Exactly, I’m also puzzled by folks who even mention server-side code in this context. Publishing the server code doesn’t improve security, because - unlike with the client-side code - there’s no way to verify that the same code is run on the servers.

And you don’t even need the server-side code to check the integrity of Secret Chats - they are solid regardless of what’s going on on the servers (that’s the whole point). In other words, publishing server-side code won’t help verify neither Secret, nor Cloud Chats, and would constitute a marketing gimmick that has nothing to do with security.

Me: The code of Telegram apps is open. It is verifiable. No other app has verifiable builds. WhatsApp’s code is hidden and intentionally obfuscated.
Confused user: You are lying, your server code is not open! 🤬
Me: 🤯

So why not publish the server code anyway, even if it adds zero to security? 3 years ago I learnt that an authoritarian regime (you may guess which) was looking for a way to obtain Telegram’s server code. Their…

Well, publishing server side code IS actually important if you provide TLS encryption - in other words, if you encrypt data on the way to your servers, and then from your servers to the recipient. Of course, if Telegram were exclusively based on end-to-end-encryption, your statement would absolutely be valid. But usually, you have TLS encryption in chats (except secret chats) and in groups by default. This means that, if we can't obtain the server-side code, we'll have to blindly trust Telegram to keep our data safe and refrain from spying on us. This is an obvious risk and thus I must say that, in my opinion, Telegram is still vastly inferior to apps like Threema, while of course being the superior choice compared to WhatsApp and Facebook Messenger.