<p>As per the discussion on answers, especially <a href="https://bitcoin.stackexchange.com/a/115690/35931">Murch's</a>, the answer seems to be there is no trust model. Bitcoin users MUST be able to understand the code they are running, otherwise are insecure.</p>

CC BY-SA 4.0
2022-10-27T12:51:34.407Z
2022-10-27T12:51:34.407Z
skang404
<p>As @1440000bytes already mentioned, Bitcoin doesn't have an official website, although there are numerous sites run by various individuals. Some projects have their own websites such as <a href="https://bitcoincore.org" rel="nofollow noreferrer">bitcoincore.org</a>.</p>
<p>The final version of the release will be tagged and signed by one of the maintainers whose keys are listed in <a href="https://github.com/bitcoin/bitcoin/blob/master/contrib/verify-commits/trusted-keys" rel="nofollow noreferrer">bitcoin/blob/master/contrib/verify-commits/trusted-keys</a>. Release candidates are then built by many volunteers from the source code in parallel in our deterministic build process to compare that they create the same binary. The builders' keys, attestations, and instructions how to verify them are found in the <a href="https://github.com/bitcoin/bitcoin/blob/master/doc/release-process.md#verify-other-builders-signatures-to-your-own-optional" rel="nofollow noreferrer">release process document</a>. You can find a description of the process here: <a href="https://bitcoin.stackexchange.com/a/110517/5406">https://bitcoin.stackexchange.com/a/110517/5406</a></p>
<p>Older versions of Bitcoin Core releases were signed with the <a href="https://github.com/bitcoin/bitcoin/blob/7fcf53f7b4524572d1d0c9a5fdc388e87eb02416/contrib/verifybinaries/README.md" rel="nofollow noreferrer">release signing key</a>.</p>
<p>If so inclined, you will find that many of these keys, especially the release signing key, are attested to by other  Bitcoin Core contributors. If this does not suffice, you could put the key into your web of trust by attending a key signing party at a Bitcoin conference.</p>

CC BY-SA 4.0
2022-10-26T00:19:52.200Z
Thanks. I will accept this as an answer if you could please edit it to say the model is 'web of trust facilitated by in-person key signing ceremony' part only, since the rest of the answer highlights the issue with third party websites. Also, if you could please add how/if this web of trust leads back to Satoshi.
skang404
CC BY-SA 4.0
2022-10-26T14:20:59.400Z
While Satoshi had a pgp key on one of his profiles, Satoshi never publicly signed anything except his Bitcoin transactions. I don't agree that my answer summarizes to “it boils down to web of trust”. Rather, most people appear to trust that the release process facilitated per the GitHub repository is not compromised. If you feel that you have a better answer, please write your own.
Murch
CC BY-SA 4.0
2022-10-24T18:38:21.053Z
2022-10-25T15:04:18.233Z
2022-10-25T15:04:18.233Z
Murch
<p>Bitcoin.org seems to be hacked.</p>
<ol>
<li>How can it be reclaimed, especially since the listed address is receiving a lot of funding?</li>
<li>More importantly, what is the procedure for a new user in establishing trust for bitcoin-related-software(keys for core client, websites etc.)?</li>
</ol>

<bitcoin-core-development><trust><websites>
What is the trust model in bitcoin?
skang404
# What is the trust model in bitcoin?

(Asked by: username_0 on 2022-10-15)

Bitcoin.org seems to be hacked.

1. How can it be reclaimed, especially since the listed address is receiving a lot of funding?
2. More importantly, what is the procedure for a new user in establishing trust for bitcoin-related-software(keys for core client, websites etc.)?

**Tags:** bitcoin-core-development, trust, websites


---

## 2 answers

### Answer by username_0 on 2022-10-27. Score: -3 | Accepted answer

As per the discussion on answers, especially [username_1's](https://bitcoin.stackexchange.com/a/115690/35931), the answer seems to be there is no trust model. Bitcoin users MUST be able to understand the code they are running, otherwise are insecure.


---

### Answer by username_1 on 2022-10-24. Score: 1

As @1440000bytes already mentioned, Bitcoin doesn't have an official website, although there are numerous sites run by various individuals. Some projects have their own websites such as [bitcoincore.org](https://bitcoincore.org).

The final version of the release will be tagged and signed by one of the maintainers whose keys are listed in [bitcoin/blob/master/contrib/verify-commits/trusted-keys](https://github.com/bitcoin/bitcoin/blob/master/contrib/verify-commits/trusted-keys). Release candidates are then built by many volunteers from the source code in parallel in our deterministic build process to compare that they create the same binary. The builders' keys, attestations, and instructions how to verify them are found in the [release process document](https://github.com/bitcoin/bitcoin/blob/master/doc/release-process.md#verify-other-builders-signatures-to-your-own-optional). You can find a description of the process here: <https://bitcoin.stackexchange.com/a/110517/5406>

Older versions of Bitcoin Core releases were signed with the [release signing key](https://github.com/bitcoin/bitcoin/blob/7fcf53f7b4524572d1d0c9a5fdc388e87eb02416/contrib/verifybinaries/README.md).

If so inclined, you will find that many of these keys, especially the release signing key, are attested to by other Bitcoin Core contributors. If this does not suffice, you could put the key into your web of trust by attending a key signing party at a Bitcoin conference.

> **Comments:**
> **username_0**: Thanks. I will accept this as an answer if you could please edit it to say the model is 'web of trust facilitated by in-person key signing ceremony' part only, since the rest of the answer highlights the issue with third party websites. Also, if you could please add how/if this web of trust leads back to Satoshi.  
> **username_1**: While Satoshi had a pgp key on one of his profiles, Satoshi never publicly signed anything except his Bitcoin transactions. I don't agree that my answer summarizes to “it boils down to web of trust”. Rather, most people appear to trust that the release process facilitated per the GitHub repository is not compromised. If you feel that you have a better answer, please write your own.  

---

