+ {{ content }}
+
+{% translate download-bitcoin-core bitcoin-core-overview %}
+ 
+ 
+ 
+
diff --git a/_includes/layout/base-core/head-menu.html b/_includes/layout/base-core/head-menu.html
new file mode 100644
index 00000000..1a9e578c
--- /dev/null
+++ b/_includes/layout/base-core/head-menu.html
@@ -0,0 +1,29 @@
+{% comment %}
+This file is licensed under the MIT License (MIT) available on
+http://opensource.org/licenses/MIT.
+{% endcomment %}
+
+
+
+ 
{% translate about1 %}
+{% translate about2 %}
+ +{% translate about3 %}
+ +{% translate about4 %}
+ + {% comment %} + + {% endcomment %} + {% if page.lang == "en" %} +In addition to improving Bitcoin's decentralization, Bitcoin Core users get + better security + for their bitcoins, + privacy features + not available in other wallets, a choice of + user interfaces, + and several other powerful features.
+ {% else %} +{% translate about5 %}
+ {% endif %} ++ {% translate download-bitcoin-core %}
+{% endif %} + +{% translate more-news-and-rss %}
+ +{% translate summary %}
+{% if page.lang != 'en' %}{% translate summary %}
{% endif %} + +{% translate involvetxt1 development %}
+{% translate involvetxt2 development %}
+ + +{% capture markdown %} + *To report an issue, +please see the [bug reporting][bcc contribute issues] page.* + +## Code Review + +Bitcoin Core is security software that helps protect assets worth +billions of dollars, so every code change needs to be reviewed by +experienced developers. + +It can take a long time for other developers to review your pull +requests. Remember that all reviewers are taking time away from their +own projects to review your pull requests, so be patient and respectful +of their time. + +Please also consider helping to review other people's pull requests. You +don't need to be an expert in Bitcoin, the Bitcoin Core codebase, or C++ +(although all these things help). There are almost always [open pull +requests][bcc pulls] that any programmer can review. + +## Starter Projects + +Do you want to begin coding for Bitcoin Core but don't have a specific +improvement in mind? Here are a few ideas: + +- **Fix existing issues:** the [issue tracker][bcc issues] is the + best place to find a useful way to contribute to Bitcoin Core. + Before starting to write any patches for issues you find, you may + want to comment on the issue to make sure nobody else is already + working on it. + +- **Write tests:** Bitcoin Core is covered by many tests, but patches + that improve test coverage are always welcome and are a great way to + build familiarity with the codebase. See the documentation about + [automated testing][bcc automated testing]. + +{% include references.md %} +{% endcapture %} +{% if page.lang == 'en' %} + {{ markdown | markdownify }} +{% endif %} +{% translate spectxt %}
-{% translate inventor %}
+{% translate inventor %}
-bitcoin-security@lists.sourceforge.net
-{% translate disclosuretxt %}
- -{% translate involvetxt1 %}
-{% translate involvetxt2 %}
- - -{% translate morechoose %}
- -bitcoin-security@lists.sourceforge.net
+{% translate disclosuretxt %}
+{% endif %}+{% case page.lang %} +{% when 'id' or 'da' or 'de' or 'es' or 'fr' or 'it' or 'hu' or 'nl' or 'pl' or 'pt_BR' or 'ro' or 'sl' or 'sv' or 'tr' or 'el' or 'bg' or 'ru' or 'uk' or 'ar' or 'fa' or 'hi' or 'ko' or 'ja' or 'zh_CN' or 'zh_TW' %} +{% else %} +Want to contribute to a different project? +{% endcase %} +{% translate morechoose %}
+ +bitcoin-security@lists.sourceforge.net
+{% translate disclosuretxt development %}
+ +{% include bitcoin-core/core-committers.html %} + +## Public Issue Tracking + +For non-security problems with Bitcoin Core, please [search for similar +issues][bcc issues] and, if you don't find any, [open a new issue][bcc +new issue] providing the information listed below. + +1. A clear description of the problem. If possible, please describe how + to reproduce the problem. (For general guidelines on writing steps + to reproduce, see [Mozilla's bug reporting documentation][].) + +2. What version of Bitcoin Core you use (if you downloaded from + Bitcoin.org) or what commit you built using (`git log -1`) plus any + extra patches you applied. + +3. Any relevant entries from your `debug.log` file. Note, this file can + contain private information, so review it before posting or ask in + the issue to email it directly to a developer rather than posting + publicly. You can publicly post logs on a [0bin service][0bin]. By + default, the `debug.log` can be found at the following locations: + + - Windows: `%APPDATA%\Bitcoin\debug.log` + + - OS X: `$HOME/Library/Application Support/Bitcoin/debug.log` + + - Linux: `$HOME/.bitcoin/debug.log` + +The best strategy to get your issue fixed quickly is to make it as easy +as possible for the development team to track down the problem and +write a fix. Providing more information and organizing it well helps +significantly. + +
