3 ms·

With reproducible builds like Signal does you can be sure the app you've downloaded matches the source code that's been audited: https://github.com/signalapp/S

by jgtor 5mo ago

With reproducible builds like Signal does you can be sure the app you've downloaded matches the source code that's been audited: https://github.com/signalapp/Signal-Android/blob/main/reproducible-builds/README.md https://github.com/signalapp/Signal-Android/blob/main/reprod...

lrvick 5mo ago
While I agree reproducible builds are a huge part of the answer, if you get your builds from Google Play or the App Store you have no idea if anyone has reproduced the particular build that was served to your device. A solution to this would be independent reproducible builds like F-Droid does, but Moxie rejected this citing it would cause them to lose control of the platform and install metrics Google and Apple provide. Always thought that was a weird position for a privacy tool.
- Moldoteck 5mo ago
  there's no guarantee, but if the build is mass served - it's at least possible to find out. For closed source apps you may even not know
- Melatonic 5mo ago
  Personally I would be more concerned about a vulnerability or backdoor in Intel SGX
charcircuit 5mo ago
So what? The centralized owner owns the code repo too, so such a restriction doesn't stop anything. Even if Instagram was open source, Meta could remove the E2E chat feature.
- lrvick 5mo ago
  If it was open source people could fork.
  - charcircuit 5mo ago
    But a fork wouldn't be installed on billions of people's devices.
    - lrvick 5mo ago
      Any community that cares could then at least make the right choice of client for their community. The masses never care, but what matters is that privacy is actually a choice.
dingaling 5mo ago
Do you check?