Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wire messenger server code open-sourced

github.com

Post reply on HN
Print view View original

31–40 of 71 posts

Re: Wire messenger server code open-sourced

#31

Post by MichaelGG »

gpm wrote: post #29
fullsage wrote: post #24

The title for this post should be changed to "a piece of the wire messenger server code open sourced." Most of the source is not open source, you can't run your own. Also, holy shit they're storing a lot of information about their users: * All of your contacts. * Unencrypted profile information for everyone. * Every active conversation you have. * Every archived conversation you have. * The frequency that you communi…

So I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one. * All of your contacts. Wire contacts, they only store non-wire contacts in a hashed form, and there's an opt out for non-wire contacts. * Unencrypted profile (Isn't this just profile picture (which is shown to people you haven't connected with), and name anyways…

Why do they need to know active conversations to route? Every time you send a message it should contain the needed info.

Re: Wire messenger server code open-sourced

#32

Post by voidz »

y0ghur7_xxx wrote: post #5

there is something i never understood, maybe someone can help me: what makes wire better than xmpp? why do we need yet another protocol for chat?

Video calling works splendidly, which is why my wife and I chose Wire.

Back when our boy was just a few months old and my wife's maternity leave came to an end, keeping in touch with video made going back to work a less difficult. She'd call every time she needed some assurance that we were OK, and I could show her we were, in high resolution.

Signal didn't have video calling back then, and Skype is out of the question because I really distrust Microsoft.

Re: Wire messenger server code open-sourced

#33

Post by fullsage »

gpm wrote: post #29
fullsage wrote: post #24

The title for this post should be changed to "a piece of the wire messenger server code open sourced." Most of the source is not open source, you can't run your own. Also, holy shit they're storing a lot of information about their users: * All of your contacts. * Unencrypted profile information for everyone. * Every active conversation you have. * Every archived conversation you have. * The frequency that you communi…

So I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one. * All of your contacts. Wire contacts, they only store non-wire contacts in a hashed form, and there's an opt out for non-wire contacts. * Unencrypted profile (Isn't this just profile picture (which is shown to people you haven't connected with), and name anyways…

> So I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one.

Maybe it's good that they've documented this somewhere, but I don't think most Wire users read white papers. I'm a dev and I was surprised. Their outward facing marketing didn't lead me to think they track all my contacts and the state of every conversation I am having. It very clearly suggests the total opposite.

They need to do much better than this if they want people to think they take security/privacy seriously.

>> * Every group that you're in.

> This is the same as conversations... they clearly need to know this to route messages.

Why? That's not true for Signal from what I can tell.

Re: Wire messenger server code open-sourced

#34

Post by zedred »

walterbell wrote: post #30
zedred wrote: post #27

Earlier quoted context omitted.

I was hopeful at first. A large VC funded company with a big full time team should run circles around a small open source effort, but their security is still way behind Signal. I was also quickly put off by their "less than honest" marketing.

Could you share details on "security is still way behind Signal"? Edit: found previous discussion, https://news.ycombinator.com/item?id=13132157

I haven't directly explored the source for either in little while, so I should take a new look. I might be a little out of date, but the things that I have seen second hand recently confirmed my earlier conclusions.

Like I recently saw an announcement from Wire that calls are now secure, but they had been advertising them as secure all along! I had even spent time looking through the code but didn't know that calls weren't authenticated. Now are they really secure? I don't know, they said that before too, and the source is so hard to follow. Then I saw a post that showed they weren't even doing cert pinning, which is so basic.

I wanted to like it, but the more I looked the more I felt like "security" was just sprinkled on as an after thought.

Re: Wire messenger server code open-sourced

#35

Post by gpm »

fullsage wrote: post #33
gpm wrote: post #29

Earlier quoted context omitted.

So I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one. * All of your contacts. Wire contacts, they only store non-wire contacts in a hashed form, and there's an opt out for non-wire contacts. * Unencrypted profile (Isn't this just profile picture (which is shown to people you haven't connected with), and name anyways…

> So I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one. Maybe it's good that they've documented this somewhere, but I don't think most Wire users read white papers. I'm a dev and I was surprised. Their outward facing marketing didn't lead me to think they track all my contacts and the state of every conversation I a…

> Maybe it's good that they've documented this somewhere, but I don't think most Wire users read white papers.

In the sense of "most users don't read privacy policies", sure.

