zlacker

>>domano+(OP)
Is there any mechanism to validate that the code running on Signal's servers is the same as on Github?

>>red_tr+G1
That's basically the same problem as DRM, so no, you can't verify that someone is running only code you want them to run against data you gave them, on hardware they own.

>>monoca+J2
Yet DRM does exist. (Yes, these schemes usually end up getting broken at some point, but so does other software.)

The problem is more generally called trusted computing, with Intel SGX being an implementation (albeit one with a pretty bad track record).