+ 
+ 
+ 
+ 
+
+Click an entry below to show it:
+
+{% for service in page.third_party_privacy %}
+ {% if service.name != 'Bitcoin Core' %}
+
+ {% endif %}
+{% endfor %}
+
| Who knows your information? **Just you**{:.fggreen} or also a **service provider?**{:.fgred} | +||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| + {% for service in page.third_party_privacy %} + {% if service.name %} + | {{service.name}} | + {% else %} + {% die "Some service doesn't have a name" %} + {% endif %} + {% endfor %} +|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Your real name | + {% for service in page.third_party_privacy %} + {% case service.tracks_real_names %} + {% when "yes" %} ++ {% when "no" %} + | + {% when "maybe" %} + | + {% else %} + {% die "missing service information" %} + {% endcase %} + {% endfor %} + | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Your bitcoin balance | + {% for service in page.third_party_privacy %} + {% case service.knows_your_bitcoin_balance %} + {% when "yes" %} ++ {% when "no" %} + | + {% when "maybe" %} + | + {% else %} + {% die "missing service information" %} + {% endcase %} + {% endfor %} + | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Who you pay, and/or who pays you (in some cases) | + {% for service in page.third_party_privacy %} + {% case service.tracks_payments %} + {% when "yes" %} ++ {% when "no" %} + | + {% when "maybe" %} + | + {% else %} + {% die "missing service information" %} + {% endcase %} + {% endfor %} + | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| How much you spend and/or receive | + {% for service in page.third_party_privacy %} + {% case service.tracks_amounts %} + {% when "yes" %} ++ {% when "no" %} + | + {% when "maybe" %} + | + {% else %} + {% die "missing service information" %} + {% endcase %} + {% endfor %} + | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| The IP address your connection came from | + {% for service in page.third_party_privacy %} + {% case service.tracks_ip_addresses %} + {% when "yes" %} ++ {% when "no" %} + | + {% when "maybe" %} + | + {% else %} + {% die "missing service information" %} + {% endcase %} + {% endfor %} + | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Who can guess your information? **Just you**{:.fggreen} or also **people + you trade with?**{:.fgred} | +||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| + {% for service in page.third_party_privacy %} + {% if service.name %} + | {{service.name}} | + {% else %} + {% die "Some service doesn't have a name" %} + {% endif %} + {% endfor %} +|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Other transactions you made or received | + {% for service in page.third_party_privacy %} + {% case service.susceptible_to_taint_analysis %} + {% when "yes" %} ++ {% when "no" %} + | + {% when "maybe" %} + | + {% else %} + {% die "missing service information" %} + {% endcase %} + {% endfor %} + | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| **Ask bankers**{:.fgred} They'll monitor your every transaction |
+
+ **Ask random nodes**{:.fgred} Some of which sell your data |
+
| **Ask a free service**{:.fgred} (Actually, some do care about privacy) |
+
+ **Get all {{site.text.total_tx_count_in_millions}} million transactions**{:.fggreen} For **perfect** receiving privacy **Bitcoin Core** |
+
| P2P Lightweight Wallets | +Bitcoin Core | +
|---|---|
| Asks the same centralized services every time program is + restarted. This can be faster. | + +Uses the peer-to-peer network to independently discover new + peers. Uses found peers on restart. | +
| Attack | +Bank Wallet | +SPV Wallet | +Bitcoin Core | +
|---|---|---|---|
| Direct theft | ++ | + | + |
|
+> Alice deposits 100 bitcoins to Bank.Example.com. The next day, the
+> owners of the site disappear with Alice's money.
+
+- **Bitcoin bank**{:.fgred} users are vulnerable to direct theft because
+ they don't control their own private keys.
+
+- **Lightweight (SPV) wallet**{:.fggreen} users and **Bitcoin
+ Core**{:.fggreen} users are not vulnerable because they control their
+ own private keys.
