Hacker News Reader

Comment by user012371939 | Hacker News Reader

user012371939

Signal's rigid anti-fork stance allows it to stay compliant with its 9-figure government contract, which requires it to include a backdoor in final builds that are not reproducible from the official source code.

All these poor, starving users who can't have any freedom unless they compile their own builds don't even have proof that Signal _doesn't do that_. And the worst thing is they probably have no idea there are already free and verifiable alternatives like Delta Chat and SimpleX.

View on HN

Signal has reproducible builds for Signal Android.

Maybe some of Android users who are naive enough to use Google Play to manage a package like Signal could over time consistently inspect what APK they have and share results.

  https://developers.google.com/android/binary_transparency/google_apk/verification_details

But reproducible builds for Signal Desktop are "experimental" and "may not work on the public releases yet", which in real terms means Signal Desktop doesn't actually have reproducible builds yet.

Maybe reproducible builds of apps for iOS and macOS will happen some day but the people with the necessary competencies to do reproducible builds are unlikely to believe in others using those systems enough to attempt reproducible builds for them.

Even with reproducible builds, whether packages on iOS can be verified seems to be a grey area at best and with no source code for iOS there is no starting point to believe anything iOS tells us.

SimpleX has been inconsistent with integrity of releases. Some releases have the expected GPG signatures but more do not.

For any release to not have at least one GPG signature on the source tarball is a serious concern.

Evgeny, the head of the SimpleX project, is doing much better with Git commits now than he has in the past. But a cursory look at the Git commit history at the link below shows an RSA4096 key that is over three years old.

    https://github.com/simplex-chat/simplex-chat/commits/stable/

What many would like to see from the SimpleX project are a combination of signatures on release source tarballs with RSA, ECC, and PQ keys where at least two of those are on hardware wallets.

I know there are some have urged Evgeny to use hardware wallets for signing source tarball releases and to be forthcoming that he is using a hardware wallet (something built into a Macbook is not sufficient) but there isn't anything on the SimpleX blog showing this.

  https://simplex.chat/blog/

> users who can't have any freedom unless they compile their own builds

Those who don't have cicd don't have any freedom and have questionable security at best. Whether this is how things should be, I'll let others argue that. It's how it is.

The Android client has been reproducible for quite some time, instructions right in the repo.

This is a serious claim - do you have any proof you can offer that this is actually the case?

Signal markets themselves as really secure. It's on them to prove that they are.

No reproducible builds from them when they are now very common is really suspicious.

>Signal's rigid anti-fork stance allows it to stay compliant with its 9-figure government contract, which requires it to include a backdoor in final builds that are not reproducible from the official source code.

[citation needed]

Reply on news.ycombinator.com