4 ms·
Are you running an open client? Is anyone? That's all a smoke screen. Nobody is running an open client with a reproducible build, everybody is running whatev
by jki275 6y ago
Are you running an open client? Is anyone?
That's all a smoke screen. Nobody is running an open client with a reproducible build, everybody is running whatever version is downloaded from their app store of choice.
It's not special, and I don't trust it a bit.
- monocasa 6y agoThe point of reproducible builds isn't to run an open client, but validate that their copy in the app store matches the source they say it does.
- jki275 6y agoBut nobody actually does that.
- 10000truths 6y agoNot manually, perhaps. But automated integrity checks of reproducible builds are trivial to write.
- cyphar 6y agoHave you personally done that? Do you know of anyone who is doing that and publicly tracks said verification? It doesn't matter how trivial it would be to verify if nobody is actually doing the verification (not to mention you'd actually want many people doing it and publicly posting their verification, as well as you checking that your hash matches everyone else's before installing the APK -- and there is no automated setup for doing that on Android.)
- jki275 6y agoI don't think any significant number of people do it. I don't use Signal specifically, but I don't even know that there is a way for me to actually do it and then track whether that matches the version the iOS app store loaded on my phone, at least not without jailbreaking the phone.