5 ms·

This article makes early on a major factual error, claiming that Signal is on F-Droid. It is not, and the Signal team’s refusal to authorize the app on F-Droid

This article makes early on a major factual error, claiming that Signal is on F-Droid. It is not, and the Signal team’s refusal to authorize the app on F-Droid is a well-known and longstanding decision. The author then claims that the team’s development of new functionality behind closed doors (payments) represents some kind of betrayal of Signal being open source. Yet all clients running on people’s phones in the meantime were based on source that was published, with verifiable builds. Finally, Moxie Marlinspike is no longer leading Signal. There are nevertheless legitimate reasons to not trust Signal and to worry about compromise. I am pleased to see that the author mentions one major but usually overlooked one: the (optional, but encouraged) sharing of people’s contact lists with the server through Intel SGX functionality, which has been repeatedly found to be insecure.

lmm 3y ago
> Yet all clients running on people’s phones in the meantime were based on source that was published, with verifiable builds. "Based on" meaning they're built from that source but have changes to it? Because given that the published source had known bugs and was not updated for months, either they're not fixing known bugs for months, or they're publishing builds based on unpublished source. (And the article does address the verifiable builds point, pointing out that it doesn't and can't really work).
- hiq 3y ago
  > the published source had known bugs and was not updated for months That's the server code, not the client code. > the article does address the verifiable builds point, pointing out that it doesn't and can't really work IIRC (the article is now down for me for some reason), the author was again talking about server code.