You are viewing a single comment's thread from:

RE: Hive Keychain Independent Audit Proposal

in LeoFinance3 years ago (edited)

I would not support such a proposal as you have presented it to us.

You refer to "external prices" to support your valuation but do not provide any information about them (company names, offers, ...). It would be nice to know more about the proposals you received.

You also do not provide an estimate on the volume of work that such an audit represents. It might be good to know how often Keychain undergoes updates, either to adapt to the change of the blockchain code (hardfork) or to integrate new functionalities. Have you ever inquired about this?

More important is the timing of your audit. Did you know Keychain is under heavy refactoring? It would be quite wasteful work to do an audit before this major overhaul has been done and released.

I'm also surprised you do not plan to audit Keychain Mobile and wrote in a reply you do not know if it is open-source. Yet it is easy to find (https://github.com/stoodkev/hive-keychain-mobile) as it is the last and most updated repository from @stoodkev on Github.
It would be a shame to do things halfway. While I understand that it is difficult to certify that the executed code of an application is the same as that of the repository, it would still be good to ensure that the available code is safe.

Add to this that @stoodkev does not hesitate to present himself publicly, which is not your case, and him having as good a reputation as yours, we can have good reason to trust him that he doesn't cheat when he pushes the app to the stores.

Finally, I would find it more appropriate to make a proposal to fund the initial audit once it is done and to proceed in the same way when there are updates to Keychain. If the quality of the first one is there, there should be no problem approving the following ones.