3 ms·
Is there an audit trail showing that the compiled binary available in the App store is the same one you build from source?
by busterarm 6y ago
Is there an audit trail showing that the compiled binary available in the App store is the same one you build from source?
- bigiain 6y agoSadly, no. There’s still some “trust” required in both Whispersystems to not backdoor updates, as well as Apple and Google to not backdoor the distributed apps after Whispersystems submit updates for publication. There is though, some ability for skilled enough people to “trust but verify” by reversing the app bundles after publication. I believe (but not for any good evidence based reason) that there are “enough eyeballs” interested in Signal that _hopefully_ if a backdoored app update ever appears the white hats will raise the alarm quickly (I have no doubt the black hats will sell the details to NSO/GreyKey just as quickly...)
- godelski 6y agoYou are able to compile from source though...