21 ms·

Wire open-sourced

488 points by arunc 10y ago

gfosco 10y ago
A link to a GitHub organization isn't great.. I'd say this is better: https://medium.com/@wireapp/you-can-now-build-your-own-wire-client-ea9ed9214e26 https://medium.com/@wireapp/you-can-now-build-your-own-wire-... but even that doesn't clearly explain what Wire is. Visit https://wire.com https://wire.com to find out it's an encrypted video and group chat app.
- computator 10y ago
  From a Hacker News reader's perspective, the following page seems to be the best explanation of what it does: https://wire.com/privacy/ https://wire.com/privacy/ Also, the Wikipedia entry is a good overview: https://en.wikipedia.org/wiki/Wire_Swiss https://en.wikipedia.org/wiki/Wire_Swiss
- toomanythings4 10y ago
  There are just so many posts on tech sites to things like this where one wouldn't have a clue what it is or does. You would think the organization pointed to would have some motivation to explain themselves.
- walterbell 10y ago
  From http://fortune.com/2016/07/22/wire-open-source/ http://fortune.com/2016/07/22/wire-open-source/: ... the move has two main objectives: transparency and building an ecosystem of secure services that can talk to one another ... there is scope for organizations to design Wire-based apps that are tailored to different use cases, such as enterprise communications and digital health, and even automotive and the Internet of things ... "You can register with email and it doesn’t require mobile.” He also pointed out that the apps don’t need to be interoperable, though federation at some point would be nice. “It’s a shame we have so many islands in the communications space,” he added. HN comments from Wire marketing: https://news.ycombinator.com/threads?id=Siimteller https://news.ycombinator.com/threads?id=Siimteller
- PhasmaFelis 10y ago
  I really hate HN posts that just link to an error page, or a spreadsheet, or a Github repo with no readme, or something else that makes no sense unless you already know whatever you're supposed to be taking from it. Please don't do this, everyone.
nanch 10y ago
See https://wire.com https://wire.com for more information since the linked repos provide no context. "Crystal clear voice, video and group chats. No advertising. Your data, always encrypted."
- qznc 10y ago
  So, Signal plus video chat?
  - stemuk 10y ago
    Probably not, scince Signal doesn't really support secure web communication (without phone routing).
    - woah 10y ago
      What do you mean? Are you objecting to the phone number used as username?
      - nxzero 10y ago
        It's not just a phone number, but also the IMEI. And the objection is that the service makes it (intential) very hard to use it anonymously.
    - lorenzhs 10y ago
      This phone routing story keeps getting repeated here but it's not true and never was. The devices share a key but are completely independent. You can easily try it, put your phone into airplane mode and Signal-Desktop works just the same.
      - nxzero 10y ago
        Issue may not be the routing, but that a mobile device is required to create an account. Are you saying that the Signal Protocol created Open Whisper Systems, which is lead by Moxie Marlinspike, does not require a phone number to work? (Say the Signal Protocol instead of the browser extension since the browser extension uses the protocol to work.)
20andup 10y ago
I wonder what the business model is?
- computator 10y ago
  They might charge for certain premium services in the future, according to https://en.wikipedia.org/wiki/Wire_Swiss#Business_model https://en.wikipedia.org/wiki/Wire_Swiss#Business_model
  - detaro 10y ago
    If I read the TOS correctly, you are also not allowed to write any kind of chat bot against it. If the current hype for bots remains, bot access might be another thing to sell.
    - laksjd 10y ago
      That might be hard to enforce given that the open source client will make creating unofficial bots fairly trivial. Given that they already have Spotify and giphy integration I'm going to predict Skype-like monetization with sponsored integrations (e.g. Skype has those sponsored animated emoji things)
    - deleted 10y ago
      [deleted]
mahyarm 10y ago
Now all this needs is a few good third party audits, verifiable builds and it's the holy grail of encrypted communications!
- ianopolous 10y ago
  I would say the Holy Grail would be fully decentralized without needing central servers, but this does look cool nonetheless.
  - mrbiber 10y ago
    I am very hopeful that Briar (https://briarproject.org/ https://briarproject.org/) will achieve this. They don't use any centralized infrastructure, the app works even when the net is down, and they have e completely distributed and thus uncensorable forums and blogs.
    - ianopolous 10y ago
      Interesting. Do you know how they handle identity/usernames/contact discovery without central servers?
      - mrbiber 10y ago
        As far as I know, the identity is just a public key. You can add contacts only by either scanning a qr-code disayed on your contact's phone in person or by being introduced to each other by a mutual contact, so there is no real need for discovery. As there are no servers at all (not even federated), this also means that no one can even enumerate users. Torsten Grote, one of the projects main developers, explains the technology behind it in this very nice presentation: https://m.youtube.com/watch?v=Dr42vZIoGqM https://m.youtube.com/watch?v=Dr42vZIoGqM
        andrewaylett 10y ago
        "No servers" doesn't feel quite right -- no dedicated servers, maybe, but the project depends on TOR, which has quite a lot of servers. I've not dug into the source, but I'm expecting each client to be using a TOR hidden service to allow peer-to-peer connections. The ability of TOR to allow essentially roaming services like this is a feature I'm always surprised isn't used more often. And although it's not something I was ever going to actually get around to, something like Briar has been on my list of interesting thins to try to do for a while -- I'm really glad someone else has had a similar thought and been able to run with it :).
stemuk 10y ago
I wonder how they encrypted their chat on the web client. Scince the Signal protocol is kind of the gold standard right now, probably their solution might in the end be the better one.
- eps 10y ago
  > Since the Signal protocol is kind of the gold standard right now Oy vey. The perils of reading HN too much.
  - mintplant 10y ago
    What, in your opinion, is the gold standard?
