alt Hacker News>> This is not true. I can build Signal from source from GitHub
> Sure, but can you find an NSA-designed backdoor in the source code?
You're moving the goalpost. They were responding to the claim suggesting it's impossible to get non-Signal provided signal.
>> you can get it once and disable autoupdates
> Try doing that with Signal, and you'll be unable to connect to the main network in just a few days because you get out of sync.
That's demonstrably false. On one of my idle/backup phones I'm using Signal 8.8.2, released in April 2026, almost 3 full months ago. It can not only connect to the network but everything works, with every contact.
You might think of the official Signal client expiration, but that's client side (meaning that you can compile and use the version that doesn't have it) and..... 90 days, not "a few".
I don't have a concrete number for the server side of enforcement though (minimumVersions seems to be populated at start time, with the defaults not committed to the repo). It's not entirely unreasonable to assume that the lowest official supported version is the one that introduced the concept of usernames, and the only meaningful capability test is SPQR.
> Also, what do you do if there's a high severity CVE on the program? You still don't update or you re-audit all the new code?
I think disabling auto update was shown as a possible strategy against a silent, targeted auto update. Not a way to remain protected against the general CVEs.
Non sequitur.
> You're moving the goalpost. They were responding to the claim suggesting it's impossible to get non-Signal provided signal.
That was never my claim. The claim is that you cannot protect youself from Signal being malicious if Signal is the maker of the software. Compiling the software yourself doesn't help against the kind of adversary in the threat model.
> That's demonstrably false. On one of my idle/backup phones I'm using Signal 8.8.2, released in April 2026, almost 3 full months ago. It can not only connect to the network but everything works, with every contact.
Lucky you, you only need to fully audit the codebase every 3 months.
I'm using the Signal apk directly so I'm painfully aware of the frequency of the breakages.
> I think disabling auto update was shown as a possible strategy against a silent, targeted auto update. Not a way to remain protected against the general CVEs.
I don't think you understand my point. I'm not talking about the CVE being exploited against you. The CVE will just push you to download the compromised update, breaking your “security through lack of update” policy.