Hacker News Reader

Comment by nabla9 | Hacker News Reader

They simply can't collect much. Plus keeping secret records would be massive legal liability, especially in the EU.

The protocol is public. Signal software is free and open-source. Its mobile clients, desktop client, and server are all published under the AGPL-3.0. Any modifications for the app binaries and protocols would be quickly noticed. Hackers and cybersecurity companies are not fools.

View on HN

> Any modifications for the app binaries and protocols would be quickly noticed. Hackers and cybersecurity companies are not fools.

Would it though? The Signal server source repo was once not updated for almost a year until somebody noticed and called them out on it:

https://lemmy.ml/post/55595

It's the client code that tells you if they could have any of the plaintext.

> Any modifications for the app binaries and protocols would be quickly noticed

Signal doesn't support reproducible builds, does it?

There are reproducible builds on android, and reproducible builds are simply not possible on iOS due to Apple's own decisions.

It’s entirely possible to inspect a binary even if the build isn’t reproducible.

https://news.ycombinator.com/item?id=41361609

"Entirely possible" is a misleading argument.

I don't understand why Signal is not pursuing the reproducible builds. It looks suspicious. Verification of a binary takes a huge effort and can only be done by knowledgeable people. Case in point: nobody noticed or cared about the lack of undisclosed binary updates of Signal without released sources.

Reply on news.ycombinator.com