11 ms·

Threema apps are Open Source

157 points by nickexyz 6y ago

nickexyz 6y ago
The link for the acual info, should have posted that: https://threema.ch/en/open-source https://threema.ch/en/open-source
- deleted 6y ago
  [deleted]
- testingFlights 6y ago
  No, the blog post contains additional information about previous reviews. The announcement is the correct link.
DerWOK 6y ago
Link to GitHub repo https://github.com/threema-ch https://github.com/threema-ch
nikivi 6y ago
How can 1,99$ one time payment cover the costs of storing all the messages/media for all users?
- dbrgn 6y ago
  Messages are not stored, only forwarded. This means that very little server infrastructure is required. Additionally, there are offerings for companies (mostly the same app, but with MDM management possibilities) that use subscription based pricing: https://work.threema.ch/ https://work.threema.ch/
- testingFlights 6y ago
  Messages are not stored, they are deleted as soon as they are downloaded from the server. So if you assume that energy cost is low and servers can be used for a long time, it feels like this could pay for lots of sent messages. They host everything themselves, so only the physical space for servers needs to be rented.
- crutee341 6y ago
  They don't store the messages on their servers. All messages are only stored on the end devices of the users. The servers operate only as a message relay and only store the message until the message is delivered.
- _trampeltier 6y ago
  At moment the API is not free to use, sadly
dbrgn 6y ago
Collection of relevant information: - "Open source" technical landing page: https://threema.ch/open-source/ https://threema.ch/open-source/ - GitHub account: https://github.com/threema-ch/ https://github.com/threema-ch/ - Reproducible builds: https://threema.ch/en/open-source/reproducible-builds https://threema.ch/en/open-source/reproducible-builds
- 74d-fe6-2c6 6y ago
  https://github.com/threema-ch/threema-android/blob/997fd7baacf314bb0238cca4912bd4d3d28b6886/app/assets/passwords/bad_passwords.txt#L1515 https://github.com/threema-ch/threema-android/blob/997fd7baa... ;D
- bla3 6y ago
  Great to see they document how to do reproducible builds. I don't know docker well -- are docker images automatically reproducible and open-source as well? If not, do they have documentation on how to reproduce their docker image somewhere as well?
  - dbrgn 6y ago
    The dockerfile is included in the scripts directory. It's mostly just Ubuntu + Android SDK/NDK. https://github.com/threema-ch/threema-android/blob/main/scripts/Dockerfile https://github.com/threema-ch/threema-android/blob/main/scri...
WA 6y ago
Great news, I hope this helps to increase trust in Threema and to get traction. I use Threema with a lot of contacts already (I’m German).
- nix23 6y ago
  >I hope this helps to increase trust in Threema and to get traction. You can thank the Swiss Goverment that THIS will not happen. Because of the two "crypto" scandals.
- nmy 6y ago
  I moved my family group chat to Threema. After the initial pushback, everyone seem to be happy with it now.
tom_mellior 6y ago
Nice. So I guess the business model is now purely about hosting the central servers for everyone? I'm fine with that, I hope it works out for them. I've been a satisfied Threema user for years. The main problem, as with all messenger systems, is network effects. The less optimistic views are that (a) this will destroy their business since people will manage to write self-hosted servers that make Threema's hosting services redundant, or (b) that they know that their business is on the way out, and this is giving back to the community before they fold. I hope that's not the case.
- yreg 6y ago
  Open sourcing the apps doesn't make them free. They will continue to generate income from the app stores.
  - tom_mellior 6y ago
    Open sourcing the apps doesn't make them free in the app stores. But it means that anyone can publish a build for free, no? Either on GitHub or wherever, for people who can install an APK on their device. Or in the app store, as a rival "free Threema clone" or whatever (I guess one would have to be careful about trademark issues).
    - wasmitnetzen 6y ago
      You still need a license to create new accounts on the official servers. So if you want to be in the official network, you have to pay.
      - tom_mellior 6y ago
        If you want to be in the official network, yes. But like I said, open sourcing the client possibly open sources the relevant parts of the protocol that would allow compatible, maybe even federated, self-hostable and free servers.
        6y ago
est31 6y ago
