2 ms·

> Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. You can't say affirmatively that yes they

> Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. You can't say affirmatively that yes they deployed but then say it's an assumption. Either they did or they didn't. If they didn't deploy the code to production prior to the commit then I see no problem with what they did.

dogecoinbase 6y ago
I noted this in another comment, but if they _did not_ update the code in production, they ran with known vulnerabilities in the server side for many months: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c... There's no good option here.
- cptskippy 6y ago
  Interestingly one of the comments in that thread refers to the server code as a reference implementation. This implies that Signal's server code isn't opensource, and that this code is just a reference implementation. The readme.md on the repo doesn't really clarify one way or another on the matter.
remram 6y ago
I am 99% sure they did. I can't say affirmatively that anyone is running anything exactly, but they now claim they did.
- cptskippy 6y ago
  > I am 99% sure they did. Why? > I can't say affirmatively that anyone is running anything exactly Signal provides a means for reproducing Android builds so you can affirmatively determine what you're running. https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ > but they now claim they did. Signal claims they shipped server updates without releasing code? Do you have a link to that? When others were complaining about the lack of an update to server, they're complaining about the client and server APIs being out of sync. Reading through these comments, I don't get the impression that the server code published is what's actually running. In fact the following comment even refers to it as a reference implementation: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#commitcomment-47509056 https://github.com/signalapp/Signal-Server/commit/3432529f9c... At the end of the day, it doesn't really matter much what server code is running since the Clients manage encryption and the Server has no insight into the messages being exchanged.

dogecoinbase 6y ago

I noted this in another comment, but if they _did not_ update the code in production, they ran with known vulnerabilities in the server side for many months: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c... There's no good option here.

cptskippy 6y ago
Interestingly one of the comments in that thread refers to the server code as a reference implementation. This implies that Signal's server code isn't opensource, and that this code is just a reference implementation. The readme.md on the repo doesn't really clarify one way or another on the matter.

remram 6y ago

I am 99% sure they did. I can't say affirmatively that anyone is running anything exactly, but they now claim they did.

cptskippy 6y ago
> I am 99% sure they did. Why? > I can't say affirmatively that anyone is running anything exactly Signal provides a means for reproducing Android builds so you can affirmatively determine what you're running. https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ > but they now claim they did. Signal claims they shipped server updates without releasing code? Do you have a link to that? When others were complaining about the lack of an update to server, they're complaining about the client and server APIs being out of sync. Reading through these comments, I don't get the impression that the server code published is what's actually running. In fact the following comment even refers to it as a reference implementation: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#commitcomment-47509056 https://github.com/signalapp/Signal-Server/commit/3432529f9c... At the end of the day, it doesn't really matter much what server code is running since the Clients manage encryption and the Server has no insight into the messages being exchanged.