+
+
+Direct theft is likely the leading cause of stolen bitcoins so far.
+
+
+### Real Example
+
+Bitcoin exchange Mt Gox reportedly had 650,000 bitcoins (worth $347
+million USD) stolen from their customer deposits and their own operating
+funds. They declared bankruptcy on 28 February 2014.
+
+Even when the bankruptcy proceeding is complete, customers are unlikely to
+recover more than a small fraction of the bitcoins they had on deposit.
+
+**Learn More:** [Collapse of Mt
+Gox](https://en.bitcoin.it/wiki/Collapse_of_Mt._Gox)
+ |
+|||
| Bait and switch | ++ | + | + |
|
+> Alice installs Example Wallet, whose open source code has been
+> audited. The next day, the authors of Example Wallet push new code to
+> Alice's device and steal all her bitcoins.
+
+- **Bitcoin bank**{:.fgred} users are vulnerable because they can only
+ spend their bitcoins when they use the bank's approved software.
+
+- **Lightweight (SPV) wallet**{:.fgyellow} users are vulnerable with
+ most software because auditors can't easily verify the software you
+ run (the executable) is the same as the program source code, called a
+ deterministic build. However, some lightweight wallets are moving to
+ deterministic builds.
+
+- **Bitcoin Core**{:.fggreen} is built deterministically. Cryptographic
+ signatures from build auditors---many of whom are well known to the
+ community---are [released publicly][gitian sigs].
+
+
+Bitcoin.org's [Choose Your Wallet][] page tells you whether or not
+wallet builds are audited in the *Transparency* score for each wallet.
+
+
+### Real Example
+
+In April 2013, the OzCoin mining pool was hacked. The thief stole 923
+bitcoins (worth $135,000 USD), but online wallet StrongCoin modified
+their wallet code to 'steal back' 569 of those bitcoins ($83,000)
+from one their users who was suspected of the theft.
+
+Although this attack was done with good intentions, it illustrated
+that the operators of StrongCoin could steal bitcoins from their users
+at any time even though the users supposedly controlled their own
+private keys.
+
+**Learn More:** [OzCoin Hacked, Stolen Funds Seized and Returned by StrongCoin](https://bitcoinmagazine.com/4273/ozcoin-hacked-stolen-funds-seized-and-returned-by-strongcoin/)
+ |
+|||
| Fabricated transactions | ++ | + | + |
|
+> Mallory creates a transaction giving Alice 1,000 bitcoins, so Alice
+> gives Mallory some cash. Later Alice discovers the transaction Mallory
+> created was fake.
+
+- **Bitcoin bank**{:.fgred} users depend on the information reported by the
+ bank, so they can easily be fooled into accepting fabricated
+ transactions.
+
+- **Lightweight (SPV) wallet**{:.fgred} users depend on full nodes and
+ miners to validate transactions for them. It costs nothing for
+ dishonest full nodes to send unconfirmed fabricated transactions to an
+ SPV wallet. Getting one or more confirmations of those fabricated
+ transactions is also possible with help from a dishonest miner.
+
+- **Bitcoin Core**{:.fggreen} users don't have to worry about fabricated
+ transactions because Bitcoin Core validates every transaction before
+ displaying it.
+
+
+Currently the best defense against fabricated transactions, besides
+using Bitcoin Core, is to wait for as many confirmations as possible.
+
+
+### Real Example
+
+On 4 August 2015, web wallet BlockChain.info began indicating that a
+transaction had spent the earliest mined 250 bitcoins, coins that some
+people believed were owned by Bitcoin creator Satoshi Nakamoto.
+
+It was soon discovered that the transaction was invalid. BlockChain.info
+was not validating transactions with Bitcoin Core and that transaction
+had been [created by a security researcher][fake satoshi transaction].
+
+**Learn more:** [BitcoinJ documentation about pending transaction
+safety][]
+
+ |
+|||
| Chain hijacking | ++ | + | + |
|
+> Alice believes that there should never be more than 21 million
+> bitcoins---but one day she's tricked into buying "bitcoins" that
+> are only valid on a block chain with permanent 10% inflation.
+
+- **Bitcoin bank**{:.fgred} users have to use whatever block chain the
+ bank uses. Banks can even profit from switching their users to a new
+ chain and selling their users' bitcoins from the old chain.
+
+- **Lightweight (SPV) wallet**{:.fgred} users accept the block chain
+ they know about with the most proof of work. This lets the hash rate
+ majority of miners force SPV wallet users off of Bitcoin.
