I'm kinda worried about running ExploitAgency's fork (though I really like the additions). Would it be safe if I generated all my keys using his version using split key generation? Or theoretically, could he still get the full private key that way?
I'm fairly confident that the fork is legit, but want to be very safe about this. I don't have a machine that's not connected to the internet for generating keys, so that's not an option for me.
You might be able to set up a firewall rule that prevents any outgoing connections from the app via your firewall perhaps to effectively make it offline.
Clone the samr7 repo and my repo and do a diff on the code, if your running linux this is easy, else download a tool to compare files on Windows. I don't use Windows you'll have to ask someone for a suggestion or Google it. It will be easy to validate there have been no malicious changes. Also you can use something like Wireshark to see that there are no packets being sent(make sure network is not in use) or a Windows specific tool like "netstat -a -n -o" and compare the PIDs to vanitygens PID(unless running oclvanityminer you should NOT find vanitygens PID in the list) this will show vanitygen doesn't "dial out" and the command should be built into windows unless they removed it to justify a pro version.
I don't know what else to say other than trust no one and investigate things for yourself. It is an open source project. Look at the code and compile it yourself. I provided binaries to be helpful as most people who use Windows struggle to get things to compile.
Download one of those firewalls that warns every time a new program tries to make an internet connection, I like that idea too.
I strongly encourage users to encrypt their private keys. I don't want to see anything happen to someones coins. Always practice common sense security. Using the -E option and specifying the password as an argument with the command just so happens to save that password to your command history. I encourage you to use the -e option which prompts for the password input thus not saving a password to decrypt your private key in the command history. I care about security, I put that tip right in the readme. Thats all I can say, investigate things and then vouch for me when you come back and post a thumbs up :-).
Someone please audit my code i need testers!
There is no good gpu passthrough for vm's but you can run intel's opencl runtime and do opencl on the cpu for testing and checking security. This is how I am testing my windows binaries.
