monero-project / monero-site

https://getmonero.org
BSD 3-Clause "New" or "Revised" License
275 stars 384 forks source link

Add Monero.com wallet #2007

Closed SamsungGalaxyPlayer closed 1 year ago

netlify[bot] commented 2 years ago

Deploy Preview for barolo-time-757cf9 ready!

Built without sensitive environment variables

Name Link
Latest commit 900d41449ecdf0a168ad0c7e565d1fd76742ab0a
Latest deploy log https://app.netlify.com/sites/barolo-time-757cf9/deploys/635026defa18e8000864e1db
Deploy Preview https://deploy-preview-2007--barolo-time-757cf9.netlify.app
Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

plowsof commented 2 years ago

a compromise could be to change the URL of the existing Cake wallet link to monero.com -> then users will see both (and that one is multi coin / the other monero only)

Or if there was an extra column added to getmonero stating which wallets are multi coin or monero only (e.g. edge is a multi coin wallet iirc)

SamsungGalaxyPlayer commented 2 years ago

Considering we made a Monero-only wallet specifically to address the desires of many vocal Monero community members, I think both apps are very relevant. Both Monero.com and Cake Wallet and highly-regarded wallets in the community, and excluding one for irrelevant reasons is pretty tragic.

If someone asked "should Monero.com wallet be listed on the getmonero.org website", the obvious answer is that yes, it should. Same for Cake Wallet. Excluding them just because they share the same codebase is dumb; they're 2 wallets focused on 2 different audiences of Monero users. It's like saying we shouldn't list any wallet2 app because the use the same Monero wallet lib. Who cares? People just want links to good apps.

erciccione commented 2 years ago

@SamsungGalaxyPlayer you should disclose that you are currently an employer of Cake wallet, so people reading know you have high interest in this pr being merged.

We are talking of 2 wallets that share the same logo, owner, development and fundamental code. The reference to wallet2 is nonsense. This PR is just a way to double cake's visibility in this crucial section on the website, but the request has no merits.

If tomorrow cake wallet decides to fork again their wallet and launch a copy with a little game in it, should we list that as well or would be unfair to Monero users?

I like @plowsof's suggestion of listing only monero.com, since it includes links to the multi-purpose cake wallet.

Thinking about it. Having a separated directory for multi-wallet could be a good idea as well.

SamsungGalaxyPlayer commented 2 years ago

Your recommendation is to remove Cake Wallet? How would that make sense?

plowsof commented 2 years ago

i suggested (what i think to be) the path of least resistance (not delete cake wallet xD ) -> simply change the URL that Cake wallet currently links to, to monero.com (while this issue is being worked out) I think everyone can agree on this? ideally there would also be a ( Download ) button, top right @ monero.com that takes the user to the part of the page which shows the Monero.com / Cake Wallet side by side.

edit: see @MajesticBank s message , everyone can not agree on the above ^ , i guess we are deadlocked here (i forgot about the "monero.com" url relevance hmm

johnr365 commented 2 years ago

This PR is just a way to double cake's visibility in this crucial section on the website, but the request has no merits.

@erciccione - I disagree. As @SamsungGalaxyPlayer correctly points out, the Monero.com wallet was a direct response to the community, of whom a significant number were uncomfortable with Cake wallet potentially supporting Zcash or other tokens.

They haven't created it simply for marketing.

If tomorrow cake wallet decides to fork again their wallet and launch a copy with a little game in it, should we list that as well or would be unfair to Monero users?

In the list that Justin is proposing to add the Monero.com wallet (mobile wallets w/ local sync) there's only 3 wallets; Cake, Feather and Monerujo.

Feather is desktop only. Monerujo is Android only. Therefore only Cake supports iOS. As of now there are no options in that list which are stand alone Monero wallets and support iOS. Thus, I disagree that this is duplication.

erciccione commented 2 years ago

They haven't created it simply for marketing.

I never claimed it was created for marketing. I see your points @johnr365, but you are not really addressing mine. The only way i see this to make sense is to have a dedicated category for multiple wallets, where cake fits, while monero.com is displayed normally. My intention is only to avoid that aggressive marketing tactics will result in an unfair situation for the other wallets listed, but i'm not going to spend further time on this, my opinion is clear.

johnr365 commented 2 years ago

My intention is only to avoid that aggressive marketing tactics will result in an unfair situation for the other wallets listed

I see your point.

