4 ms·
> Next, I install signal on my phone via the app store. How do I know the app I installed matches the source code that was audited? After all, google / Apple co
by wildmanx 6y ago
> Next, I install signal on my phone via the app store. How do I know the app I installed matches the source code that was audited? After all, google / Apple could decide / be forced to provide a modified binary.
> Reproducible builds work for that.
You read the original post, right? He discusses this at length. Actually, right in the beginning.
In short, if you go through the dance of building the binary yourself to compare it to what's installed, then you could just use the binary that you just built, without ever looking at what the app store has.
- ISL 6y agoIf the app store distributes binaries to thousands of people, and only one of them rebuilds from source to check, those thousands of people gain a substantial (but not perfect) level of protection.
- ansible 6y agoYes, it would be "not community-minded" if you did a build, and it didn't match the app store, and you told no one.
- UncleEntity 6y agoSomeone, we'll call them Bob, goes to all the trouble to build the binary, finds out that it doesn't match with what the app store is distributing then just shrugs their shoulders and uses it to connect with other users in a secure messaging network because their binary is correct? What could possibly go wrong?
- rocqua 6y agoYou read my post aswell right? I don't want to check the binary myself. I want others to have that opportunity, so that tampering would be detected. I am lazy, reproducible builds let the diligent protect the lazy.