5 ms·
>This is… not true? Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don'
by lowwave 5y ago
>This is… not true? Signal builds are reproducible. You can verify that the apk in the app store corresponds to a specific point in git history, and if you don't trust Google you can sideload that.
A better way to verify this is latest Signal build in F-Droid? Last time I checked it is behind quit few version. If Signal can satisfy the F-Droid build check to be open and free, then it is legit. Most people don't have time to go through the git commit to verify the build.
- thelittleone 5y agoAgree though making it faster or more convenient would be a benefit. But I disagree that most people don't have time to check. It's just inconvenient or not important enough for those who choose not to.
- input_sh 5y agoI don't think Signal was ever on F-Droid? IIRC its code does contain some proprietary blobs and Signal doesn't want non-official clients to connect to their servers, so it'd be against Signal's wishes to have a fork on F-Droid without those proprietary blobs. They do offer an apk on their website though.
- medstrom 5y agoThe F-Droid issue mentioned nothing about blobs as I recall, the reason was they want to be able to push security updates in a timely manner. F-Droid makes it far too easy for people to keep using an old version.
- MrDresden 5y agoI use Signal, and am not saying that they are doing anything shady. But that argument would make for a convenient smokescreen if they were.
- lowwave 5y ago>F-Droid makes it far too easy for people to keep using an old version. Being open/free is to allow people to have any version they chose. I've pushed both in App Store and Google Play Store, if the software is truly free/open it shouldn't be hard to publish it on F-Droid. The problem is when there are mixxed proprietary code in the project then F-Droid tend to reject it.