4 ms·

Signal (with Google / Apple cooperation) can potentially ship modified backdoored versions to specific targeted users, while that one geek that verifies every S

Signal (with Google / Apple cooperation) can potentially ship modified backdoored versions to specific targeted users, while that one geek that verifies every Signal build still gets a clean version. This is not a game you can win with centralised app stores and app architecture that relies on push notifications.

mjg59 5y ago
This is true even in a decentralised world - even if the protocol can be guaranteed to be secure, you could still push a modified binary to an individual.
- cft 5y ago
  Not if you buy a raspberry pi like device "server" and plug it into your modems' Ethernet port
- Andrew_nenakhov 5y ago
  Not if you build the binary yourself. It is perfectly doable in PC world, where you can run background processes and such, but much harder to do in current mobile world, where both iOS and Android restrict background processes (Android to the lesser degree, but it is going to the same place as iOS), and force apps to rely on push notifications.
  - gizmo385 5y ago
    But you can already build the signal binary yourself, right? Or are you suggesting that should be the default and everybody should rebuild the binary?
    - Andrew_nenakhov 5y ago
      You can, but you won't be able to receive push notifications with it - to send push notifications to your app Signal will need your developer keys, or relay push notifications via your server. And I don't think Signal can relay push notifications. Telegram, actually, can send push notifications to third-party clients, but requires uploading developer keys to them.
  - mike_hearn 5y ago
    No, mjg59 is right - the operating system is a root of trust. Microsoft could push a Windows update that patches a messenger app in place for example. I probably shouldn't have brought up the "knowing what your peer is running" problem as it just confuses things. There is plenty of progress to be made here without getting into the next layer of how do you trust your OS. Android is at any rate in a decent place because so many users don't get their OS bits from Google but rather, an intermediary, and it's very easy to change those intermediaries (it means buying a new phone but people do that all the time anyway). Reproducible builds and audits are all very theoretical today. Reproducible builds on their own aren't actually useful because you're just comparing hashes: someone has to have actually read the source code, understood it, documented what it does or compared it to some natural language description, and they have to keep up with all the code changes, and they have to convince other people to trust their judgement. It's a lot of work and we don't have any companies that do this sort of thing today. The industry needs a network of auditing firms that specialize in this but it's a chicken-and-egg problem: there's no point creating such a firm when their outputs are so hard to use, and there's no point making their outputs easier to use when there are no auditors who would create them.
    - Andrew_nenakhov 5y ago
      There are many sources to get Android OS, but they all share one and the same Google Play. So this is the most logical piece of infrastructure to ship you tampered apps, on any Android device with Google services.
    - gizmo385 5y ago
      With respect to reproducible builds, they're pretty extensively used in engineering but have you considered that the reason they aren't more widely used outside of the industry is that most people simply don't care? I don't think that it's that the outputs are hard to use - it's that the vast majority of people installing and running software on their devices are perfectly fine with trusting the existing distribution infrastructure.
      - mike_hearn 5y ago
gls2ro 5y ago
I think it is also not a game you can win (as in world wide usage) if you need users to build their own apps. The majority of users will not do that no matter how many tutorials one can write.
- Andrew_nenakhov 5y ago
  well, this is something that can be somewhat mitigated by giving users a meaningful choice of software repositories. Like, f-droid maintainers are trusted not to tamper apps because of their reputation. However, this would also require making third-party repositories ("app stores" is the modern fancy term) to have the same system privileges as Google Play / Apple Appstore have - and by this I mean giving apps access to third party push notifications services.

mjg59 5y ago

This is true even in a decentralised world - even if the protocol can be guaranteed to be secure, you could still push a modified binary to an individual.

cft 5y ago
Not if you buy a raspberry pi like device "server" and plug it into your modems' Ethernet port
Andrew_nenakhov 5y ago
Not if you build the binary yourself. It is perfectly doable in PC world, where you can run background processes and such, but much harder to do in current mobile world, where both iOS and Android restrict background processes (Android to the lesser degree, but it is going to the same place as iOS), and force apps to rely on push notifications.
- gizmo385 5y ago
  But you can already build the signal binary yourself, right? Or are you suggesting that should be the default and everybody should rebuild the binary?
  - Andrew_nenakhov 5y ago
    You can, but you won't be able to receive push notifications with it - to send push notifications to your app Signal will need your developer keys, or relay push notifications via your server. And I don't think Signal can relay push notifications. Telegram, actually, can send push notifications to third-party clients, but requires uploading developer keys to them.
- mike_hearn 5y ago
  No, mjg59 is right - the operating system is a root of trust. Microsoft could push a Windows update that patches a messenger app in place for example. I probably shouldn't have brought up the "knowing what your peer is running" problem as it just confuses things. There is plenty of progress to be made here without getting into the next layer of how do you trust your OS. Android is at any rate in a decent place because so many users don't get their OS bits from Google but rather, an intermediary, and it's very easy to change those intermediaries (it means buying a new phone but people do that all the time anyway). Reproducible builds and audits are all very theoretical today. Reproducible builds on their own aren't actually useful because you're just comparing hashes: someone has to have actually read the source code, understood it, documented what it does or compared it to some natural language description, and they have to keep up with all the code changes, and they have to convince other people to trust their judgement. It's a lot of work and we don't have any companies that do this sort of thing today. The industry needs a network of auditing firms that specialize in this but it's a chicken-and-egg problem: there's no point creating such a firm when their outputs are so hard to use, and there's no point making their outputs easier to use when there are no auditors who would create them.
  - Andrew_nenakhov 5y ago
    There are many sources to get Android OS, but they all share one and the same Google Play. So this is the most logical piece of infrastructure to ship you tampered apps, on any Android device with Google services.
  - gizmo385 5y ago
    With respect to reproducible builds, they're pretty extensively used in engineering but have you considered that the reason they aren't more widely used outside of the industry is that most people simply don't care? I don't think that it's that the outputs are hard to use - it's that the vast majority of people installing and running software on their devices are perfectly fine with trusting the existing distribution infrastructure.
    - mike_hearn 5y ago

gls2ro 5y ago

I think it is also not a game you can win (as in world wide usage) if you need users to build their own apps. The majority of users will not do that no matter how many tutorials one can write.

Andrew_nenakhov 5y ago
well, this is something that can be somewhat mitigated by giving users a meaningful choice of software repositories. Like, f-droid maintainers are trusted not to tamper apps because of their reputation. However, this would also require making third-party repositories ("app stores" is the modern fancy term) to have the same system privileges as Google Play / Apple Appstore have - and by this I mean giving apps access to third party push notifications services.