zlacker

>>domano+(OP)
Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

>>red_tr+G1
How would that work? You'd be layering trust on trust, wherein if they're willing to lie about one thing they're willing to lie about confirmation of that same thing (or not).

Unless you're going to hire some independent auditor (that you still have to trust) it seems logically problematic.

>>Someon+f2
SGX enclaves can attest to the code they are running, so you don't exactly need to take Signal's word on faith.

>>madars+K2
That isn't a solution to the problem being discussed (a provider's server code being verifiable by end users). I'm quite confused by the suggestion that it could be/is.