Re:Telegram gets 3M new signups during Facebook apps’ outage
by ta2223332221 on Thursday March 14, 2019 @07:59AM
(#19388400)
but how do you know if it really is the source code of Signal?
That's a valid question which used to bug me about open source projects. But apparently they finally figured out that the output of the source needs to be deterministic and match the binaries they ship. This property is called "reproducible builds". Signal claims to have them (modulo some third party libraries), though I haven't personally verified it: https://signal.org/blog/reproducible-android/
Honestly though, trust boils down to trusting people. I trust Signal because I trust Moxie, and I trust Moxie because of his reputation among the prominent security experts publicly active on the internet, at least the ones that I find convincing. As a security layman, that's the best I can do.
Re:Telegram gets 3M new signups during Facebook apps’ outage
by cfrs on Monday March 18, 2019 @08:35AM
(#19420517)
Interesting whether apple's bitcode and app thinning breaks "reproducible builds". Also I'm not sure you still can get IPA file (app binary) from appstore/iphone.
That's a valid question which used to bug me about open source projects. But apparently they finally figured out that the output of the source needs to be deterministic and match the binaries they ship. This property is called "reproducible builds". Signal claims to have them (modulo some third party libraries), though I haven't personally verified it: https://signal.org/blog/reproducible-android/
Honestly though, trust boils down to trusting people. I trust Signal because I trust Moxie, and I trust Moxie because of his reputation among the prominent security experts publicly active on the internet, at least the ones that I find convincing. As a security layman, that's the best I can do.