Earlier quoted context omitted.
Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. Note the endpoint does a DYNAMIC lookup of source code. So you can kinda reassure yourself the endpoint is executing dynamic code just by providing your own source code. It might be more obvious the runtime does nothing much if you see the runtime https://github.com/endpointservices/serverlesscells The clever bits that ac…
> Simple but not 100% foolproof, you can mutate your source code and verify the changes propagate. If I was evil, I wouldn't have a totally separate source tree and binary that I shipped; I'd have my CI process inject a patch file. As a result, everything would work as expected - including getting any changes from the public source code - but the created binaries would be backdoored.
Signal Server code on GitHub is up to date again
51–60 of 206 posts
Re: Signal Server code on GitHub is up to date again
#52Is it though? We're already 6 days without a commit. Who knows that the history isn't frozen again until the next major release?
Re: Signal Server code on GitHub is up to date again
#53After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure alternative exists in the form of matrix.
But of course tech media didn't recommend it because it requires a modicum of thought and technical understanding. To me this drives home one key issue: the bulk of users is either too stupid or unwilling to invest even the tiniest amount of effort into their privacy. If you don't want to be saved then fine, give up a detailed profile of your life, interests and opinions into the hands of large megacorps that sell you as their product to advertisers, governments and whoever has the cash. But don't come crying to the experts when your private information has been leaked for the thousands time and don't ever expect a fair election again when political parties can microtarget you into oblivion.
It's not a matter of not knowing anymore but willful ignorance. Democracy and Freedom won't die with thunderous applause but the silent callousness of an unthinking majority.
Re: Signal Server code on GitHub is up to date again
#54Earlier quoted context omitted.
> The fact that no one, in all time, has bothered to notice that the running code is different than the published code It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. > The entirety of the signal "stack" depends on the SGX enclave Only private contact discovery depends on trusting SGX.
> It’s client apps who verify (via attestation) that the code inside an SGX enclave is what they expect it to be, and clients are open source. If the attestation signature matches the published enclave code, then we can know if there's a match. So either there's a missing mitigation, which no one ever has complained about, or the running enclave code doesn't match the source, which also no one ever has complained abo…
Then please demonstrate.
Re: Signal Server code on GitHub is up to date again
#55So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?
> Is there an official response as to why they stopped sharing the code for so long
Not oficially, but see https://news.ycombinator.com/item?id=26725117. They stopped publishing code when they started on the cryptocurrency integration.
Re: Signal Server code on GitHub is up to date again
#56So it just took close to a year to dump thousands of private commits into the public repo! Is there an official response as to why they stopped sharing the code for so long and more importantly, why they started sharing it publicly again? Who gains what with the publication now? And seriously, why is it even relevant anymore?
The first commit that they omitted in April 2020 is related to the payment feature they just announced. So the two events coinciding (server code being published and payment feature being announced) might not have been a coincidence. They apparently didn't want to bother creating a private test server running a private fork of the server code and just pushed their experiments to production, just not releasing the source code to prevent people from seeing the feature before an official announcement. They neccessarily built test client apps because I couldn't find any old commit mentioning payments in the client app git log.
Re: Signal Server code on GitHub is up to date again
#57[deleted]
Re: Signal Server code on GitHub is up to date again
#58After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
Matrix is still broken though. I find XMPP to be sufficient at least until matrix fixes their group encryption
Re: Signal Server code on GitHub is up to date again
#59After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
Matrix is still broken though. I find XMPP to be sufficient at least until matrix fixes their group encryption
Got a source for matrix group encryption issues?
EDIT:
From their [FAQ](https://matrix.org/faq/)
> End-to-End Encryption is fully supported in Matrix. New rooms have encryption enabled by default, and all existing rooms can optionally have End-to-End Encryption turned on.
What exactly do you think is broken here?
Re: Signal Server code on GitHub is up to date again
#60After people started to realize that WhatsApp, owned by Facebook, started changing their privacy settings from terrible to slightly differently terrible, people flocked to and were recommended Signal by so called experts. Yet no one at that time bothered to point out that signal has been opaque as fuck about just about anything they do. On the other hand a free, self-hostable, highly transparent, highly secure altern…
This is an unhelpful attitude, IMHO.
Your best chance, as a privacy-conscious, tech-savvy individual is to push for mass-market adoption of strong encryption and good government privacy regulations that will help everyone.
Lacking those, you will stand out like a sore thumb as one of a tiny number of "weirdos" using Matrix, or Brave, or Tor or GrapheneOS or whatever other hardcore self-hosted, federated niche tools you favour. Any interested spooks can focus their considerable resources on the user base for these tools. Merely having these things installed becomes suspicious in a way that WhatsApp or Signal is not.