Re: [guardian-dev] Google's new App Signing service

2017-05-19 Thread Elmor
This is not only happening on mobiles. Since about one year, your add-ons on Opera and Firefox are "verified". If developers do not let their add-on veriefy, they are suspended. What also poped into my eyes was point "3. Permanent Enrolement". If you have a well going app and the name is in

Re: [guardian-dev] Google's new App Signing service

2017-05-19 Thread Hans-Christoph Steiner
With iOS, you need to use Apple tools to decrypt your official app binary, so there is no way to verify that Apple isn't inserting anything. With Android, we'll still be able to compare APKs. So if you submit an app that was reproducibly built, then you can compare the Google APK to your own

Re: [guardian-dev] Google's new App Signing service

2017-05-19 Thread Natanael
Is there any plausible way to get them to only apply verifiable modifications? Such as compression using algorithms proven to preserve original behavior? I'm aware that would require a ton of resources (both in development and computationally), but is it doable? - Sent from my phone Den 19 maj

Re: [guardian-dev] Google's new App Signing service

2017-05-19 Thread Nathan of Guardian
On Fri, May 19, 2017, at 07:29 AM, Michael Rogers wrote: > Paranoid people might suspect that this simultaneous move by Apple and > Google is the result of political pressure to provide some means of > adding/removing functionality, such as end-to-end encryption. You read my mind. +n

Re: [guardian-dev] Google's new App Signing service

2017-05-19 Thread Michael Rogers
It's interesting that this is happening at the same time Apple is introducing bitcode, which similarly allows Apple to optimise the app and sign the optimised version. This makes it very hard for developers to verify that their users are receiving their apps without any added/removed

Re: [guardian-dev] Question about Orbot and Tor Path Selection

2017-05-19 Thread Michael Rogers
On 16/05/17 21:34, Nathan of Guardian wrote: > > > On Tue, Apr 11, 2017, at 02:39 PM, Kevin Gallagher wrote: >> Please forgive me if this is not the correct place for this question. I >> was wondering if Orbot checked for network connectivity every time it >> attempts to build a Tor circuit or