Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Signal Server code on GitHub is up to date again

github.com

Post reply on HN
Print view View original

1–10 of 206 posts

Re: Signal Server code on GitHub is up to date again

#4

Post by Someone1234 »

red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

How would that work? You'd be layering trust on trust, wherein if they're willing to lie about one thing they're willing to lie about confirmation of that same thing (or not).

Unless you're going to hire some independent auditor (that you still have to trust) it seems logically problematic.

Re: Signal Server code on GitHub is up to date again

#5

Post by Foxboron »

red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

There isn't, but people are working on getting us there. The first project that comes to mind is "System Transparency".

https://system-transparency.org/

Re: Signal Server code on GitHub is up to date again

#6

Post by mikece »

red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

Seems there should be an API endpoint, similar to a health check endpoint, that allows one to validate that the code on the server matches what's in GitHub. How exactly that would work is beyond me since I'm not a cryptographer but seems like an easy way to let developers/auditors/the curious check to see that the code on the server and GitHub match.

Re: Signal Server code on GitHub is up to date again

#7

Post by monocasa »

red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

That's basically the same problem as DRM, so no, you can't verify that someone is running only code you want them to run against data you gave them, on hardware they own.

Re: Signal Server code on GitHub is up to date again

#8

Post by madars »

Someone1234 wrote: post #4
red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

How would that work? You'd be layering trust on trust, wherein if they're willing to lie about one thing they're willing to lie about confirmation of that same thing (or not). Unless you're going to hire some independent auditor (that you still have to trust) it seems logically problematic.

SGX enclaves can attest to the code they are running, so you don't exactly need to take Signal's word on faith.

Re: Signal Server code on GitHub is up to date again

#9

Post by danpalmer »

red_trumpet wrote: post #2

Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

I think the argument would be that with end-to-end encryption this is unnecessary, which is good because it's impossible.

There's a counter-argument that there is still useful metadata a server can glean from its users, but it's certainly minimised with a good protocol... like the Signal protocol.

Post reply on HN