It's pretty clearly linked in their privacy policy as "this is where you should go for information", I know I'm not the only wire user who read it before installing it.

> Why? That's not true for Signal from what I can tell.

Ya... I think I overstated it. It's the easiest way to route messages but it's not the only way.

Re: Wire messenger server code open-sourced

#36

Post by isilauzelis »

y0ghur7_xxx wrote: post #5

there is something i never understood, maybe someone can help me: what makes wire better than xmpp? why do we need yet another protocol for chat?

I assume it's the same thing as signal is for me: it's the thing with UX good enough to convince some of my friends to use it. They wouldn't use buggy xmpp, tox clients or things without many of the features like ricochet.

I like testing these tools with cryptonerd friends though.

Re: Wire messenger server code open-sourced

#37

Post by milesrout »

seagreen wrote: post #18
giancarlostoro wrote: post #17

Earlier quoted context omitted.

Also mind the license. It means anyone competing with Wire has to comply with the AGPL which is specific to servers. If you modify the code, you must publish it, whilst Wire can retain their own modifications to the server.

Weirdly I think free licenses are great for businesses to use and open licenses are great for personal projects. If I'm writing a hobby project, I want it to help the ecosystem as much as possible. If businesses want to use it then great! So MIT. If I'm running a business my main goal is to survive. I want to help the community as well, but I obviously can't do that if I go broke. "Put on your own oxygen mask before…

This is really bad abuse of terminology. Non-copyleft and copyleft licenses are all both open source and free software licenses. They're all free and open, which are synonyms in the context of software licensing. I think you'll confuse people if you use the terminology as you are using it (plus it's just plain wrong).

Personally, if I'm writing a hobby project then I want it to be copyleft. Of course I want it to be copyleft. Why wouldn't I? I don't want some company taking my work, making proprietary changes and improvements to it and then not releasing those back to me. Copyleft is simple courtesy that you'd expect anyway, codified into a license.

Re: Wire messenger server code open-sourced

#38

Post by milesrout »

giancarlostoro wrote: post #17
otoburb wrote: post #3

How will Wire make money and stay viable while maintaining this level of service?

Also mind the license. It means anyone competing with Wire has to comply with the AGPL which is specific to servers. If you modify the code, you must publish it, whilst Wire can retain their own modifications to the server.

That's not accurate at all. If you contribute back changes to it then they have to comply with the license too and publish the source.

Re: Wire messenger server code open-sourced

#39

Post by seagreen »

milesrout wrote: post #37
seagreen wrote: post #18

Earlier quoted context omitted.

Weirdly I think free licenses are great for businesses to use and open licenses are great for personal projects. If I'm writing a hobby project, I want it to help the ecosystem as much as possible. If businesses want to use it then great! So MIT. If I'm running a business my main goal is to survive. I want to help the community as well, but I obviously can't do that if I go broke. "Put on your own oxygen mask before…

This is really bad abuse of terminology. Non-copyleft and copyleft licenses are all both open source and free software licenses. They're all free and open, which are synonyms in the context of software licensing. I think you'll confuse people if you use the terminology as you are using it (plus it's just plain wrong). Personally, if I'm writing a hobby project then I want it to be copyleft. Of course I want it to be…

I should have written libre not free. That has a clear meaning (and it's what I use in the followup comment). Do you have a better suggestion than "open" for "no restrictions on use"?

> Personally, if I'm writing a hobby project then I want it to be copyleft.

Totally up to you! In the context of Haskell projects though, I really, really want to see Haskell businesses succeed as well as the open Haskell ecosystem.

Re: Wire messenger server code open-sourced

#40

Post by ThisIsUnfair »

fullsage wrote: post #24

The title for this post should be changed to "a piece of the wire messenger server code open sourced." Most of the source is not open source, you can't run your own. Also, holy shit they're storing a lot of information about their users: * All of your contacts. * Unencrypted profile information for everyone. * Every active conversation you have. * Every archived conversation you have. * The frequency that you communi…

I've

I don't know much about security so I really have no constructive criticism, obviously, one can easily make lots of investigative inferences from the information Wire collects and that is troubling enough.

If I understand correctly signal stores only metadata. My question whats the format of the metadata what kind of information does it retain. Is it anywhere close to what Wire is storing?

I would appreciate clarifications on this.

Post reply on HN