News for hackers. Stuff that matters.

A comment on Signal Foundation. Parent comment

Re:Signal Foundation by leshow on Wednesday February 21, 2018 @04:38PM (#16433210)
Theoretically, but when you throw in things like build systems often not being deterministic, minor versions of dependencies changing, different OS or slightly different OS version with different libraries; there's a multitude of places to throw the final binary off by a few bytes or more and end up with a different checksum.

Signal wants to distribute a binary with a checksum. Once the checksum is different all bets are off, that's why it's not in F-Droid

[ Parent | on HN ]
Re:Signal Foundation by Ao7bei3s on Wednesday February 21, 2018 @05:37PM (#16433617)
As if reproducible builds hadn't been done before. If Debian can get to building 80% of their packages reproducibly[1], the communities around Android can get there too. Luckily, it's being worked on.[2]

Now the question is: (when) will this be supported by F-Droid?

[1] Scroll down for a big graph https://wiki.debian.org/ReproducibleBuilds

[2] https://github.com/signalapp/Signal-Android/wiki/Reproducibl...

[ Parent | on HN ]
Re:Signal Foundation by kuschku on Wednesday February 21, 2018 @08:27PM (#16434476)
F-Droid has supported reproducible builds for years: https://f-droid.org/en/docs/Reproducible_Builds/

The real question is, when will Signal finally support it?

[ Parent | on HN ]
Re:Signal Foundation by Ao7bei3s on Sunday February 25, 2018 @05:43AM (#16458292)
Nice, thanks for pointing that out!
[ Parent | on HN ]
Re:Signal Foundation by izacus on Wednesday February 21, 2018 @04:41PM (#16433233)
So why don't they just also list checksum of the F-Droid binary?
[ Parent | on HN ]
Re:Signal Foundation by JetSpiegel on Wednesday February 21, 2018 @06:37PM (#16433946)
They don't trust F-Droid.
[ Parent | on HN ]
Re:Signal Foundation by izacus on Thursday February 22, 2018 @03:19AM (#16436078)
Yeah, figured. They seem very inconsistent in applying their trust. At times they'll do strange things like build app on Chrome Apps platform / mandatory phone ID and on other times they'll make user-hostile decisions like hijacking SMS messages and refusing to publish to F-Droid due to "security".

The end result is an app that keeps shooting itself in the foot and being beaten by Messenger and WhatsApp.

[ Parent | on HN ]