5 ms·
In what way is the comment misleading? While "Telegram" might refer to "the Telegram app" or "the Telegram service", when talking about open-source, it nearly a
by ivanbakel 6y ago
In what way is the comment misleading? While "Telegram" might refer to "the Telegram app" or "the Telegram service", when talking about open-source, it nearly always refers to the service. Of the two, the source of the central server is arguably much more important, since it's possible to at least track if the app tries to exfiltrate any data.
- eznzt 6y agoThe source of the central server is useless since if they release it there is no way to prove they are running the same software on their servers.
- ivanbakel 6y agoThe source isn't "useless", it allows you to run your own server.
- romwell 6y agoYeah, and then you need to modify the client to use that server, have everyone you communicate with install that client, and also not brand it as "Signal" because it has nothing to do with the Signal network anymore, and you can't communicate with "regular" Signal users. So, from the point of view of anyone using the Signal service, the utility of the source is near-useless.
- NateEag 6y agoSignal has a fascinating blog post from 2017 about how to use Intel's Software Guard Extensions (SGX) to actually let clients confirm that the software they're communicating with is the exact version they expect it to be. https://signal.org/blog/private-contact-discovery/ https://signal.org/blog/private-contact-discovery/ SGX is definitely not bulletproof (https://medium.com/@maniacbolts/signal-increases-their-reliance-on-sgx-f46378f336d3 https://medium.com/@maniacbolts/signal-increases-their-relia...), but it exists to do exactly this job, and Signal is using it.
- leetcrew 6y agoin this case, shouldn't the client code be enough to show that bona fide E2E is happening?