41–50 of 367 posts
I'm not seeing it. I've only had 1 of my friends convert to signal in the last week. The rest of them: they've always have been on signal.
So 100% of the people you know who were not on signal are now on signal?
I'm saying anidotically, I'm not seeing a massive wave of people sign on to signal.
Earlier quoted context omitted.
You can build the source locally, then compare the MD5 hash value of your build to (1) the hash value they post publicly for their build and (2) the actual hash value of their build once you download it. Assuming all three match, you know that the binary matches the source. Someone who is more technically inclined can probably go into more detail on this.
we are talking about security, and you brought up... MD5?
Earlier quoted context omitted.
You can build the source locally, then compare the MD5 hash value of your build to (1) the hash value they post publicly for their build and (2) the actual hash value of their build once you download it. Assuming all three match, you know that the binary matches the source. Someone who is more technically inclined can probably go into more detail on this.
we are talking about security, and you brought up... MD5?
Earlier quoted context omitted.
How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
How do you know the compiler actually compiles the source code to the binary you expect without injecting backdoors? How do you know that the hardware actually follows the instructions in the binary as they are specified? How do you know you're not living in a computer simulation in which the operators can access your data without any backdoors whatsoever?
Earlier quoted context omitted.
The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
I was about to ask about this. Signal was comparatively annoying. Can I keep using Telegram or am I postponing the inevitable? Curious.
Earlier quoted context omitted.
How do you know that the binary you run actually corresponds to the source code you read? EDIT: and would you then also review every commit to make sure nothing bad gets introduced? No, at some point you have to place trust in the vendor, the developers, independent audits, etc.
How do you know the compiler actually compiles the source code to the binary you expect without injecting backdoors? How do you know that the hardware actually follows the instructions in the binary as they are specified? How do you know you're not living in a computer simulation in which the operators can access your data without any backdoors whatsoever?
Cartesian doubt becomes pointless at some point. If you're worried that the deep state has implanted microchips in your brain to prevent you from analyzing signal, it probably doesn't matter because at that point they wouldn't need to hack signal to get to you.
A less snarky and more realistic answer is: threat models and risk assesment. (Non-divine) adversaries generally have limited resources. The limit may be high, but its still there. You can realistically worry about a government coercing a service to hand over keys, because that's easily within their power. On the other hand, having a giant conspiracy-trusting trust style-where every compiler & microchip has a backdoor that is inserted into every tool ever compiled, is a bit unrealistic. It would take thousands of people to be in on it to pull it off, spread across many countries (who hate each other) over at least 50 years. Having that many people, especially academics, keep that type of secret for that long is basically impossible. If they could do that, it would be child's play to have most of the protestors be gov agents, so if you think this is realistic, worry about that first. Anyways, in my judgement governments don't have that kind of power, so its probably not something to worry about.
So, to conclude, estimate the level of power and influence you think your enemies have, and then take steps to rule out the possibilities that your enemies have done the things that are theoretically in their power to do. Start with the possibilities that are most likely multiplied by how bad it would be for you (liklihood*severity = risk)
Earlier quoted context omitted.
Determinism. https://tests.reproducible-builds.org/debian/reproducible.ht... We're making great strides into software being completely deterministic. The Bitcoin project for many years has had completely deterministic binaries and a ceremony process for GPG signing the output with many individual parties.
See my other comment about determinism: https://news.ycombinator.com/item?id=23424925 Trying to get a bit-to-bit equivalent of a binary lifted from the app store sounds challenging to say the least.
See also Guix, which provides tools to challenge servers providing binary packages to see if they match a locally-built version: https://guix.gnu.org/manual/en/html_node/Invoking-guix-chall...
I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
Earlier quoted context omitted.
The Signal app experience leaves a lot to be desired compared to Telegram or Matrix.
You get voice, video, chat, stickers, files. What more do you want?
I hope one day apps like Signal will be the default for everyone , not just protesters in a time of crisis.
I would ditch WhatsApp in a heartbeat if Signal had a browser client.