8 ms·
Wire messenger server code open-sourced
- larrysalibra 10y agoThis is really great to see. Kudos to the Wire messenger team for taking this step.
- otoburb 10y agoHow will Wire make money and stay viable while maintaining this level of service?
- simplehuman 10y agoOpen source is a development model and not a business model.
- posguy 10y agoExactly, the userbase and network effects are a potential profit source, the software is merely a means to an end.
- giancarlostoro 10y agoAlso mind the license. It means anyone competing with Wire has to comply with the AGPL which is specific to servers. If you modify the code, you must publish it, whilst Wire can retain their own modifications to the server.
- seagreen 10y agoWeirdly I think free licenses are great for businesses to use and open licenses are great for personal projects. If I'm writing a hobby project, I want it to help the ecosystem as much as possible. If businesses want to use it then great! So MIT. If I'm running a business my main goal is to survive. I want to help the community as well, but I obviously can't do that if I go broke. "Put on your own oxygen mask before helping others" and all that. So *GPL, because it lets me balance those goals.
- giancarlostoro 10y agoI'm not arguing against it or anything just pointing it out. AGPL keeps the lights on whilst still letting others play with it and contribute.
- seagreen 10y agoI understood you! I just wanted to add a few reasons why I (generally an open > libre guy) don't mind the AGPL in this case.
- giancarlostoro 10y agoUnderstood, I only worry about AGPL if I'm working on a similar product for commercial work I would absolutely avoid looking at the code. Some licenses are fine for some companies, others are a nightmare. Apparently D had that issue for example.
- milesrout 10y agoThis is really bad abuse of terminology. Non-copyleft and copyleft licenses are all both open source and free software licenses. They're all free and open, which are synonyms in the context of software licensing. I think you'll confuse people if you use the terminology as you are using it (plus it's just plain wrong). Personally, if I'm writing a hobby project then I want it to be copyleft. Of course I want it to be copyleft. Why wouldn't I? I don't want some company taking my work, making proprietary changes and improvements to it and then not releasing those back to me. Copyleft is simple courtesy that you'd expect anyway, codified into a license.
- seagreen 10y agoI should have written libre not free. That has a clear meaning (and it's what I use in the followup comment). Do you have a better suggestion than "open" for "no restrictions on use"? > Personally, if I'm writing a hobby project then I want it to be copyleft. Totally up to you! In the context of Haskell projects though, I really, really want to see Haskell businesses succeed as well as the open Haskell ecosystem.
- milesrout 10y agoThat's not accurate at all. If you contribute back changes to it then they have to comply with the license too and publish the source.
- giancarlostoro 10y agoThe entire purpose of the AGPL is that users of the server are now users of your program, so having access to the code is their right. IANAL but this is how I've always understood the AGPL to work. See: https://tldrlegal.com/license/gnu-affero-general-public-license-v3-(agpl-3.0) https://tldrlegal.com/license/gnu-affero-general-public-lice... Edit: See also their own FAQ: http://www.affero.org/oagf.html#How_does_the_Affero_Public_License http://www.affero.org/oagf.html#How_does_the_Affero_Public_L...
- milesrout 10y agoThat's my point. The GPL goes both ways. Wire release under the AGPL, sure. That means if you want to use it on your server you have to release the source code of any modifications. Of course you do. But they do too. It's open source, they accept contributions. Those contributions are copyright the contributors and licensed AGPL.
- detaro 10y agoAt least for contributions you directly submit to their project, they require you to sign a CLA. If I'm reading it right it allows them to use your changes in a private fork as well, as long as they are also included in the public version. https://cla-assistant.io/wireapp/wire-server https://cla-assistant.io/wireapp/wire-server
- deleted 10y ago[deleted]
- milesrout 10y agoThat's a blatant GPL violation. "No additional restrictions"...
- graffitici 10y agoThis is fantastic news. If I understand things correctly, we can now host the Wire server on our own VM, and use the clients to connect to it, correct? We'll have full control over the end-to-end encrypted network?
- fullsage 10y agoNo most of the source is still missing.
- y0ghur7_xxx 10y agothere is something i never understood, maybe someone can help me: what makes wire better than xmpp? why do we need yet another protocol for chat?
- 0x6c6f6c 10y agoAs a service, what it's provided is consistency for the group of friends I use it with. We've tried XMPP and Matrix on multiple accounts and had trouble on the server and client side. Wire is out of the box a great option with open source ideologies and some feature we liked that weren't available with XMPP or Riot. They could have done the same thing with existing protocols, but I do like the way it was done and how well it works for us, and as a consumer of the service it's satisfied areas where XMPP/Matrix felt.. fragile. Not that XMPP or Matrix are vastly inferior, there's certainly an issue or two we've had with Wire, but just how well it worked for us immediately was largely why we've stuck to it.
- Arathorn 10y agoIt would be great if you could detail what issues you encountered with Matrix (and/or file some bugs to help things improve). Unlike XMPP, Matrix is still considered in beta which gives us a lot of flexibility in addressing shortcomings :)
- 0x6c6f6c 10y agoIssues I encountered were already reported on their GitHub pages if I recall correctly. I normally make a point to document and report these issues, if I can't submit a PR myself ;)
- feld 10y agoXMPP is terribly fragmented and the clients all suck.
- unicornporn 10y agoI just tried https://conversations.im/ https://conversations.im/ and I must I'm very impressed.
