{"id":38556094,"user":"orangepurple","time":1701956093,"time_ago":"2 years ago","type":"comment","content":"

Threema may very well be the Crypto AG of our times","comments":[{"id":38556118,"user":"keep_reading","time":1701956297,"time_ago":"2 years ago","type":"comment","content":"

Why would you say that? It's open source and has reproducible builds","comments":[{"id":38556612,"user":"orangepurple","time":1701958919,"time_ago":"2 years ago","type":"comment","content":"

Play Store version could be anything","comments":[{"id":38557418,"user":"snoutie","time":1701963017,"time_ago":"2 years ago","type":"comment","content":"

i fail to see how the play store version could be "anything" considering you can reproduce the builds. can you enlighten me how something like this would be possible?","comments":[{"id":38558550,"user":"orangepurple","time":1701967469,"time_ago":"2 years ago","type":"comment","content":"

You can reproduce the builds yourself but you have no control over what happens to the app APK once it is uploaded to Google then distributed via the Play Store. I suppose you could checksum the APK before and after and make sure your app is exactly the same before and after sending it to Google to distribute via the Play Store. Google doesn't have much motivation TODAY to mess with APKs directly since they have Google Play Services which is essentially a rootkit running on your phone all the time and it is easily accessible by the NSA through Google's infrastructure, probably by a secret FISA warrant with a gag order. Maybe they don't need a warrant. Think we would ever find out?","comments":[{"id":38559138,"user":"snoutie","time":1701969889,"time_ago":"2 years ago","type":"comment","content":"

I think I am still missing what you are referring to. The guide on Threema's site promts you to extract the APK from your phone via adb which you then `diff -r` with the locally compiled version. [1] As far as I am aware it does not matter whether Google or Threema modified the APK before uploading it to the Play Store since you would notice either way.

[1]https://threema.ch/en/open-source/reproducible-builds","comments":[{"id":38559879,"user":"orangepurple","time":1701973554,"time_ago":"2 years ago","type":"comment","content":"

That works as long as you always check after each update.","comments":[{"id":38560555,"user":"snoutie","time":1701976619,"time_ago":"2 years ago","type":"comment","content":"

I agree with you. That's the case with every software project.","comments":[],"comments_count":0,"level":6,"url":"item?id=38560555"}],"comments_count":1,"level":5,"url":"item?id=38559879"}],"comments_count":2,"level":4,"url":"item?id=38559138"}],"comments_count":3,"level":3,"url":"item?id=38558550"}],"comments_count":4,"level":2,"url":"item?id=38557418"}],"comments_count":5,"level":1,"url":"item?id=38556612"}],"comments_count":6,"level":0,"url":"item?id=38556118"}],"comments_count":7,"url":"item?id=38556094"}

Comment by orangepurple