4 ms·
How do you make sure that the source you see is the one that's deployed?
by patates 4y ago
How do you make sure that the source you see is the one that's deployed?
- 867-5309 4y agodepends on the party deploying it
- cesarb 4y ago> How do you make sure that the source you see is the one that's deployed? With reproducible builds. Signal has done reproducible builds since 2016 (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/), all you need to do is to get the APK from your device and compare it (see https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod... for a detailed step-by-step).
- patates 4y agoThe problem is, I have to trust my capability (and the others who actually read the source) to understand that the client doesn't trust the server, as long as I don't deploy the server too myself. Not to mention having to do the same for each update. In a nutshell, at some point, you practically have to trust someone.