4 ms·
Sure, but the Signal source code is open source. I've been compiling it myself for years on Android (and signing the binary with my own key). They can't silentl
by aorth 7y ago
Sure, but the Signal source code is open source. I've been compiling it myself for years on Android (and signing the binary with my own key). They can't silently push a binary from the Play Store and overwrite my binary.
- zzzcpan 7y agoThey still can for everyone else, probably everyone you talk to over Signal, so not much of a protection. Pretty much the only way to avoid that is for Signal to give up that control, don't supply Signal directly and let others build Signal from sources and publish in independent from Signal package repositories, i.e. f-droid, OS package managers on Linux, etc. Even if they don't federate, it will at least make their end-to-end encryption sound, not useless like it is now when everyone uses Signal supplied binaries.
- 6gvONxR4sf7o 7y agoPresumably, for most of us here, even if we compiled it ourselves, most of the people we'll communicate with won't.
- abledon 7y agoDude, I can only imagine what you are doing that you need to be so secretive lol
- aorth 7y agoI think "trust, but verify" and "verifiable security" are good axioms.