3 ms·
> How do you make sure that the source you see is the one that's deployed? With reproducible builds. Signal has done reproducible builds since 2016 (https://si
by cesarb 4y ago
> How do you make sure that the source you see is the one that's deployed?
With reproducible builds. Signal has done reproducible builds since 2016 (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/), all you need to do is to get the APK from your device and compare it (see https://github.com/signalapp/Signal-Android/tree/main/reproducible-builds https://github.com/signalapp/Signal-Android/tree/main/reprod... for a detailed step-by-step).
- patates 4y agoThe problem is, I have to trust my capability (and the others who actually read the source) to understand that the client doesn't trust the server, as long as I don't deploy the server too myself. Not to mention having to do the same for each update. In a nutshell, at some point, you practically have to trust someone.