4 ms·

not possible with open source

• patates 4y ago
  How do you make sure that the source you see is the one that's deployed?
  • 867-5309 4y ago
    depends on the party deploying it
  • cesarb 4y ago
    > How do you make sure that the source you see is the one that's deployed? With reproducible builds. Signal has done reproducible builds since 2016 (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/), all you need to do is to get the APK from your device and compare it (see https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod... for a detailed step-by-step).
    • patates 4y ago
      The problem is, I have to trust my capability (and the others who actually read the source) to understand that the client doesn't trust the server, as long as I don't deploy the server too myself. Not to mention having to do the same for each update. In a nutshell, at some point, you practically have to trust someone.