    - drdaeman 10y ago
      For now, isn't is still plain old boring OTR? No less secure (and because of its mature age, it had received more auditors attention), far more ubiquitous, and while not perfect, still doesn't seem to have too severe limitations that make its use too hard or impossible.
      - moxie 10y ago
        OTR doesn't work in asynchronous environments, which makes it infeasible to deploy on mobile devices. I think that's a pretty severe limitation in today's world. In terms of ubiquity, Signal Protocol is running on over two billion monthly active devices. I would be surprised if OTR's active install base exceeds a hundred thousand.
        drdaeman 10y ago
        Doesn't it? Not to challenge the authority, but I believe the only requirements OTR impose are constraints on the initial presence (thus, lack of offline operation) and constraints on message ordering. Which doesn't seem too severe to me, if the saying about "always connected" world is true enough in reality. Maybe I'm deeply mistaken here. But, I mean, 99% of my conversations are when both participants are online, and it does work for me in practice (and I can't realistically replace it with Signal) - that's why I've had the opinion that it's still haven't gave up on "gold" yet. As for ubiquity - 2 billion devices is great (and hope there will be more!), but I meant the other sort of it. I've ran OTR sessions over XMPP, ICQ, Skype and Telegram. I guess, it's a wrong sort of ubiquity, probably not something that works for the goal of "encryption for everyone", but it still works if I don't want to hop the services but layer security instead. Maybe that's too old-fashioned. Hope there will be Signal Protocol-based addons/libraries like this one day.
pedalpete 10y ago
I don't get how they can make statements like this "Only Wire offers fully encrypted calls, video and group chats available on all your devices". Webrtc is encrypted by default.
- pepesza 10y ago
  Because encryption without authentication is prone to MITM attacks. WebTRC does not have auth layer.
  - pedalpete 10y ago
    But they don't say anything about authentication, and authentication and encryption are two different things...
- saghul 10y ago
  WebRTC is only the audio / video part. Chat, groupchat, etc are not using it IIRC. Chat could use the data channel, though.
- laksjd 10y ago
  The other signal/axolotl protocol based systems currently don't support true multi device solutions. It's not a limitation of the protocol, after all Wire is based on it, too, just that Signal/WhatsApp decided not to implement it. Wire has true multi device support (basically multiple keys per identity)
  - moxie 10y ago
    Not sure what you're definition of "true multi device" is, but Signal Desktop does not do phone routing and functions whether your mobile device has connectivity or not: https://whispersystems.org/blog/signal-desktop-public/ https://whispersystems.org/blog/signal-desktop-public/
    - laksjd 10y ago
      Thanks, I thought it did phone routing, mostly because the Signal FAQ lists some odd restrictions on multi device usage (e.g. desktop can't be linked to the iOS app, cannot have iPad and iOS at the same time [1] [1]: http://support.whispersystems.org/hc/en-us/articles/213240927--Can-I-use-multiple-devices-Why-is-my-device-offline- http://support.whispersystems.org/hc/en-us/articles/21324092...
aleken 10y ago
Otto is my new best friend. I cannot see any information about a bot API on their site though...
- Siimteller 10y ago
  There's no not API available. We've been experimenting with a few internal bots (Otto is the most prominent) but that's the extent of it for now.
jalami 10y ago
Side note, but it's kind of strange that images on their site require cookies enabled to view. I didn't dig into a reason, I just white-list the sites I want to use cookies and found it odd that there were big white spaces before doing so.
- Siimteller 10y ago
  Weird, we'll check it out. Thanks for pointing it out.
deleted 10y ago
[deleted]
mei0Iesh 10y ago
Thank you! Wire is the best, with multiple device support, clean mobile app, and a desktop client. It'd be nice if it were a standard open protocol so everyone could implement it, and find a way to allow federation. I'd pay to help support.
melle 10y ago
I believe all their good intentions and I do hope they succeed. But for me it's too early to tell whether their business model will hold. If they build up a sufficiently large user base, but fail to monetize it and sell the company to e.g. Microsoft or Facebook, then I doubt how much of their original privacy / openness remains. Another thing that I wonder about: Does being Swiss-based give them a privacy advantage?
- laksjd 10y ago
  It might be mostly marketing since the Swiss have long switched from a 'swiss banking secrecy' mindset to fairly open cooperation with EU and US investigators. It's probably nevertheless better than being based in the US, just ask Lavabit ;)
grizzles 10y ago
A bold move by Wire. Open source is still a very disruptive play, and the world needs something like this. If they manage this well and triple down on developer engagement, it could work out quite nicely for them. EDIT: Thread title is slightly misleading. It looks like they did a Telegram. There is no server here.
- niftich 10y ago
  Correct, there's no server. I will avoid blockquoting large amounts of text but on their open source summary page [1], they give you two options: 1. you point your implementation to their server and you have to abide by their additional terms (which is exactly what I'd expect) - or - 2. you point your implementation to somewhere else, unspecified, and you're only bound by GPLv3 Right now, #2 is moot because there is no compatible server you can host. Once someone implements a compatible server, this will get a lot more exciting. [1] https://github.com/wireapp/wire#open-source https://github.com/wireapp/wire#open-source
  - ZenoArrow 10y ago
    Does the Wire licence agreement allow you to create a standalone server though? https://github.com/wireapp/wire/blob/master/README.md https://github.com/wireapp/wire/blob/master/README.md "Additionally, if you choose to build an Open Source App, certain restrictions apply, as follows: a. You agree not to change the way the Open Source App connects and interacts with our servers" Even if the company behind Wire seems trustworthy, if I cared about security I wouldn't want any interaction between clients to go through a server I didn't have control over.
    - niftich 10y ago
