628
Kinda sus... (lemmy.world)
submitted 2 years ago by to c/linuxmemes@lemmy.world
73 comments fedilink hide all child comments
 

The NSA, the original primary developer of SELinux, released the first version to the open source development community under the GNU GPL on December 22, 2000.[6] The software was merged into the mainline Linux kernel 2.6.0-test3, released on 8 August 2003. Other significant contributors include Red Hat, Network Associates, Secure Computing Corporation, Tresys Technology, and Trusted Computer Solutions.

https://en.wikipedia.org/wiki/Security-Enhanced_Linux

you are viewing a single comment's thread
view the rest of the comments
[–] 13 points 2 years ago* (4 children)

Signal is weird about actually allowing others to reproduce the APK builds.

Specifically, they are the kind of weird about it that one would expect if the Signal client app had an NSA back-door injected at build time.

This doesn't prove anything. It just stands next to anything and waggles it's eyebrows meaningfully.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 2 years ago (1 child)

    Do you have more recent information by Signal on the topic? The GitHub issue you linked is actually concerned with publicly hosting APKs. They also seem to have been offering reproducible builds for a good while, though it's currently broken according to a recent issue.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 2 years ago* (last edited 2 years ago)

    I had a hard time choosing a link. Searching GitHub for "F-Droid" reveals a long convoluted back-and-forth about meeting F-Droid's requirements for reproducible builds. Signal is not, as of earlier today, listed on F-Droid.

    F-Droid's reproducibility rules are meant to cut out the kind of shenanigans that would be necessary to hide a back door in the binaries.

    Again, this isn't proof. But it's beyond fishy for an open source security tool.

    Edit: And Signal's official statements on the topic are always reasonable - but kind of bullshit.

    Reasonable in that I alwould absolutely accept that answer, if it were the first time that Signal rejected a contribution to add it to F-Droid.

    Bullshit in that it's been a long time, lots of folks have volunteered to help, and Signal still isn't available on F-Droid.

  • permalink
  • fedilink
  • source
  • parent