Posts and replies

@S1m @IzzyOnDroid @unifiedpush No one but Google can verify nothing is hidden in there as it's encrypted.

You'd have to audit the code that generates it as well as all the inputs and then verify you get an exact match, since you cannot look at the data from the block itself: it's a completely opaque encrypted binary blob (which means it's not exactly FOSS either).

But you can't currently do that since it's not even reproducible: https://issuetracker.google.com/issues/268071369

At IzzyOnDroid, our scans try to flag what we can: https://gist.github.com/obfusk/a993b1bb54f52e1f6d2f56b1f97b2100

But there are plenty of places to hide something; e.g. F-Droid would not catch this at all since they only flag a handful of specific blocks instead of anything unexpected: https://github.com/obfusk/sigblock-code-poc