Why?
These applications are super complex and you can't count on all eyeballs detecting a potential backdoor. And, you don't know if the code in the repo matches what you download from the App Store.
These applications are super complex and you can't count on all eyeballs detecting a potential backdoor. And, you don't know if the code in the repo matches what you download from the App Store.
You are also right that appstores are a problem. However, one of the nice things they do is using signatures to prevent tampering with the builds. So having a build system that produces reproducible builds and signatures means users can check whether things line up.
A bigger problem is the reliance on the phone network for identity. A lot of these chat clients insist on using telephone numbers for identifying users. This has been used to shut down chat networks in countries with telecom operators that are collaborating with governments.
If you want to stay secure, most of the chat apps out there are problematic at some level. Signal is one of the very few decent options out there. It is one of the few solutions that has both open source clients and servers and a wide community of people using it and scrutinizing it. With e.g. whatsapp, you are at the mercy of a multinational with a track record of indifference and negligence towards the goal of preserving their user's privacy and, worse, a strong incentive towards doing the exact opposite.
As for not knowing what has been downloading (if someone tempered with), the best approach is compiling it on your own.
The reason I ask is that this is an oft repeated claim about open source by developers yet when I talk to security people they don’t seem to care about open source nearly as much. To them inspecting binaries is table stakes anyway.
Meanwhile people write backdoors that aren’t obvious for fun. http://underhanded-c.org/
Eventually, maybe. How many eyeballs and how long to find Heartbleed?
Bringing this up as an argument is a sensible as claiming that transparency and democracy isn't any better than a dictatorship because there is still corruption.