If they're transparent, why don't they expose their commits to server code to the public?
Because Signal's client is open source it's considered a unique-to-Signal downside that we don't have access to the server's source. I feel like some people would bring up the server source issue if someone was asking if it would be a good idea to migrate off of Facebook Messenger.
FB, Google etc never claimed to be open source with their infrastructure.
So if WhatsApp cant be trusted as to what happens on the server, right now neither can Signal.
Can Signal show that what they are running on the server is the same as whats on Github? Are we just trusting them because we have been trusting them all along?
Even if they release up-to-date server code, we have no way to confirm that's the code that's running on their servers. People would then complain that they don't have shell access to the servers to ensure the code is what is expected.
Right now if you run the published server code and point the client certain features don't work. Doesn't that sound a little concerning ?
Modern Intel chips support a feature called Software Guard Extensions (SGX). SGX allows applications to provision a “secure enclave” that is isolated from the host operating system and kernel, similar to technologies like ARM’s TrustZone. SGX enclaves also support a feature called remote attestation. Remote attestation provides a cryptographic guarantee of the code that is running in a remote enclave over a network.
https://signal.org/blog/private-contact-discovery/
But of course you need published source code and reproducible build.
The forum has posts of people who cant even run their own instance of Signal.
So why arent they sharing what is happening server side