WhatsApp is as closed as the version of Telegram you download from the (App|Play) Store.

Before you say "but I can compile it myself", think of how many people will ever bother to do that.

You can download it from F-Droid where they will compile it from the source for you. Yes, only very few people will use that version, too. But with that logic there isn't any reason for open-source at all.

Same as every other app including Signal. For the record, not advocating using Telegram over Signal.

One would do in order to unearth any backdoors. In case of WhatsApp, that would be more difficult.

No, we can easily know for sure, despite the fact that it's closed source.

How?

Sorry, I don't understand your question.

How can you know for sure?

By looking at the code.

but it's closed-source, so we can't do that

`tptacek is being obtuse, but it really is pretty straightforward: https://en.wikipedia.org/wiki/Decompiler

It's a forward tick: 'tptacek. We're not writing Lisp macros. :)

So you concede that you were being obtuse ;)

Not really: I'd just rather find out where the point of contention is before getting pedantically prolix.

You understand how frustrating it is for open source advocates to hear that normal users will never look at source code and so there's no practical difference for them between closed source and open source since it's all opaque to them anyways?

That's how literally every security person feels about the argument that closed-source software is unknowable.

We don't need decompilers or special tools to read closed-source applications. Almost all of them --- very much including the Signal-based messengers --- are built with tools that produce straightforward easy to follow assembly code.

So there's no practical difference for you in understanding algorithms between assembly and higher-level source code?

I think there is another issue to remember, you can't trust the source.

So, I doubt any security professionals would say its preferable to not have the source, but to do the job of verifying the software you have to do it at a lower level than the source anyway, so having the source is a bonus, not a requirement.

In practice we often don't even need to read the assembly code; we can match control-flow graphs. There really are some software security verification problems that are easier from the binary, particularly if the build system is complex.

But that's sort of besides the point. Reading assembly is more tedious than reading C code, which is in turn more tedious than reading Python code. But you don't get to move the goalposts now. You claimed, repeatedly, that closed-source software was unknowable. It is not; it is in fact very far from unknowable. So the idea that Facebook is going to sneak backdoors into some of its most prominent code under cover of "closed source" is an extraordinary claim, requiring extraordinary evidence.

I see, thanks for clarifying.