Embed Notice

@david_chisnall @dalias @guardianproject @signalapp @fdroidorg

I see a real point challenging your overstatement. This doesn't strike me as arguing for the sake of arguing, but rather as correcting the myth of live code injection into signed builds.

This converts the original overstatement from "signal (and everything else?) will run arbitrary code downloaded at runtime" into "blobs are a risk".

This is a much less compelling and startling (headline-worthy) claim.