zlacker

>>domano+(OP)
Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

>>red_tr+G1
Seems there should be an API endpoint, similar to a health check endpoint, that allows one to validate that the code on the server matches what's in GitHub. How exactly that would work is beyond me since I'm not a cryptographer but seems like an easy way to let developers/auditors/the curious check to see that the code on the server and GitHub match.

>>mikece+E2

   validate_endpoint() {
     return hash_against_other_file_not_exe();
   }