      If you read it in context, they say: "If you compile the open source software that we make available from time to time to develop your own mobile, desktop or web application, and cause that application to connect to our servers for any purposes, we refer to that resulting application as an 'Open Source App'." Then, they say the part you quoted, so the gist is that if you elect to use their servers, you have to use them the out-of-the-box way. But you're not required to use their servers, if you can somehow procure a compatible one. They're not helping you with that, though.
deltaprotocol 10y ago
I must say that my first impression is beyond positive. One to one and group chats, group video and audio calls, GIF search built-in, doodles, the best implementation of photos in the message stream that I've seen, poking and playable Spotify and Soundcloud music by just sharing links? All with end-to-end encryption? I have that "too good to be true" feeling but, still impressed. Just waiting for possible audits and more feedback from the security community. Edit: It's also Switzerland based, already supports Win10, MacOS, Web, Android and iOS, and to complete has the cleanest design I've seen in a messaging app.
- deleted 10y ago
  [deleted]
- Andrenid 10y ago
  I've been using it for a while just with 1 other friend who has it, and it's without a doubt my favourite IM as far as interface/functionality/etc. As usual it's just the matter of getting other people to use it. Everyone I know just uses FB Messenger or Telegram now.
- abcd_f 10y ago
  Looking them up on zefix.ch shows that they appear to be only registered in Switzerland, with Luxembourg ownership and non-Swiss management. Alan, their CTO and (co-?)founder is Swedish.
  - Siimteller 10y ago
    We have a small office in Zug, main dev center in Berlin and a few people here and there around the globe. Alan is originally from Croatia.
- unicornporn 10y ago
  I've been using it with friends and family for awhile on Android and macOS and it's fantastic, in theory. It has however been plagued with lots of bugs. The calling functionality, which I've used a lot, often stalls at "joining" and then nothing happens. It's not as polished or flawless as Telegram. It does not have a feature to compress video before sending for instance. But I can only expect that to change. Especially now, when anyone can write their own client.
_bojan 10y ago
Didn't see that coming. I think Wire is struggling to get new users and this move could put them on the map.
- Siimteller 10y ago
  We've actually nicely accelerated user growth this year. Going the OS route was always the plan, especially given the target audience of hacktavists, human rights organizations, journalists. Open source is tablestakes to be taken seriously. It's also just one of the steps towards more transparency.
  - zedred 10y ago
    I tried installing it and only had a single contact show up. And it turns out that contact had long since uninstalled the app (said it was very unreliable), but the server was still showing her as registered. From the app store numbers, it looks like Wire is still not even to a million monthly active users. For a funded app with a large full time staff and generous marketing budget, that's a pretty terrible sign several years after launching. I know that the founders are rich, but why would they continue funding an app that isn't showing adoption?
    - walterbell 10y ago
      One privacy advantage of Wire is that it does not force you to upload your address book to their server.
      - zedred 10y ago
        I didn't see that option, but either way the fact remains that even after several years, nobody is using the app. As a business with a large full time staff that needs considerable ongoing capital to continue, the numbers do not bode well for its future. Maybe being open source will change that, but I can't see it being a significant factor for the hundreds of millions of users they need to even begin to catch up. I think they were betting on end to end encryption to save them, but their biggest competitor launched better end to end encryption by default before they could.
saghul 10y ago
Lots of good stuff in there, thanks Wire! I just wish they had gone with something other than GPLv3 for libraries, like LGPL. Looks like they changed them on December, from MPL 2.0 to GPLv3. At any rate, there are lots of us who can use the code with that license :-)
sanjeetsuhag 10y ago
Can anyone explain to me why they use an UpsideDownTableViewController ?
- jtreanor 10y ago
  This is usually because the default scroll position of a conversation is at the bottom rather than the top so it significantly simplifies scrolling logic (which can get pretty complex). I am surprised they are using a table view rather than a collection view for this though.
- philo23 10y ago
  From memory, the easiest way to have the "top" of a table view at the bottom of the screen (like in Messages, so the latest message bubble appears at the bottom) is to flip the table view upside down using an affineTransform and then also flip each cell in the table view upside down as well (so the cell is the right way up again). This means you can insert new rows (message bubbles) at index 0 and they'll appear at the bottom, which makes it considerably easiest to add new messages.
  - deleted 10y ago
    [deleted]
arthurk 10y ago
Is there a way to download the OSX app without the Mac App Store?
- stephenr 10y ago
  Why, because a sandboxed app guaranteed to be from the author you think it's from is just too good a thing, and you prefer the heady rush of getting bombarded with MacUpdate spam when you get your apps? Fine, some developers don't want to use the MAS. Their choice. I don't understand users not wanting to use it. It's the simplest possible way to install an app and get automatic updates for those apps.
  - saiko-chriskun 10y ago
    I also avoid the MAS when possible.
    - stephenr 10y ago
      That still doesn't answer my question of why.
      - pikachu_is_cool 10y ago
        Because it's horrible UX. I don't want to open a whole other application, search for it on their placeform, and then authenticate with AppleID. Instead you can just download a .dmg or a .zip right from their website, like how it's been done for aeons.
        stephenr 10y ago