And, as it stands, the Monero.com wallet currently offers functionality that none of the others in that list do. Namely it's the only iOS wallet that is Monero only, in the category of wallets that support local sync. Which is the category that the PR seeks to edit.

So I don't think it's unfair on the other wallets

If tomorrow cake wallet decides to fork again their wallet and launch a copy with a little game in it, should we list that as well or would be unfair to Monero users?

To your point about wallets "gaming the system" - won't it be fairly clear if this is the case in the future?

Isn't it getting ahead of ourselves to penalize Cake/Monero.com in anticipation of a future event that hasn't yet happened, and can be addressed on an individual basis if and when it does?

MajesticBank commented 2 years ago

From my point of view current website represent accurately wallets available, no further changes needed.

Owning monero.com and not giving it back to the project is not something I like too much.

Said that monero.com shouldn't be referred anywhere on the getmonero.org website as it's misleading and people might think monero.com is official domain.

By observing the difference between https://cakewallet.com/ and https://monero.com/ website it's obvious the primary goal of monero.com is not wallet website but an exchange and "coin" website.

Probably the order of wallets should be different only

Feather wallet CakeWallet Monerujo

Or

Feather wallet Monerujo CakeWallet

CakeWallet commented 2 years ago

From my point of view current website represent accurately wallets available, no further changes needed.

Owning monero.com and not giving it back to the project is not something I like too much.

Said that monero.com shouldn't be referred anywhere on the getmonero.org website as it's misleading and people might think monero.com is official domain.

By observing the difference between https://cakewallet.com/ and https://monero.com/ website it's obvious the primary goal of monero.com is not wallet website but an exchange and "coin" website.

Probably the order of wallets should be different only

Feather wallet CakeWallet Monerujo

Or

Feather wallet Monerujo CakeWallet

We have been giving since 2018 to this community through various routes as everyone in the community knows, so making the accusation that we don't give back to the community is misguided. Monero.com was for sale for many years and no one bought it. If the monero dot com app, a Monero only open source app built by the request of the community should not be listed here, I don't know what should.

erciccione commented 2 years ago

Discussion continued on #monero-site.

I'm struggling to receive an answer from this question, so i try here as well since it's important:

@CakeWallet @SamsungGalaxyPlayer It was pointed out that currently both cake and monero.com ping a cake's server at startup. It was requested to remove this "feature" (https://github.com/cake-tech/cake_wallet/issues/280), but that issue is currently stalling, while Cake's privacy policy was modified to allow collecting user's data.

Could you clarify what data do you collect (or can potentially collect) from users?

erciccione commented 2 years ago

FYI i change my stance from agreeing with listing monero.com as a monero wallet and cake as a multi-coin wallet on getmonero.

After the recent discussion in #monero-sitte, i'm much more inclined to not accept monero.com until they make clear at the top of their website that monero.com is maintained by a private company, as others are also requesting in the chat, and i would like to know what private info they are able to collect from users.

monero.com was announced as simply a monero-only wallet, but yesterday it was defined in a very different way from Cake people:

the point of monero.com is to help promote the commercial nature of monero

This is very different from what has been marketed by Cake until now and rises exponentially the risk of monero.com being mistaken by monero users for an official website.

Contacting coingecko and making them remove monero.com from the "website" section of Monero would be also appreciated, since no other project on coingecko lists a private third-party website beside the project's website. I'm sure you don't want people to mistakenly think monero.com is an official website :)

CakeWallet commented 2 years ago

FYI i change my stance from agreeing with listing monero.com as a monero wallet and cake as a multi-coin wallet on getmonero.

After the recent discussion in #monero-sitte, i'm much more inclined to not accept monero.com until they make clear at the top of their website that monero.com is maintained by a private company, as others are also requesting in the chat, and i would like to know what private info they are able to collect from users.

monero.com was announced as simply a monero-only wallet, but yesterday it was defined in a very different way from Cake people:

the point of monero.com is to help promote the commercial nature of monero

This is very different from what has been marketed by Cake until now and rises exponentially the risk of monero.com being mistaken by monero users for an official website.

Contacting coingecko and making them remove monero.com from the "website" section of Monero would be also appreciated, since no other project on coingecko lists a private third-party website beside the project's website. I'm sure you don't want people to mistakenly think monero.com is an official website :)

Responding to both your comments in one:

Firstly, the apps do ping the cake server to get fiat price ONLY. We have a pull request for a feature that will allow users to disable this in the settings. We state in our policy that we do not log any of this data, but that's not as good as allowing someone to disable it, which is why we have a PR for that which has been under review since before this discussion started

The apps do connect to nodes that we run as default. A user can add any node or even their own node under settings.