+
+- **Bitcoin Core**{:.fggreen} users don't have to worry about chain
+ hijacking because Bitcoin Core validates every block using *all* of
+ Bitcoin's consensus rules.
+
+
+Preventing chain hijacking is one of Bitcoin Core's most important jobs.
+The alternative is to allow miners to do whatever they want.
+
+
+### Real Example
+
+In July 2015, several large Bitcoin miners accidentally produced an
+invalid block chain several blocks longer than the correct block chain.
+Some bank wallets and many SPV wallets accepted this longer chain,
+putting their users' bitcoins at risk.
+
+Recent versions of Bitcoin Core never accepted any of the blocks from
+the invalid chain and never put any bitcoins at risk.
+
+It is believed that the miners at fault controlled more than 50% of the
+network hash rate, so they could have continued to fool SPV wallets
+indefinitely. It was only their desire to remain compatible with
+Bitcoin Core users that forced them to abandon over $37,500 USD worth of
+mining income.
+
+**Learn more:** [July 2015 chain forks][]
+ |
+|||
| Transaction withholding | ++ | + | + |
|
+> Mallory shows Alice $1,000 USD that he will pay her if she sends him some
+> bitcoins. Alice sends the bitcoins but the transaction never seems to
+> confirm. After waiting a long time, Alice returns Mallory's cash. It
+> turns out the transaction did confirm, so Alice gave away her bitcoins
+> for nothing.
+
+- **Bitcoin bank**{:.fgred} users only see the transactions the bank
+ choose to show them.
+
+- **Lightweight (SPV) wallets**{:.fgred} users only see the
+ transactions their full node peers choose to send them, even if those
+ transactions were included in a block the SPV wallet knows about.
+
+- **Bitcoin Core**{:.fggreen} users see all transactions included in
+ received blocks. If Bitcoin Core hasn't received a block for too long,
+ it displays a catching-up progress bar in the graphical [user
+ interface][bcc user interface] or a warning message in the CLI/API user
+ interface.
+
+
+Unless you use Bitcoin Core, you can never be sure that your bitcoin balance
+is correct according to the block chain.
+
+
+### Real Example
+
+In March 2015, spy nodes run by the company Chainalysis accidentally
+prevented some users of the lightweight BreadWallet from connecting to
+honest nodes. Since the spy nodes didn't relay transactions, BreadWallet
+users stopped receiving notification of new transactions.
+
+**Learn more:** [Chainalysis CEO Denies 'Sybil Attack' on Bitcoin's Network](http://www.coindesk.com/chainalysis-ceo-denies-launching-sybil-attack-on-bitcoin-network/)
+ |
+|||
| Chain rewrites | ++ | + | + |
| +> Mallory gives Alice 1,000 bitcoins. When Alice's wallet says the +> transaction is confirmed, Alice gives Mallory some cash. Later Alice +> discovers that Mallory has managed to steal back the bitcoins. + +This attack applies to **all Bitcoin wallets.**{:.fgred} + +The attack works because powerful miners have the ability to rewrite the +block chain and replace their own transactions, allowing them to take +back previous payments. + +The cost of this attack depends on the percentage of total network hash +rate the attacking miner controls. The more centralized mining becomes, +the less expensive the attack for a powerful miner. + + + +### Real Example + +In September 2013, someone used centralized mining pool GHash.io to +steal an estimated 1,000 bitcoins (worth $124,000 USD) from the gambling +site BetCoin. + +The attacker would spend bitcoins to make a bet. If he won, he would +confirm the transaction. If he lost, he would create a transaction +returning the bitcoins to himself and confirm that, invalidating the +transaction that lost the bet. + +By doing so, he gained bitcoins from his winning bets without losing +bitcoins on his losing bets. + +Although this attack was performed on unconfirmed transactions, the +attacker had enough hash rate (about 30%) to have profited from +attacking transactions with one, two, or even more confirmations. + +**Learn more:** [GHash.IO and double-spending against BetCoin +Dice][ghash betcoin double spend] + | +|||
| *Users of Bitcoin banks* **Trust bankers**{:.fgred} |
+
+ *Users of P2P lightweight wallets* **Trust miners**{:.fgred} |
+
| *Users of client lightweight wallets* **Trust "free" services**{:.fgred} |
+
+ *Users of Bitcoin Core* **Enforce the rules**{:.fggreen} |
+