        What searching? The developer links you directly to their app in the store. For free apps you don't necessarily need to enter a password, for paid apps it's still simpler than whatever payment system the developer might be using. With the MAS you can go from viewing the app/developer website to the app being installed in as little as two clicks. How is that worse ux than manually downloading an archive/image, opening the file, moving the .app bundle or running the installer. There are some valid criticisms of the MAS. UX on the install process is not one of them.
deleted 10y ago
[deleted]
laksjd 10y ago
They offer a password reset function. How does that work? Do they hold my private key in escrow? I'd certainly hope not! Or does the password reset work by creating a new keypair? If so, does this at least generate WhatsApp style security warnings for people chatting with me? With some digging I've found a way to verify key fingerprints so that's nice, but it's manual, not QR assisted :(
happyslobro 10y ago
I found a file that is available as either MIT or GPL. Or is it only available under a union of the terms of both licenses? An intersection? Who knows, IANAL. https://github.com/wireapp/wire-webapp/blob/0cf9bf4/aws/main.py https://github.com/wireapp/wire-webapp/blob/0cf9bf4/aws/main... Why do people copy the license all over the place like that?
- spicyj 10y ago
  That file is GPL but parts of it were adapted from MIT-licensed code (which the MIT license allows). It can be treated as GPL.
- belorn 10y ago
  MIT has one condition: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. As the code include this, the author who distribute the code can thus prove in court that they are compliant with the wishes of the author/s of the MIT licensed software. The added GPL means that copies of this specific version also adds additional conditions that those distributing this version also need to follow. This mean in practice that they need to follow the GPL license and include the MIT copyright notice as stated above, in order to follow all the different authors wishes. Thankfully, MIT and GPL is compatible, so none of the conditions are contradicting with each other.
  - reubano 10y ago
    IANAL but I thought the compatibility was only one way. I.e., you can use MIT code in a GLP project but you can't do the reverse. My understanding is if you use GPL code in an MIT project, you have to make your entire project GPL.
    - belorn 10y ago
      Yes and no :). The MIT authors can not sue someone for not following GPL, and the GPL authors can't sue someone for using the MIT licensed code under MIT. There is one consideration however. One of the GPL license condition says "must license the entire work under GPL", which mean that in order to legally distribute the GPL part, the MIT licensed code will be under both GPL and MIT. As such the patent grant in GPL will cover the whole project for anyone distributing the GPL included version, and many interpret this condition as making the entire project GPL. The exception to that view is that a project can still continue license new code as MIT, and a distributor could simply remove the GPL parts when they want to use it in a MIT and BSD only/Proprietary/Patent enforcing situations. While I have not seen many MIT projects do this in regard to GPL add-ons and patches, it is the standard model for open core MIT projects to do this in regard to proprietary add-ons. I would thus not call the existence of optional GPL patches or add-ons as "make your entire project GPL", unless the additional code is essential to run the program.
jacek 10y ago
I am a user. I switched myself and my family from Skype a few months ago and it has been great so far. Quality of video and audio is great, Android app works very well (better than web based desktop versions). And it also works in a browser, which is great for me (Linux user).
vasili111 10y ago
Where is Windows client source code?
- Siimteller 10y ago
  It's all on GuyHub. Our windows client is webapp in Electron wrapper so that's what you're looking for.
  - Siimteller 10y ago
    Darn autocorrect. That's Github, of course.
- lipis 10y ago
  We will release the Electron's code as well in the coming weeks :)
maxpert 10y ago
Good to see people using Rust in production :)
redthrow 10y ago
Why does this Android app require a phone number to sign up? At least Hangouts lets me use the app without a phone number.
- walterbell 10y ago
  You can register with just an email, using a desktop web browser at http://app.wire.com http://app.wire.com, then use that account to login on mobile. Unclear why it's not possible to register a new email-only account from the mobile app.
  - vasili111 10y ago
    I hope they will fix this.
  - Siimteller 10y ago
    We had this, was confusing UX. Considering bringing it back.
mtgx 10y ago
I've been asking for three things from Signal for the past almost two years: 1) desktop app 2) video call support 3) self-deleting messages Signal finally (sort of) delivered a desktop app, but it still doesn't have the other two. Wire has the first two, but it's still lacking the last one. I hope one of them will have all three of these features soon.
- walterbell 10y ago
  This HN comment (22 days ago) says Wire has a prototype of ephemeral messages, but insufficient demand, https://news.ycombinator.com/item?id=12014056 https://news.ycombinator.com/item?id=12014056 This Twitter comment (5 days ago) says Wire is looking into self-destructing messages, https://twitter.com/wire/status/755078974728970240 https://twitter.com/wire/status/755078974728970240
prayerslayer 10y ago
Not sure if these are for realsies, but there are some API keys in the webapp repository: https://github.com/wireapp/wire-webapp/blob/master/app/script/location/GeoLocation.coffee#L23 https://github.com/wireapp/wire-webapp/blob/master/app/scrip... https://github.com/wireapp/wire-webapp/blob/master/app/script/tracking/EventTrackingRepository.coffee#L36 https://github.com/wireapp/wire-webapp/blob/master/app/scrip...
- Siimteller 10y ago
  Thanks, nothing critical but we'll clear this up.
mrmondo 10y ago
Sorry if I've missed it somewhere but I'm looking for some independent, transparent reports on its security implementation. I was wondering if anyone could help me with finding this - or if perhaps they haven't been done I guess that would answer my question?
07 10y ago
Hmm, seems interesting.
iamleppert 10y ago
I wish they would have preserved the commit history. Future note to those open sourcing projects: Preserve the commit history! It's very useful! Even if it takes more effort to review the history and remove stuff that you're not allowed to show or whatever.
yetii 10y ago
Android client uses Scala - might be changer for Scala on Android
- premium-concern 10y ago
  Why?

