> verify the open source code The argument here is that open source code can be verified where closed source is explicitly non-verifiable by nature. > but tha

> verify the open source code The argument here is that open source code can be verified where closed source is explicitly non-verifiable by nature. > but that the binary was built from this code Doesn't code signing address this? If not could you explain (for my own learning)? https://en.wikipedia.org/wiki/Code_signing https://en.wikipedia.org/wiki/Code_signing > that your operating system and every layer below it is also trustworthy. Yep, this is the last major piece for true security in my mind. Although there is some movement in the open hardware space as well as USB mounted OSs (http://gizmodo.com/try-the-super-secure-usb-drive-os-that-edward-snowden-i-1563320487 http://gizmodo.com/try-the-super-secure-usb-drive-os-that-ed...). > I stand by my claim that using software written by a malicious developer is game over in the vast majority of contexts. Sure...perfectly accurate...but in the context you are implying that WhatsApp is malicious. To which I think "hackuser" was interpreting as "closed source is malicious" and therefore offering open source (and by implication Signal) as an alternative. Might just be a miscommunication moment :-)