- samaydedon 10y agoTupac mourned, Baez urges activism at Hall of Fame http://georgia.247sports.com/Board/101621/Contents/FOXTV-UFC-210-Live-Stream-in-8th-2017-for-free-52213027 http://georgia.247sports.com/Board/101621/Contents/FOXTV-UFC...
- infodroid 10y agoIt's great to see more Haskell code being used in production.
- mbrubeck 10y agoAnd a little bit of Rust, too! https://github.com/wireapp/wire-server/tree/master/libs/libzauth/libzauth https://github.com/wireapp/wire-server/tree/master/libs/libz...
- Siimteller 10y agoIf you're into rust then their crypto is all in Rust https://github.com/wireapp/proteus https://github.com/wireapp/proteus
- raindev 10y agoI'm supper happy about Wire taking this step. Has someone done a security analysis/review of Wire yet? It would be interesting to read.
- walterbell 10y agohttps://medium.com/@wireapp/wires-independent-security-review-61f37a1762a8 https://medium.com/@wireapp/wires-independent-security-revie...
- zedred 10y agoProbably worth mentioning this is a paid report for one library they use, not the Wire app.
- Siimteller 10y agoThe post states that the app level review is coming. As a comparison afaik Signal only has protocol review available, no implementation review. Edit: typo
- giancarlostoro 10y agoI'm wondering if the clients will allow you to select any server or if you have to rebuild the apps just to do that. Never used Wired, but I am very interested.
- Siimteller 10y agoOne of the details we haven't quite settled on yet. Safe to assume that once all of the server code is open then at first you'd need to roll your own apps pointing to the right server. Since a lot of the interest for self hosting comes from companies then a nicely packaged version is somewhere in the future.
- Propen 10y agoHoping more and more people start to show their support for services such as this one by joining and bringing friends. They are running circles around Signal lately.
- zedred 10y agoI was hopeful at first. A large VC funded company with a big full time team should run circles around a small open source effort, but their security is still way behind Signal. I was also quickly put off by their "less than honest" marketing.
- walterbell 10y agoCould you share details on "security is still way behind Signal"? Edit: found previous discussion, https://news.ycombinator.com/item?id=13132157 https://news.ycombinator.com/item?id=13132157
- zedred 10y agoI haven't directly explored the source for either in little while, so I should take a new look. I might be a little out of date, but the things that I have seen second hand recently confirmed my earlier conclusions. Like I recently saw an announcement from Wire that calls are now secure, but they had been advertising them as secure all along! I had even spent time looking through the code but didn't know that calls weren't authenticated. Now are they really secure? I don't know, they said that before too, and the source is so hard to follow. Then I saw a post that showed they weren't even doing cert pinning, which is so basic. I wanted to like it, but the more I looked the more I felt like "security" was just sprinkled on as an after thought.
- walterbell 10y agoDid you see that they implemented CBR for audio calls and submitted patches to both Signal and WebRTC? https://medium.com/@wireapp/call-security-constant-bit-rate-encoding-and-improving-webrtc-a85be6caa43a https://medium.com/@wireapp/call-security-constant-bit-rate-...
- fullsage 10y agoThe title for this post should be changed to "a piece of the wire messenger server code open sourced." Most of the source is not open source, you can't run your own. Also, holy shit they're storing a lot of information about their users: * All of your contacts. * Unencrypted profile information for everyone. * Every active conversation you have. * Every archived conversation you have. * The frequency that you communicate with your contacts ('top contacts'). * Every group that you're in. * The unencrypted titles and avatars of everyone's groups. Wonder what will be in the rest of the database schema if they open source it.
- true_religion 10y agoSounds like the amount of information a typical web forum stores about its users private messages. I am not saying if this is good or bad in general, but just... I could live with it in 2005 when Vbulletin was all the rage, and I can live with it now. Also, other chat clients like Skype, Paltalk, Yahoo Messenger, Facebook Messenger also store this information---its kind of a requirement to do any kind of search over previous messages, and allow people to find their contacts or talk to random unacquainted individuals. Maybe this is a big negative for Wire if their PR basically touts "security" and "encryption", when the reality is they want to be secure against middlemen only.
- gpm 10y agoSo I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one. * All of your contacts. Wire contacts, they only store non-wire contacts in a hashed form, and there's an opt out for non-wire contacts. * Unencrypted profile (Isn't this just profile picture (which is shown to people you haven't connected with), and name anyways?) They do say so in the privacy policy. * Every active conversation you have. Specifically they claim to store: Who/when it was created, who is involved (which seems critical to be able to route messages), and conversation name * Every archived conversation you have. I assume they store the same as for non-archived conversations, seems necessary to be able to add new devices. * The frequency that you communicate with your contacts ('top contacts'). Ya... that's not listed as far as I can tell. Arguably "aggregated usage statistics"... but it's not really aggregated. * Every group that you're in. This is the same as conversations... they clearly need to know this to route messages. * The unencrypted titles and avatars of everyone's groups. Titles is listed. Avatars of groups isn't... seems like a minor oversight though given that they're like a profile picture, and profile pictures are publicly available. [0] https://wire.com/resource/Wire%20Privacy%20Whitepaper/download/ https://wire.com/resource/Wire%20Privacy%20Whitepaper/downlo...
- cageface 10y agoGreat to see an example of practical, real-world Haskell out in the wild. It's surprisingly readable. I'm more motivated to finally knuckle down and learn the language.
- lngnmn 10y agoShit. I have never believed that someone would really build and run a Haskell-based back-end in production. Respect and kudos. Classy as fuck.