488 points by arunc 10y ago

A link to a GitHub organization isn't great.. I'd say this is better: https://medium.com/@wireapp/you-can-now-build-your-own-wire-client-ea9ed9214e26 https://medium.com/@wireapp/you-can-now-build-your-own-wire-... but even that doesn't clearly explain what Wire is. Visit https://wire.com https://wire.com to find out it's an encrypted video and group chat app.

computator 10y ago
From a Hacker News reader's perspective, the following page seems to be the best explanation of what it does: https://wire.com/privacy/ https://wire.com/privacy/ Also, the Wikipedia entry is a good overview: https://en.wikipedia.org/wiki/Wire_Swiss https://en.wikipedia.org/wiki/Wire_Swiss
toomanythings4 10y ago
There are just so many posts on tech sites to things like this where one wouldn't have a clue what it is or does. You would think the organization pointed to would have some motivation to explain themselves.
walterbell 10y ago
From http://fortune.com/2016/07/22/wire-open-source/ http://fortune.com/2016/07/22/wire-open-source/: ... the move has two main objectives: transparency and building an ecosystem of secure services that can talk to one another ... there is scope for organizations to design Wire-based apps that are tailored to different use cases, such as enterprise communications and digital health, and even automotive and the Internet of things ... "You can register with email and it doesn’t require mobile.” He also pointed out that the apps don’t need to be interoperable, though federation at some point would be nice. “It’s a shame we have so many islands in the communications space,” he added. HN comments from Wire marketing: https://news.ycombinator.com/threads?id=Siimteller https://news.ycombinator.com/threads?id=Siimteller
PhasmaFelis 10y ago
I really hate HN posts that just link to an error page, or a spreadsheet, or a Github repo with no readme, or something else that makes no sense unless you already know whatever you're supposed to be taking from it. Please don't do this, everyone.

nanch 10y ago

See https://wire.com https://wire.com for more information since the linked repos provide no context. "Crystal clear voice, video and group chats. No advertising. Your data, always encrypted."

qznc 10y ago
So, Signal plus video chat?
- stemuk 10y ago
  Probably not, scince Signal doesn't really support secure web communication (without phone routing).
  - woah 10y ago
    What do you mean? Are you objecting to the phone number used as username?
    - nxzero 10y ago
      It's not just a phone number, but also the IMEI. And the objection is that the service makes it (intential) very hard to use it anonymously.
  - lorenzhs 10y ago
    This phone routing story keeps getting repeated here but it's not true and never was. The devices share a key but are completely independent. You can easily try it, put your phone into airplane mode and Signal-Desktop works just the same.
    - nxzero 10y ago
      Issue may not be the routing, but that a mobile device is required to create an account. Are you saying that the Signal Protocol created Open Whisper Systems, which is lead by Moxie Marlinspike, does not require a phone number to work? (Say the Signal Protocol instead of the browser extension since the browser extension uses the protocol to work.)

20andup 10y ago

I wonder what the business model is?

computator 10y ago
They might charge for certain premium services in the future, according to https://en.wikipedia.org/wiki/Wire_Swiss#Business_model https://en.wikipedia.org/wiki/Wire_Swiss#Business_model
- detaro 10y ago
  If I read the TOS correctly, you are also not allowed to write any kind of chat bot against it. If the current hype for bots remains, bot access might be another thing to sell.
  - laksjd 10y ago
    That might be hard to enforce given that the open source client will make creating unofficial bots fairly trivial. Given that they already have Spotify and giphy integration I'm going to predict Skype-like monetization with sponsored integrations (e.g. Skype has those sponsored animated emoji things)
  - deleted 10y ago
    [deleted]

mahyarm 10y ago

Now all this needs is a few good third party audits, verifiable builds and it's the holy grail of encrypted communications!

ianopolous 10y ago
I would say the Holy Grail would be fully decentralized without needing central servers, but this does look cool nonetheless.
- mrbiber 10y ago
  I am very hopeful that Briar (https://briarproject.org/ https://briarproject.org/) will achieve this. They don't use any centralized infrastructure, the app works even when the net is down, and they have e completely distributed and thus uncensorable forums and blogs.
  - ianopolous 10y ago
    Interesting. Do you know how they handle identity/usernames/contact discovery without central servers?
    - mrbiber 10y ago
      As far as I know, the identity is just a public key. You can add contacts only by either scanning a qr-code disayed on your contact's phone in person or by being introduced to each other by a mutual contact, so there is no real need for discovery. As there are no servers at all (not even federated), this also means that no one can even enumerate users. Torsten Grote, one of the projects main developers, explains the technology behind it in this very nice presentation: https://m.youtube.com/watch?v=Dr42vZIoGqM https://m.youtube.com/watch?v=Dr42vZIoGqM
      - andrewaylett 10y ago
        "No servers" doesn't feel quite right -- no dedicated servers, maybe, but the project depends on TOR, which has quite a lot of servers. I've not dug into the source, but I'm expecting each client to be using a TOR hidden service to allow peer-to-peer connections. The ability of TOR to allow essentially roaming services like this is a feature I'm always surprised isn't used more often. And although it's not something I was ever going to actually get around to, something like Briar has been on my list of interesting thins to try to do for a while -- I'm really glad someone else has had a similar thought and been able to run with it :).

stemuk 10y ago

I wonder how they encrypted their chat on the web client. Scince the Signal protocol is kind of the gold standard right now, probably their solution might in the end be the better one.

