On: Building end-to-end security for Messenger

[I_am_tiberius]

I thought Signal is open source?

[nicce → I_am_tiberius]

Also their builds are fully reproducible on Android.

[zaik → nicce]

Is there a guide how one can check that the PlayStore version matches the source code?

[nicce → zaik]

Here is one: https://github.com/signalapp/Signal-Android/tree/main/reprod...

[dontlaugh → I_am_tiberius]

US spooks can get Apple or Google to deliver altered apps to targets, if nothing else.

[viktorcode → dontlaugh]

Source?

[cies → viktorcode]

AppStore and PlayStore are not open source, so you trust the distribution mechanism, is what I think parent wanted to say.

[I_am_tiberius → cies]

But you don't need to install them via their store. Also, you can always check the hash code of the binary.

[cies → I_am_tiberius]

I'm not sure about that. But true, in that case only the fact that's not open source is still in the way of me giving it my "baseline safe" approval. :)

[TiredOfLife → I_am_tiberius]

It's "source available". They make changes to their server code, run those modified servers for a year or so and then release a source.

[contravariant → TiredOfLife]

The server code isn't relevant in this case, you want the client code to be secure.