Our privacy policy was modified to make things more clear and it is very clear and honest about all the items by splitting things into specific categories. You don’t seem to have an issue with Mymonero for example, which has a far worse privacy policy.

We do not ask for or collect any information on the user or devices as stated in our privacy policy. This is mainly because none of this info is needed by a user for him/her to use the app. However, when connecting to ANY node (not just cake’s), the node knows the IP address that you connect from. This is the nature of the internet and not a Cake thing. To remediate this, there are many solutions for the user: 1. its best to use your own node 2. Use Tor 3. use a VPN.

Regarding the section what we “may” collect, has to do with when users send us support emails, thus sending us info. Of course, we know the email address that the user sent the email from. Again this is not a Cake thing, but that’s how email works. To remediate this, the user can use a burner email for support or contact us on telegram, reddit, twitter, etc.

We understand the importance of discussing our privacy policy, but I don't think this is what the pushback here is about. Cake Wallet has the same policy, and getmonero.org currently lists the clearly-worse-for-privacy apps MyMonero and Edge.

Regarding Coingecko, we had nothing to do with it, but yes sure, we can try to contact them, but we can’t control all website on the Internet what they chose to post or not.

As far as making it more clear on monero.com website, that its not the official thing, yes we can do that.

erciccione commented 2 years ago

Thanks for the clarification about what you collect @CakeWallet. I was under the impression that Cake/monero.com, like Monerujo, did't send external data unless specifically requested by the user Unfortunately the situation currently seem to revolve around trust, at least until there will be the possibility to disable sending data.

You don’t seem to have an issue with Mymonero for example, which has a far worse privacy policy.

The issue about cake's privacy policy was brought up in #monero-site. I don't really usually look into the privacy policy of a project if i have no reason to, but i'll definitely take a look at Mymonero's if it's that bad as it sounds.

Cake Wallet has the same policy, and getmonero.org currently lists the clearly-worse-for-privacy apps MyMonero and Edge

This is a good point. We should show to getmonero's visitors which wallets don't send home data by default with a logo or something. People would be able to make a more informed choice about their privacy.

As far as making it more clear on monero.com website, that its not the official thing, yes we can do that.

It would be surely appreciated.

CakeWallet commented 2 years ago

Thanks for the clarification about what you collect @CakeWallet. I was under the impression that Cake/monero.com, like Monerujo, did't send external data unless specifically requested by the user Unfortunately the situation currently seem to revolve around trust, at least until there will be the possibility to disable sending data.

What data sending are you talking about? The app doesn't send out data. It seems you are starting with mistrust and then looking for things to question. Cake has worked well for Monero users with no problems for users for close to 5 years now.

SamsungGalaxyPlayer commented 2 years ago

I was under the impression that Cake/monero.com, like Monerujo, did't send external data unless specifically requested by the use

Monerujo uses an external price API from Kraken, subject to Kraken's (a regulated exchange) privacy policy: https://www.kraken.com/en-us/legal/privacy

erciccione commented 2 years ago

Firstly, the apps do ping the cake server to get fiat price ONLY. We have a pull request for a feature that will allow users to disable this in the settings. We state in our policy that we do not log any of this data, but that's not as good as allowing someone to disable it, which is why we have a PR for that which has been under review since before this discussion started

You just said the app ping cake wallet's servers. That's the data you send and that's why you have a pr open to disable that behaviour to improve privacy. Wallets like Monerujo, the GUI and the CLI don't ping anywhere unless the user specifically request it. Am i missing something?

Monerujo uses an external price API from Kraken, subject to Kraken's (a regulated exchange) privacy policy: https://www.kraken.com/en-us/legal/privacy

The difference as far as reported is that monerujo doesn't send any data by default, but only if requested. Exactly like the GUI.

CakeWallet commented 2 years ago

Firstly, the apps do ping the cake server to get fiat price ONLY. We have a pull request for a feature that will allow users to disable this in the settings. We state in our policy that we do not log any of this data, but that's not as good as allowing someone to disable it, which is why we have a PR for that which has been under review since before this discussion started

You just said the app ping cake wallet's servers. That's the data you send and that's why you have a pr open to disable that behaviour to improve privacy. Wallets like Monerujo, the GUI and the CLI don't ping anywhere unless the user specifically request it. Am i missing something?

Yes just to get the fiat rate. That's it. Just like Monerujo. Like I said, we have a PR to make this optional.

