3 ms·
The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.
by AJ007 11y ago
The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.
- russell_h 11y agoSimply open sourcing the code doesn't give that validation.
- AckSyn 11y agoNot completely but I can certainly look at it, compile, and then side-load it onto my device knowing it's what it said it was.
- brianacton 11y agoThis is literally an impossibility. Java apps are typically obfuscated with randomization of symbol names. Each build is unique and not reproducible. You are better off verifying the actual compiled and distributed apk files than verifying the source.
- danjoc 11y agoIt's impossible? https://whispersystems.org/blog/reproducible-android/ https://whispersystems.org/blog/reproducible-android/