3 ms·
No. If they wanted to harvest metadata, they could do it while still making their repo look up to date and totally clean. Wouldn't be hard either.
by doomrobo 6y ago
No. If they wanted to harvest metadata, they could do it while still making their repo look up to date and totally clean. Wouldn't be hard either.
- sodality2 6y agoThey could harvest whatever they want and just not push it to the repo, not limited to metadata. This would require updating the apps but you can't decompile GP versions to source code...
- mfwoods 6y agoBut you can verify that the source they publish on Github is the same that was used to built the Google Play version with reproducible builds[1]. Also, Android apps are fairly easy to decompile. They are very likely to get caught if they publish an update with a backdoor. [1] https://github.com/signalapp/Signal-Android/tree/master/reproducible-builds https://github.com/signalapp/Signal-Android/tree/master/repr...