Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wire messenger server code open-sourced

github.com

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Wire messenger server code open-sourced

#51

Post by milesrout »

giancarlostoro wrote: post #49
milesrout wrote: post #38

Earlier quoted context omitted.

That's not accurate at all. If you contribute back changes to it then they have to comply with the license too and publish the source.

The entire purpose of the AGPL is that users of the server are now users of your program, so having access to the code is their right. IANAL but this is how I've always understood the AGPL to work. See: https://tldrlegal.com/license/gnu-affero-general-public-lice... Edit: See also their own FAQ: http://www.affero.org/oagf.html#How_does_the_Affero_Public_L...

That's my point.

The GPL goes both ways. Wire release under the AGPL, sure. That means if you want to use it on your server you have to release the source code of any modifications. Of course you do. But they do too. It's open source, they accept contributions. Those contributions are copyright the contributors and licensed AGPL.

Re: Wire messenger server code open-sourced

#52

Post by detaro »

milesrout wrote: post #38
giancarlostoro wrote: post #17

Earlier quoted context omitted.

Also mind the license. It means anyone competing with Wire has to comply with the AGPL which is specific to servers. If you modify the code, you must publish it, whilst Wire can retain their own modifications to the server.

That's not accurate at all. If you contribute back changes to it then they have to comply with the license too and publish the source.

At least for contributions you directly submit to their project, they require you to sign a CLA. If I'm reading it right it allows them to use your changes in a private fork as well, as long as they are also included in the public version.

https://cla-assistant.io/wireapp/wire-server

Re: Wire messenger server code open-sourced

#53

Post by JshWright »

walterbell wrote: post #41
zedred wrote: post #34

Earlier quoted context omitted.

I haven't directly explored the source for either in little while, so I should take a new look. I might be a little out of date, but the things that I have seen second hand recently confirmed my earlier conclusions. Like I recently saw an announcement from Wire that calls are now secure, but they had been advertising them as secure all along! I had even spent time looking through the code but didn't know that calls w…

Did you see that they implemented CBR for audio calls and submitted patches to both Signal and WebRTC? https://medium.com/@wireapp/call-security-constant-bit-rate-...

In 2017... CBR has been a thing in secure calling apps for ~5 years now.

Re: Wire messenger server code open-sourced

#54

Post by ikawe »

ThisIsUnfair wrote: post #40
fullsage wrote: post #24

The title for this post should be changed to "a piece of the wire messenger server code open sourced." Most of the source is not open source, you can't run your own. Also, holy shit they're storing a lot of information about their users: * All of your contacts. * Unencrypted profile information for everyone. * Every active conversation you have. * Every archived conversation you have. * The frequency that you communi…

I've I don't know much about security so I really have no constructive criticism, obviously, one can easily make lots of investigative inferences from the information Wire collects and that is troubling enough. If I understand correctly signal stores only metadata. My question whats the format of the metadata what kind of information does it retain. Is it anywhere close to what Wire is storing? I would appreciate cla…

Signal service doesn't store message routing meta data nor what groups you are in.

In response to a subpoena for specific user's data:

"the only information we can produce in response to a request like this is the date and time a user registered with Signal and the last date of a user's connectivity to the Signal service."

https://whispersystems.org/bigbrother/

Re: Wire messenger server code open-sourced

#55

Post by [deleted] »

ThisIsUnfair wrote: post #40
fullsage wrote: post #24

The title for this post should be changed to "a piece of the wire messenger server code open sourced." Most of the source is not open source, you can't run your own. Also, holy shit they're storing a lot of information about their users: * All of your contacts. * Unencrypted profile information for everyone. * Every active conversation you have. * Every archived conversation you have. * The frequency that you communi…

I've I don't know much about security so I really have no constructive criticism, obviously, one can easily make lots of investigative inferences from the information Wire collects and that is troubling enough. If I understand correctly signal stores only metadata. My question whats the format of the metadata what kind of information does it retain. Is it anywhere close to what Wire is storing? I would appreciate cla…

[deleted]

Re: Wire messenger server code open-sourced

#58

Post by walterbell »

JshWright wrote: post #53
walterbell wrote: post #41

Earlier quoted context omitted.

Did you see that they implemented CBR for audio calls and submitted patches to both Signal and WebRTC? https://medium.com/@wireapp/call-security-constant-bit-rate-...

In 2017... CBR has been a thing in secure calling apps for ~5 years now.

Can you recommend some iOS/Android apps which support CBR?

Re: Wire messenger server code open-sourced

#59

Post by Siimteller »

zedred wrote: post #26
walterbell wrote: post #12

Earlier quoted context omitted.

https://medium.com/@wireapp/wires-independent-security-revie...

Probably worth mentioning this is a paid report for one library they use, not the Wire app.

The post states that the app level review is coming. As a comparison afaik Signal only has protocol review available, no implementation review.

Edit: typo

Re: Wire messenger server code open-sourced

#60

Post by Siimteller »

mbrubeck wrote: post #14
infodroid wrote: post #9

It's great to see more Haskell code being used in production.

And a little bit of Rust, too! https://github.com/wireapp/wire-server/tree/master/libs/libz...

If you're into rust then their crypto is all in Rust https://github.com/wireapp/proteus
Post reply on HN