SamsungGalaxyPlayer commented 2 years ago

We're working to add feature parity with the PR as you mentioned. If you want to make adding Monero.com to the site contingent on merging that PR, I don't see why (Cake Wallet is already here), but at least we have something to work on.

erciccione commented 2 years ago

@SamsungGalaxyPlayer as far as i can tell monero.com has received two major criticisms about being listed:

Some have requested to make very clear at the top of monero.com that it is not an official website, but operated by a third-party company. That would mitigate the first concern. About the second point, i'd say it needs more discussion.

nahuhh commented 2 years ago

I'd like to note that the reasons I treat monero.com with higher scrutiny than other wallets is because it is called monero.com.

Example: I take no issue with whatever features are added to Cake Wallet. But if it looks like a horse (monero.com looks official) it should walk like one too. If not for the monero.com name, the following wouldnt matter. (But the name is monero.com and will likely always be mistaken for the "official mobile wallet of monero" by some).

which should also remove or change relevant parts of the ui. (Exchange button removed, left cakepay screen removed or replaced with receive acreen etc).

Id like to see monero.com up there as the top recommendation.. but in its current form I dont like the misrepresentation (whether intenional or not). Misrepresentations in general with monero.com being confused as the official site by aggregators like coingecko, users as well and misrep of privacy as a result of the fiat API metadata leakage.

Adding the funky cakepay privacy policy makes me :/ wish cakewallet would do these things above and ensure monero.com is on the "monero only" side of things.

Tldr. Not just differentiating the apps, but to develop monero.com to standards of those who may confuse it for an official app.

CakeWallet commented 2 years ago

I'd like to note that the reasons I treat monero.com with higher scrutiny than other wallets is because it is called monero.com.

Example: I take no issue with whatever features are added to Cake Wallet. But if it looks like a horse (monero.com looks official) it should walk like one too. If not for the monero.com name, the following wouldnt matter. (But the name is monero.com and will likely always be mistaken for the "official mobile wallet of monero" by some).

  • id like monero.com to be bare bones "monero only".
  • ability to enable/disable the following (default disabled) Exchange Cakepay Fiat lookups Openalias, ens, unstoppable domains etc

which should also remove or change relevant parts of the ui. (Exchange button removed, left cakepay screen removed or replaced with receive acreen etc).

Id like to see monero.com up there as the top recommendation.. but in its current form I dont like the misrepresentation (whether intenional or not). Misrepresentations in general with monero.com being confused as the official site by aggregators like coingecko, users as well and misrep of privacy as a result of the fiat API metadata leakage.

Adding the funky cakepay privacy policy makes me :/ wish cakewallet would do these things above and ensure monero.com is on the "monero only" side of things.

Tldr. Not just differentiating the apps, but to develop monero.com to standards of those who may confuse it for an official app.

Thanks for the well written and constructive feedback. Will take all into consideration. This is not the place, but if you can message me on what you don't like about the CakePay privacy policy (actually its Ionia's policy) I would like to know what bothers you. Thank you again for the well thought out comments.

CryptoGrampy commented 2 years ago

I like the idea of adding in a multicoin section, and I would suggest something like 'Monero.com (by CakeWallet)' just to make it clear that these wallets are by the same company. I think so long as a wallet is open source and considered high enough quality, it should go on GetMonero. Scarcity mentality is silly and having a dozen high quality options with different tradeoffs would be an amazing situation. GetMonero is a community resource, and people should be trusted to make their own informed decisions on their wallet choices.

Just as an aside, I don't think exchange rate API requests or gift card ToC's come anywhere close to the privacy issues surrounding lightwallets and 3rd party servers; the current warning in that section doesn't go far enough in my humble opinion.

Okay one more thought - perhaps a 'privacy' column could be added that has things like 'has external api requests', 'clearnet', 'transactions logged' etc.

erciccione commented 2 years ago

Note that this conversation has sparked two related discussions:

There is also an ongoing conversation on #monero-site

SamsungGalaxyPlayer commented 1 year ago

Closing. Will re-open with another PR later, since this appears to be adequately addressed.

erciccione commented 1 year ago

@SamsungGalaxyPlayer do you plan to open a different PR? Because the entire conversation about adding this wallet is in here, opening another pr with the same content would just result in losing the conversation and the proposals of the community.

SamsungGalaxyPlayer commented 1 year ago

Yeah, eventually. I also accidentally made a commit with irrelevant info as I was preparing another PR, so this one is now messy.