4 ms·

How do we know Signal actually does that?

• sunbum 2y ago
  Did you even click the link?
• deleted 2y ago
  [deleted]
• nabla9 2y ago
  They simply can't collect much. Plus keeping secret records would be massive legal liability, especially in the EU. The protocol is public. Signal software is free and open-source. Its mobile clients, desktop client, and server are all published under the AGPL-3.0. Any modifications for the app binaries and protocols would be quickly noticed. Hackers and cybersecurity companies are not fools.
  • sva_ 2y ago
    > Any modifications for the app binaries and protocols would be quickly noticed. Hackers and cybersecurity companies are not fools. Would it though? The Signal server source repo was once not updated for almost a year until somebody noticed and called them out on it: https://lemmy.ml/post/55595 https://lemmy.ml/post/55595
    • AnthonyMouse 2y ago
      It's the client code that tells you if they could have any of the plaintext.
  • fsflover 2y ago
    > Any modifications for the app binaries and protocols would be quickly noticed Signal doesn't support reproducible builds, does it?
    • cpach 2y ago
      It’s entirely possible to inspect a binary even if the build isn’t reproducible. https://news.ycombinator.com/item?id=41361609 https://news.ycombinator.com/item?id=41361609
      • fsflover 2y ago
        "Entirely possible" is a misleading argument. I don't understand why Signal is not pursuing the reproducible builds. It looks suspicious. Verification of a binary takes a huge effort and can only be done by knowledgeable people. Case in point: nobody noticed or cared about the lack of undisclosed binary updates of Signal without released sources.
    • sunbum 2y ago
      There are reproducible builds on android, and reproducible builds are simply not possible on iOS due to Apple's own decisions.
• cpach 2y ago
  If you want to know what an application really does, you should grab a copy of IDA Pro or Ghidra and inspect the binaries.