eps 10y ago
> Since the Signal protocol is kind of the gold standard right now Oy vey. The perils of reading HN too much.
- mintplant 10y ago
  What, in your opinion, is the gold standard?
  - drdaeman 10y ago
    For now, isn't is still plain old boring OTR? No less secure (and because of its mature age, it had received more auditors attention), far more ubiquitous, and while not perfect, still doesn't seem to have too severe limitations that make its use too hard or impossible.
    - moxie 10y ago
      OTR doesn't work in asynchronous environments, which makes it infeasible to deploy on mobile devices. I think that's a pretty severe limitation in today's world. In terms of ubiquity, Signal Protocol is running on over two billion monthly active devices. I would be surprised if OTR's active install base exceeds a hundred thousand.
      - drdaeman 10y ago
        Doesn't it? Not to challenge the authority, but I believe the only requirements OTR impose are constraints on the initial presence (thus, lack of offline operation) and constraints on message ordering. Which doesn't seem too severe to me, if the saying about "always connected" world is true enough in reality. Maybe I'm deeply mistaken here. But, I mean, 99% of my conversations are when both participants are online, and it does work for me in practice (and I can't realistically replace it with Signal) - that's why I've had the opinion that it's still haven't gave up on "gold" yet. As for ubiquity - 2 billion devices is great (and hope there will be more!), but I meant the other sort of it. I've ran OTR sessions over XMPP, ICQ, Skype and Telegram. I guess, it's a wrong sort of ubiquity, probably not something that works for the goal of "encryption for everyone", but it still works if I don't want to hop the services but layer security instead. Maybe that's too old-fashioned. Hope there will be Signal Protocol-based addons/libraries like this one day.

pedalpete 10y ago

I don't get how they can make statements like this "Only Wire offers fully encrypted calls, video and group chats available on all your devices". Webrtc is encrypted by default.

pepesza 10y ago
Because encryption without authentication is prone to MITM attacks. WebTRC does not have auth layer.
- pedalpete 10y ago
  But they don't say anything about authentication, and authentication and encryption are two different things...
saghul 10y ago
WebRTC is only the audio / video part. Chat, groupchat, etc are not using it IIRC. Chat could use the data channel, though.
laksjd 10y ago
The other signal/axolotl protocol based systems currently don't support true multi device solutions. It's not a limitation of the protocol, after all Wire is based on it, too, just that Signal/WhatsApp decided not to implement it. Wire has true multi device support (basically multiple keys per identity)
- moxie 10y ago
  Not sure what you're definition of "true multi device" is, but Signal Desktop does not do phone routing and functions whether your mobile device has connectivity or not: https://whispersystems.org/blog/signal-desktop-public/ https://whispersystems.org/blog/signal-desktop-public/
  - laksjd 10y ago
    Thanks, I thought it did phone routing, mostly because the Signal FAQ lists some odd restrictions on multi device usage (e.g. desktop can't be linked to the iOS app, cannot have iPad and iOS at the same time [1] [1]: http://support.whispersystems.org/hc/en-us/articles/213240927--Can-I-use-multiple-devices-Why-is-my-device-offline- http://support.whispersystems.org/hc/en-us/articles/21324092...

aleken 10y ago

Otto is my new best friend. I cannot see any information about a bot API on their site though...

Siimteller 10y ago
There's no not API available. We've been experimenting with a few internal bots (Otto is the most prominent) but that's the extent of it for now.

jalami 10y ago

Side note, but it's kind of strange that images on their site require cookies enabled to view. I didn't dig into a reason, I just white-list the sites I want to use cookies and found it odd that there were big white spaces before doing so.

Siimteller 10y ago
Weird, we'll check it out. Thanks for pointing it out.

deleted 10y ago

[deleted]

mei0Iesh 10y ago

Thank you! Wire is the best, with multiple device support, clean mobile app, and a desktop client. It'd be nice if it were a standard open protocol so everyone could implement it, and find a way to allow federation. I'd pay to help support.

melle 10y ago

I believe all their good intentions and I do hope they succeed. But for me it's too early to tell whether their business model will hold. If they build up a sufficiently large user base, but fail to monetize it and sell the company to e.g. Microsoft or Facebook, then I doubt how much of their original privacy / openness remains. Another thing that I wonder about: Does being Swiss-based give them a privacy advantage?

laksjd 10y ago
It might be mostly marketing since the Swiss have long switched from a 'swiss banking secrecy' mindset to fairly open cooperation with EU and US investigators. It's probably nevertheless better than being based in the US, just ask Lavabit ;)

grizzles 10y ago

A bold move by Wire. Open source is still a very disruptive play, and the world needs something like this. If they manage this well and triple down on developer engagement, it could work out quite nicely for them. EDIT: Thread title is slightly misleading. It looks like they did a Telegram. There is no server here.

niftich 10y ago
Correct, there's no server. I will avoid blockquoting large amounts of text but on their open source summary page [1], they give you two options: 1. you point your implementation to their server and you have to abide by their additional terms (which is exactly what I'd expect) - or - 2. you point your implementation to somewhere else, unspecified, and you're only bound by GPLv3 Right now, #2 is moot because there is no compatible server you can host. Once someone implements a compatible server, this will get a lot more exciting. [1] https://github.com/wireapp/wire#open-source https://github.com/wireapp/wire#open-source
- ZenoArrow 10y ago
  Does the Wire licence agreement allow you to create a standalone server though? https://github.com/wireapp/wire/blob/master/README.md https://github.com/wireapp/wire/blob/master/README.md "Additionally, if you choose to build an Open Source App, certain restrictions apply, as follows: a. You agree not to change the way the Open Source App connects and interacts with our servers" Even if the company behind Wire seems trustworthy, if I cared about security I wouldn't want any interaction between clients to go through a server I didn't have control over.
  - niftich 10y ago
    If you read it in context, they say: "If you compile the open source software that we make available from time to time to develop your own mobile, desktop or web application, and cause that application to connect to our servers for any purposes, we refer to that resulting application as an 'Open Source App'." Then, they say the part you quoted, so the gist is that if you elect to use their servers, you have to use them the out-of-the-box way. But you're not required to use their servers, if you can somehow procure a compatible one. They're not helping you with that, though.

