| At the end what matters the most is who is operating the project and which laws they have to follow. One point to keep in mind is that almost all open-source projects don't really have transparent builds, and the transparent builds are rarely built really transparent (using public compilers, etc), but more behind the curtains. Plus, even an open-source app that would have perfectly transparent builds (which is not the case from what I've seen), the app publisher can find way to push targeted updates (via app stores), feature flags, betas or settings to very specific users, etc if compelled to do so. And there is always a potential excuse that store builds don't match open-source code, because the stores are re-signing the apps (and changing the checksums). So it's more about who you decide to trust, unless you build the client yourself, which is an extreme outlier. Most Signal users I know (even very sensitive users), they have iOS, they don't build the code themselves, they don't review the code, etc. They just press Install (and I understand them, I would do the same). |
Most Signal users don't need to do that. But sensitive users can. I think it matters.