3 ms·
> It seems really unlikely to me that Apple will enable E2EE backups. And even if they did, how would we verify that the code they instruct our hardware to run
by foresto 5y ago
> It seems really unlikely to me that Apple will enable E2EE backups.
And even if they did, how would we verify that the code they instruct our hardware to run does e2ee correctly, without bugs or backdoors? Apple doesn't seem to be in the habit of opening much of their code or (on mobile) allowing users to install unapproved builds. Unless that changed, I would be skeptical, just as I am of all "e2ee" software that cannot be independently audited by anyone at any time.
- shapefrog 5y agoOut of curiousity how are you auditing the pre compiled binaries of otherwise open source software? I spent 2 months going through the signal code base checking it and now I need to audit the production code on their servers as well as the binaries they have compiled. Any tips?
- foresto 5y agoI find it's much easier to audit the source code, and build the binaries yourself from that code. Also, it's a collaborative effort. If you build your binaries from the same sources that other people use, then you can split up the work, and you all benefit from anyone's discoveries. Obviously, we don't have perfect verification of the code we run. People can overlook things. Compilers can be subverted. Operating systems can be pwned. Malicious hardware can undermine all of our efforts. But let's not let perfect be the enemy of good, and let's not fool ourselves into thinking that faith in a corporation is a substitute for transparency.
- hvidgaard 5y agoYou have to assume that everything you do not control and monitor is compromised.