David Lomeli

[David Lomeli @davidalomeli]

@vikrantnyc I think Cake should:

- fix the `getEncryptionKey()` issue;
- publish or commit the generated `secure_storage.dart`;
- publish reproducible Android build instructions;
- publish independent rebuild logs showing APKs match source.

After the xz backdoor we cannot rely on trust.

[David Lomeli @davidalomeli]

@IntCyberDigest I could not find public evidence that Cake Wallet mobile apps have reproducible builds. Signed APKs and hashes prove the APK came from Cake, but not that it matches the reviewed source. Vik has dismissed any criticism of this. Cake app has audit gaps.

[David Lomeli @davidalomeli]

Check out Brittanya Razavi at https://t.co/FwZTx6jU71!

https://t.co/0YOkuc1Gdz

[David Lomeli @davidalomeli]

@Lillie0071 Nope

[David Lomeli @davidalomeli]

@meghan2y 100

[David Lomeli @davidalomeli]

I just joined LinkedIn and created my professional profile. Join my network. http://t.co/F0iiLuVr #in