Signal Server code on GitHub is up to date again

Re:Signal Server code on GitHub is up to date again by mikece on Wednesday April 07, 2021 @11:13AM (#26726079)

Seems there should be an API endpoint, similar to a health check endpoint, that allows one to validate that the code on the server matches what's in GitHub. How exactly that would work is beyond me since I'm not a cryptographer but seems like an easy way to let developers/auditors/the curious check to see that the code on the server and GitHub match.

[ Parent | on HN ]

Re:Signal Server code on GitHub is up to date again by jhugo on Wednesday April 07, 2021 @11:17AM (#26726137)

How could that possibly work? The API endpoint of a malicious modified server could just return whatever the API endpoint of the non-malicious non-modified server returns.

[ Parent | on HN ]

Re:Signal Server code on GitHub is up to date again by beaconstudios on Wednesday April 07, 2021 @11:16AM (#26726127)

if you assume that the server can lie to you, then it's physically impossible. Any query could be answered by interrogating a copy of the github version of the server and returning the answer.

[ Parent | on HN ]

Re:Signal Server code on GitHub is up to date again by monocasa on Wednesday April 07, 2021 @11:15AM (#26726107)

   validate_endpoint() {
     return hash_against_other_file_not_exe();
   }

[ Parent | on HN ]