4 ms·
> There's no security benefit in having Signal on F-Droid instead of I don't know about Signal specifically but there is absolutely security benefits to hostin
by xorcist 6y ago
> There's no security benefit in having Signal on F-Droid instead of
I don't know about Signal specifically but there is absolutely security benefits to hosting apks on F-Droid instead of your own home page.
F-Droid supports reproducible builds, so you can actively check that their build infrastructure is not compromised.
Signal seems to support some kind of reproducible builds on their own. Why that has not been integrated into the F-Droid build process I don't know. It seems like a large enough application to warrant the work.
But I suspect no one has stepped up to do the work, and given that Moxie has been quite clear that Signal is not to be distributed on F-Droid, that seems not likely to change.
- hiq 6y ago> Moxie has been quite clear that Signal is not to be distributed on F-Droid, that seems not likely to change. IIRC his main arguments were really a different signature and delays in updates. Since these reasons will not exist anymore in the case of reproducible builds (the Signal app could still prompt for updates itself) from Signal being distributed on F-Droid, I don't think we can assume that Signal would not be fine with the APK distributed on F-Droid. From a quick glance, the main reason left now seems to be that Signal still relies on the Play services libraries at compile-time (not necessarily at runtime), which are proprietary and thus not acceptable for F-Droid. Signal does not want to support a fork with these libraries completely removed.