<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div>> adrian kashivskyy wrote:</div><div><br /></div>> open-source projects and that most of them are compiled by users<div><br /></div><div><br /></div><div><div><div>Maybe that's true, but there are apps where most of users just download the binary. A great example is Signal for iOS. There's no way to verify the binary comes from the supposed source code. So "open source" is providing all these users with a false sense of security.</div><div><br /></div><div><br /></div><div>Imagine if this was possible: (1) Download an "open source" app on your iPhone from the App Store. (2) Connect your iPhone to your Mac and extract the app binary to your Mac. (3) Compile the app's source code from GitHub. (4) Compare the SHA-256 hashes of both binaries and verify they're the same.</div><div><br /></div><div><br /></div><div>Wouldn't this be cool? I think so, because any user could ask a tech-savvy friend to verify the binary. The app's reputation would go down the tubes if the SHA-256 hashes would stop matching.</div><div><br /></div><div><br /></div><div>From this perspective, I think bitcode, app thinning, etc. are taking us backwards. I hope those never become mandatory. Developers should have the option to make steps (1)-(4) possible.</div><div><br /></div></div></div> </body>
</html>