11–20 of 69 posts
> This continues to cause significant harm to WhatsApp. $16bn says otherwise.
Maybe libraries/clients would impact WhatsApp's ability to rework their backend to use FB infra now that they've been acquired?
With the poor, let's say terrible, security posture WhatsApp always had, this is really not the way to communicate the message that they care and want their software to be scrutinized. Open implementations are a great help to any reverse engineer trying to figure out the mess that is their protocol. This is exactly what triggers full disclosure.
Interesting. Trademark law is probably pretty strong against repositories named "WhatsApp" or something very similar. Using the logo without permission as well. Describing a project as "working with WhatsApp" would probably not be an actionable trademark infringement. Code that works with the WhatsApp API is almost certainly not "infringing", unless there's some "encryption" going on. Unfortunately the DMCA takedown…
WhatsApp can easily enough restrict API access to its own clients if it chooses to do so, which is a far better solution than trying to shut down what's apparently an easy library to write.
Interesting. Trademark law is probably pretty strong against repositories named "WhatsApp" or something very similar. Using the logo without permission as well. Describing a project as "working with WhatsApp" would probably not be an actionable trademark infringement. Code that works with the WhatsApp API is almost certainly not "infringing", unless there's some "encryption" going on. Unfortunately the DMCA takedown…
They probably fall under nominative use, which is an affirmative fair use defense. Describing an API or implementation of XYZ as a "Webclient for XYZ" should be fine.
With the poor, let's say terrible, security posture WhatsApp always had, this is really not the way to communicate the message that they care and want their software to be scrutinized. Open implementations are a great help to any reverse engineer trying to figure out the mess that is their protocol. This is exactly what triggers full disclosure.
To be fair, isn't the case for most proprietary software - even for the most security-concerned closed-source companies?
No one at WhatsApp has ever warrented that their software is open source, that they want to produce open source or that they share open source values.
Interesting. Trademark law is probably pretty strong against repositories named "WhatsApp" or something very similar. Using the logo without permission as well. Describing a project as "working with WhatsApp" would probably not be an actionable trademark infringement. Code that works with the WhatsApp API is almost certainly not "infringing", unless there's some "encryption" going on. Unfortunately the DMCA takedown…
> Interesting. Trademark law is probably pretty strong against repositories named "WhatsApp" or something very similar. Using the logo without permission as well. They probably fall under nominative use, which is an affirmative fair use defense. Describing an API or implementation of XYZ as a "Webclient for XYZ" should be fine.
With the poor, let's say terrible, security posture WhatsApp always had, this is really not the way to communicate the message that they care and want their software to be scrutinized. Open implementations are a great help to any reverse engineer trying to figure out the mess that is their protocol. This is exactly what triggers full disclosure.
"this is really not the way to communicate the message that they ... want their software to be scrutinized" To be fair, isn't the case for most proprietary software - even for the most security-concerned closed-source companies? No one at WhatsApp has ever warrented that their software is open source, that they want to produce open source or that they share open source values.
With the poor, let's say terrible, security posture WhatsApp always had, this is really not the way to communicate the message that they care and want their software to be scrutinized. Open implementations are a great help to any reverse engineer trying to figure out the mess that is their protocol. This is exactly what triggers full disclosure.
"this is really not the way to communicate the message that they ... want their software to be scrutinized" To be fair, isn't the case for most proprietary software - even for the most security-concerned closed-source companies? No one at WhatsApp has ever warrented that their software is open source, that they want to produce open source or that they share open source values.
Frequently, and it is an attitude I really dislike.
A serious dedicated attacker can replicate the reversing work quite fast, but this kind of things make it really hard to dedicate a couple of hors to assessing the quality of a protocol.
Moreover, they demonstrated not to be security-concerned, so this comes to me as covering tracks, even if it isn't.