3 ms·
This is a great question. Is there a technical way to prove that an iOS or Android app is built from a specific git commit revision? And what about a web app? I
by davidhyde 7y ago
This is a great question. Is there a technical way to prove that an iOS or Android app is built from a specific git commit revision? And what about a web app? I know that these apps are signed but can a signed app be tagged with a transparent revision number which cannot be tampered with. Kind of like a sha2 hash that can be reproduced by building the same source code.
- shostack 7y agoThis is something I've wished for for a while. There are many developers out there whom I'm sure would love people to trust them and that are trustworthy. But I feel we now live in an age of "trust, but verify" and there's no great way to verify privacy claims even if we really want to believe something is benign. In some cases it may even be unintentional leaks if someone isn't aware of an issue.
- amelius 7y agoUnfortunately, there is little incentive for Apple, Google to fix this situation because the majority of people simply don't care.