Hacker News Reader

The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.

View on HN

This is literally an impossibility. Java apps are typically obfuscated with randomization of symbol names. Each build is unique and not reproducible.

You are better off verifying the actual compiled and distributed apk files than verifying the source.

It's impossible?

https://whispersystems.org/blog/reproducible-android/

Simply open sourcing the code doesn't give that validation.

Not completely but I can certainly look at it, compile, and then side-load it onto my device knowing it's what it said it was.

Reply on news.ycombinator.com