How do we verify if the code deployed in same as the one published?

Question

My question might be naive but wanted to clarify this anyway.

We see software being published as open source. Take for example Signal. We can audit the software since its public. But how do we verify if the code that gets deployed in their actual servers are same as the one available in their public code repositories?

I'm particularly concerned about things like data privacy and security. Let's say the open source version of an application (e.g. Signal) collects very little of my data. But unless I can verify if the same code has been deployed on to their servers, I cannot be sure. Signal may have another private code repository which may be doing much more than what is publicly available in their repo.

Having said this, how do I make sure the software running in Signal's server is same as the one available in its public code repository?

Answer 1

You simply can't do this, unless they granted you login access to their production servers. In other words, you cannot verify the behavior of any server you do not control. Also, unless they built their service using AGPL-licensed code, they do not have a legal obligation to expose the actual code of their service. (See the end of this answer.)

In the case of Signal and other security-oriented applications, you shouldn't need to do this: a securely-designed client should already assume worst-case behavior by any host outside of the user's control. Since the client application encrypts messages before it sends them to the server, a compromised (or otherwise malicious) server cannot do anything worse than simply refuse to deliver messages in a timely fashion. Even in the worst case, a service that only has access to encrypted messages cannot

• read encrypted messages sent by clients, nor
• misdirect messages to other recipients (as those wrong recipients would not be able to decrypt the messages), nor
• replay past messages (since a well-designed protocol will use nonces or sequence numbers to uniquely identify messages).

I suppose a malicious operator could gather metadata about who is talking to whom, but this could be done simply by looking at their own system log files, without any modification to their service's code.

Finally, if any part of the service is based on code licensed under the Affero GPL (AGPL), the server operators have a license obligation to share the source of their deployed service. Of course, there is no way to know that this is done honestly; it is not possible to definitely prove that their deployed code matches the code that they share.