deltaprotocol 10y ago

I must say that my first impression is beyond positive. One to one and group chats, group video and audio calls, GIF search built-in, doodles, the best implementation of photos in the message stream that I've seen, poking and playable Spotify and Soundcloud music by just sharing links? All with end-to-end encryption? I have that "too good to be true" feeling but, still impressed. Just waiting for possible audits and more feedback from the security community. Edit: It's also Switzerland based, already supports Win10, MacOS, Web, Android and iOS, and to complete has the cleanest design I've seen in a messaging app.

deleted 10y ago
[deleted]
Andrenid 10y ago
I've been using it for a while just with 1 other friend who has it, and it's without a doubt my favourite IM as far as interface/functionality/etc. As usual it's just the matter of getting other people to use it. Everyone I know just uses FB Messenger or Telegram now.
abcd_f 10y ago
Looking them up on zefix.ch shows that they appear to be only registered in Switzerland, with Luxembourg ownership and non-Swiss management. Alan, their CTO and (co-?)founder is Swedish.
- Siimteller 10y ago
  We have a small office in Zug, main dev center in Berlin and a few people here and there around the globe. Alan is originally from Croatia.
unicornporn 10y ago
I've been using it with friends and family for awhile on Android and macOS and it's fantastic, in theory. It has however been plagued with lots of bugs. The calling functionality, which I've used a lot, often stalls at "joining" and then nothing happens. It's not as polished or flawless as Telegram. It does not have a feature to compress video before sending for instance. But I can only expect that to change. Especially now, when anyone can write their own client.

_bojan 10y ago

Didn't see that coming. I think Wire is struggling to get new users and this move could put them on the map.

Siimteller 10y ago
We've actually nicely accelerated user growth this year. Going the OS route was always the plan, especially given the target audience of hacktavists, human rights organizations, journalists. Open source is tablestakes to be taken seriously. It's also just one of the steps towards more transparency.
- zedred 10y ago
  I tried installing it and only had a single contact show up. And it turns out that contact had long since uninstalled the app (said it was very unreliable), but the server was still showing her as registered. From the app store numbers, it looks like Wire is still not even to a million monthly active users. For a funded app with a large full time staff and generous marketing budget, that's a pretty terrible sign several years after launching. I know that the founders are rich, but why would they continue funding an app that isn't showing adoption?
  - walterbell 10y ago
    One privacy advantage of Wire is that it does not force you to upload your address book to their server.
    - zedred 10y ago
      I didn't see that option, but either way the fact remains that even after several years, nobody is using the app. As a business with a large full time staff that needs considerable ongoing capital to continue, the numbers do not bode well for its future. Maybe being open source will change that, but I can't see it being a significant factor for the hundreds of millions of users they need to even begin to catch up. I think they were betting on end to end encryption to save them, but their biggest competitor launched better end to end encryption by default before they could.

saghul 10y ago

Lots of good stuff in there, thanks Wire! I just wish they had gone with something other than GPLv3 for libraries, like LGPL. Looks like they changed them on December, from MPL 2.0 to GPLv3. At any rate, there are lots of us who can use the code with that license :-)

sanjeetsuhag 10y ago

Can anyone explain to me why they use an UpsideDownTableViewController ?

jtreanor 10y ago
This is usually because the default scroll position of a conversation is at the bottom rather than the top so it significantly simplifies scrolling logic (which can get pretty complex). I am surprised they are using a table view rather than a collection view for this though.
philo23 10y ago
From memory, the easiest way to have the "top" of a table view at the bottom of the screen (like in Messages, so the latest message bubble appears at the bottom) is to flip the table view upside down using an affineTransform and then also flip each cell in the table view upside down as well (so the cell is the right way up again). This means you can insert new rows (message bubbles) at index 0 and they'll appear at the bottom, which makes it considerably easiest to add new messages.
- deleted 10y ago
  [deleted]

arthurk 10y ago

Is there a way to download the OSX app without the Mac App Store?

stephenr 10y ago
Why, because a sandboxed app guaranteed to be from the author you think it's from is just too good a thing, and you prefer the heady rush of getting bombarded with MacUpdate spam when you get your apps? Fine, some developers don't want to use the MAS. Their choice. I don't understand users not wanting to use it. It's the simplest possible way to install an app and get automatic updates for those apps.
- saiko-chriskun 10y ago
  I also avoid the MAS when possible.
  - stephenr 10y ago
    That still doesn't answer my question of why.
    - pikachu_is_cool 10y ago
      Because it's horrible UX. I don't want to open a whole other application, search for it on their placeform, and then authenticate with AppleID. Instead you can just download a .dmg or a .zip right from their website, like how it's been done for aeons.
      - stephenr 10y ago
        What searching? The developer links you directly to their app in the store. For free apps you don't necessarily need to enter a password, for paid apps it's still simpler than whatever payment system the developer might be using. With the MAS you can go from viewing the app/developer website to the app being installed in as little as two clicks. How is that worse ux than manually downloading an archive/image, opening the file, moving the .app bundle or running the installer. There are some valid criticisms of the MAS. UX on the install process is not one of them.

