3 ms·
conflating the specific binary instantiation with the general cryptosystem. Regardless, depending on your threat model, you can take increasingly { reasonable
by ajamesm 10y ago
conflating the specific binary instantiation with the general cryptosystem. Regardless, depending on your threat model, you can take increasingly { reasonable | paranoid } precautions like manually compiling and loading Signal, as it's OSS.
edit: "private group" can encompass a lot, especially in other ecosystems like Google and FB. If said "private group" adversary is, say, a prominent and wealthy Silicon Valley businessman and enterprising vampire who collaborates with fascists, then you can see the potential of compromising someone's security by coercing Google or Facebook engineers to run you a Hadoop query or conditionally inject malicious JS.
- kuschku 10y ago> like manually compiling and loading Signal, as it's OSS. Except, I’d have to modify the code, as the current version depends on Google’s proprietary libs, which I can’t inspect. And I lose half of the functionality, as RedPhone is also proprietary. > by coercing Google or Facebook engineers to run you a Hadoop query or conditionally inject malicious JS. The same can be done by coercing OWS engineers to backdoor their services. And in any case, Signal can start collecting metadata any minute now, and there’s nothing we could do against it.
- temprature 10y ago> And I lose half of the functionality, as RedPhone is also proprietary. The source code for the Redphone client is here: https://github.com/WhisperSystems/Signal-Android/tree/master/src/org/thoughtcrime/redphone https://github.com/WhisperSystems/Signal-Android/tree/master... The source code the redphone-audio library is here: https://github.com/WhisperSystems/Signal-Android/tree/master/jni/redphone https://github.com/WhisperSystems/Signal-Android/tree/master... Stop spreading misinformation.
- kuschku 10y agoSo it finally got opened? Still doesn’t help me, considering that the Firebase Messaging library compiled into the client is still proprietary. I can not build Signal from source today.