4 ms·

It is. I hope they don't do the same thing with their code for whatever they're making.

by ktta 9y ago

rootw0rm 9y ago
No it's not, the source is on Github. Windows client looks like it uses openssl, Android client looks like it uses boringssl. I didn't actually clone the repos and and take a proper look tho.
jstanley 9y ago
What do you mean by "it is"? The Telegram client is open source.
- steve19 9y ago
  The telegram server is not.
- SXX 9y ago
  In this case "private" have nothing to do with the code license. Problem with Telegram is that protocol and cryptography they use is their own. They might use better reviewed protocol like one of Signal, but they didn't. No need to explain what dangers same strategy going to cause with cryptocurrencies.
  - unicornporn 9y ago
    Was the Signal protocol reviewed in 2013 when Telegram was launched? It seems it was developed in 2013. I'd say the biggest problem with Telegram is the fact that E2EE isn't enabled by default and no one (that I've chatted with) uses it.
    - def_true_false 9y ago
      The official desktop client doesn't even support it, after years of people asking for it. Telegram is basically equivalent to Hangouts or any other random chat app, if you care about security.
      - unicornporn 9y ago
        Yup, terrible. The native macOS desktop client (available in App Store) actually supports it. At least it did when I tried it.
    - dfox 9y ago
      People will tell you, that there is big gaping crypto vulnerability in Telegrams client-server crypto because it is not secure under CCA. In fact this is only certificational weakness (ie. attacker can replace message with different ciphertext that encodes exactly same message). The crypto is somewhat weird, but it is clear that motivation for the weirdness is getting small ciphertexts.
- ktta 9y ago
  Client doesn't mean everything. In applications like these, there shouldn't be even a single binary blob without code for it. To their credit, they said they will, but this[1] has been on their website since a very long time. [1]:https://telegram.org/faq#q-why-not-open-source-everything https://telegram.org/faq#q-why-not-open-source-everything

It is. I hope they don't do the same thing with their code for whatever they're making.

by ktta 9y ago

It is. I hope they don't do the same thing with their code for whatever they're making.

No it's not, the source is on Github. Windows client looks like it uses openssl, Android client looks like it uses boringssl. I didn't actually clone the repos and and take a proper look tho.

jstanley 9y ago

What do you mean by "it is"? The Telegram client is open source.

steve19 9y ago
The telegram server is not.
SXX 9y ago
In this case "private" have nothing to do with the code license. Problem with Telegram is that protocol and cryptography they use is their own. They might use better reviewed protocol like one of Signal, but they didn't. No need to explain what dangers same strategy going to cause with cryptocurrencies.
- unicornporn 9y ago
  Was the Signal protocol reviewed in 2013 when Telegram was launched? It seems it was developed in 2013. I'd say the biggest problem with Telegram is the fact that E2EE isn't enabled by default and no one (that I've chatted with) uses it.
  - def_true_false 9y ago
    The official desktop client doesn't even support it, after years of people asking for it. Telegram is basically equivalent to Hangouts or any other random chat app, if you care about security.
    - unicornporn 9y ago
      Yup, terrible. The native macOS desktop client (available in App Store) actually supports it. At least it did when I tried it.
  - dfox 9y ago
    People will tell you, that there is big gaping crypto vulnerability in Telegrams client-server crypto because it is not secure under CCA. In fact this is only certificational weakness (ie. attacker can replace message with different ciphertext that encodes exactly same message). The crypto is somewhat weird, but it is clear that motivation for the weirdness is getting small ciphertexts.
ktta 9y ago
Client doesn't mean everything. In applications like these, there shouldn't be even a single binary blob without code for it. To their credit, they said they will, but this[1] has been on their website since a very long time. [1]:https://telegram.org/faq#q-why-not-open-source-everything https://telegram.org/faq#q-why-not-open-source-everything