deleted 10y ago

[deleted]

laksjd 10y ago

They offer a password reset function. How does that work? Do they hold my private key in escrow? I'd certainly hope not! Or does the password reset work by creating a new keypair? If so, does this at least generate WhatsApp style security warnings for people chatting with me? With some digging I've found a way to verify key fingerprints so that's nice, but it's manual, not QR assisted :(

happyslobro 10y ago

I found a file that is available as either MIT or GPL. Or is it only available under a union of the terms of both licenses? An intersection? Who knows, IANAL. https://github.com/wireapp/wire-webapp/blob/0cf9bf4/aws/main.py https://github.com/wireapp/wire-webapp/blob/0cf9bf4/aws/main... Why do people copy the license all over the place like that?

spicyj 10y ago
That file is GPL but parts of it were adapted from MIT-licensed code (which the MIT license allows). It can be treated as GPL.
belorn 10y ago
MIT has one condition: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. As the code include this, the author who distribute the code can thus prove in court that they are compliant with the wishes of the author/s of the MIT licensed software. The added GPL means that copies of this specific version also adds additional conditions that those distributing this version also need to follow. This mean in practice that they need to follow the GPL license and include the MIT copyright notice as stated above, in order to follow all the different authors wishes. Thankfully, MIT and GPL is compatible, so none of the conditions are contradicting with each other.
- reubano 10y ago
  IANAL but I thought the compatibility was only one way. I.e., you can use MIT code in a GLP project but you can't do the reverse. My understanding is if you use GPL code in an MIT project, you have to make your entire project GPL.
  - belorn 10y ago
    Yes and no :). The MIT authors can not sue someone for not following GPL, and the GPL authors can't sue someone for using the MIT licensed code under MIT. There is one consideration however. One of the GPL license condition says "must license the entire work under GPL", which mean that in order to legally distribute the GPL part, the MIT licensed code will be under both GPL and MIT. As such the patent grant in GPL will cover the whole project for anyone distributing the GPL included version, and many interpret this condition as making the entire project GPL. The exception to that view is that a project can still continue license new code as MIT, and a distributor could simply remove the GPL parts when they want to use it in a MIT and BSD only/Proprietary/Patent enforcing situations. While I have not seen many MIT projects do this in regard to GPL add-ons and patches, it is the standard model for open core MIT projects to do this in regard to proprietary add-ons. I would thus not call the existence of optional GPL patches or add-ons as "make your entire project GPL", unless the additional code is essential to run the program.

jacek 10y ago

I am a user. I switched myself and my family from Skype a few months ago and it has been great so far. Quality of video and audio is great, Android app works very well (better than web based desktop versions). And it also works in a browser, which is great for me (Linux user).

vasili111 10y ago

Where is Windows client source code?

Siimteller 10y ago
It's all on GuyHub. Our windows client is webapp in Electron wrapper so that's what you're looking for.
- Siimteller 10y ago
  Darn autocorrect. That's Github, of course.
lipis 10y ago
We will release the Electron's code as well in the coming weeks :)

maxpert 10y ago

Good to see people using Rust in production :)

redthrow 10y ago

Why does this Android app require a phone number to sign up? At least Hangouts lets me use the app without a phone number.

walterbell 10y ago
You can register with just an email, using a desktop web browser at http://app.wire.com http://app.wire.com, then use that account to login on mobile. Unclear why it's not possible to register a new email-only account from the mobile app.
- vasili111 10y ago
  I hope they will fix this.
- Siimteller 10y ago
  We had this, was confusing UX. Considering bringing it back.

mtgx 10y ago

I've been asking for three things from Signal for the past almost two years: 1) desktop app 2) video call support 3) self-deleting messages Signal finally (sort of) delivered a desktop app, but it still doesn't have the other two. Wire has the first two, but it's still lacking the last one. I hope one of them will have all three of these features soon.

walterbell 10y ago
This HN comment (22 days ago) says Wire has a prototype of ephemeral messages, but insufficient demand, https://news.ycombinator.com/item?id=12014056 https://news.ycombinator.com/item?id=12014056 This Twitter comment (5 days ago) says Wire is looking into self-destructing messages, https://twitter.com/wire/status/755078974728970240 https://twitter.com/wire/status/755078974728970240

prayerslayer 10y ago

Not sure if these are for realsies, but there are some API keys in the webapp repository: https://github.com/wireapp/wire-webapp/blob/master/app/script/location/GeoLocation.coffee#L23 https://github.com/wireapp/wire-webapp/blob/master/app/scrip... https://github.com/wireapp/wire-webapp/blob/master/app/script/tracking/EventTrackingRepository.coffee#L36 https://github.com/wireapp/wire-webapp/blob/master/app/scrip...

Siimteller 10y ago
Thanks, nothing critical but we'll clear this up.

mrmondo 10y ago

Sorry if I've missed it somewhere but I'm looking for some independent, transparent reports on its security implementation. I was wondering if anyone could help me with finding this - or if perhaps they haven't been done I guess that would answer my question?

07 10y ago

Hmm, seems interesting.

iamleppert 10y ago

I wish they would have preserved the commit history. Future note to those open sourcing projects: Preserve the commit history! It's very useful! Even if it takes more effort to review the history and remove stuff that you're not allowed to show or whatever.

yetii 10y ago

Android client uses Scala - might be changer for Scala on Android

premium-concern 10y ago
Why?