3 ms·

> Again that's a valid security concern. Are builds reproduceable? If not then it's a trust based security model if it can't be verified independently. I don't

• palata 2y ago
  Again: you can audit the source code yourself, you can build it yourself, you can run it yourself. If you trust your correspondent and they did that too, then you can be pretty confident that the E2EE works fairly well. Is it perfect? No. Nothing is. But with arguments like this, you can complain about everything: "computers suck because there is no way to audit the millions of components that go into the hardware". > If not then it's a trust based security model I doubt "trust-based security model" is a thing. If you don't understand that there is always trust somewhere, then you have missed something about security. If you can't trust the binary coming from the official stores, maybe you will trust the ones distributed by Signal. If you can't trust that, then you can build from sources. If you can't trust the sources, maybe you shouldn't use Signal. But it goes further: can you trust your OS? Can you trust your hardware? There is always trust somewhere.