This is a great start! Note though that public git repos doesn't mean they have public issue trackers, or they are taking pull requests. Instead they want you to sign a CLA and then send patches by e-mail (sic). https://threema.ch/en/open-source/contributions/ https://threema.ch/en/open-source/contributions/ Also each new (beta) version will be squashed into an entire commit, instead of commits being atomic. But the license is FLOSS so it technically qualifies as that. As an user of Threema, I wish them good luck.
uselpa 6y ago
Is Forward Secrecy implemented in the latest version? This used to be a main disadvantage compared to Signal, for example.
- throwaway9d0291 6y ago
  Only on the transport layer. See page 10 of their whitepaper [0]. [0]: https://threema.ch/press-files/2_documentation/cryptography_whitepaper.pdf https://threema.ch/press-files/2_documentation/cryptography_...
  - est31 6y ago
    For voice calls it seems to exist though! > The audio stream is encrypted with the SRTP protocol, with DTLS-SRTP being used for the key exchange. The certificates used for the DTLS session are cryptographically linked to the keys used for Threema’s end-to-end encryption by means of including the certificate fingerprints in signaling messages. DTLS version 1.2 is enforced.
    - throwaway9d0291 6y ago
      From the Whitepaper: "Due to the inherently asynchronous nature of mobile messengers, providing reliable Forward Secrecy on the end-to-end layer is difficult. Key negotiation for a new chat session would require the other party to be online before the first message can be sent." That's not a problem for voice calls because voice calls inherently require both participants to be online. Though I am curious why Signal's approach [0] wouldn't work for Threema. [0]: https://www.signal.org/blog/asynchronous-security/ https://www.signal.org/blog/asynchronous-security/
      - dbrgn 6y ago
        Threema predates Signal (and even TextSecure v2). Using plain NaCl boxes also has certain advantages: The crypto is quite simple and you can encrypt a message statelessly for a recipient if you have their public key. With the Signal protocol, if I understand it correctly, you need to pre-generate and exchange a number of keys. With this process, I think you can run out of keys if you encrypt a lot of messages without the other party being online. And you need to exchange those keys before you can even communicate with each other.
harryf 6y ago
Ah Threema. Threema is a perfect example of why successful global startups can't happen in Switzerland today Apologies upfront to anyone at Threema reading this but I have rant a little (PS: I live in Switzerland although I have no connection to Threema)... Threema was launched in 2013 ( https://en.wikipedia.org/wiki/Threema#History https://en.wikipedia.org/wiki/Threema#History ), 4 years after WhatsApp. Threema was always a paid app who's USP was security. After WhatsApp was bought by Facebook in 2014, Threema dominated the paid iOS app listings in the the German speaking world (posted about that before here - https://news.ycombinator.com/item?id=18840587 https://news.ycombinator.com/item?id=18840587 ) showing a significant minority care about their privacy and are willing to pay for it. Given this strong signal from it's user, you'd think Threema would realise there's a huge opportunity to become a leading app in messaging... Sadly not. In fact Threema coasted, allowing Signal to launch an iOS app in 2014 ( https://en.wikipedia.org/wiki/Signal_(software)#History https://en.wikipedia.org/wiki/Signal_(software)#History ) and basically come from "zero" to "the app" for people that care about their privacy. Meanwhile Threema seemed to decide enterprise was the future in 2016 ( https://threema.ch/en/blog/posts/threema-for-organizations-threema-work https://threema.ch/en/blog/posts/threema-for-organizations-t... ) ... perhaps inspired by Slack that had launched in 2013 and already had traction? Seen from a distance, Threema had every opportunity to become a major player in messaging but failed to do so. Why? I'm guessing because the founders lacked the experience or the right people to guide them from startup into massive growth. The market told them they had a product / market fit. The next stage was product / channel fit and them pour in the marketing dollars for real growth, but sadly Switzerland lacks the people with that kind of experience. There are few that even have the experience of growing a company from 10 to 100 employees... In the last 10 years Switzerland has become a great place to launch tech startups, with the ETH and EPFL plus Google and others having engineering offices here. But sadly from there what's lacking is people with the experience growing startups. That needs to change...
- tom_mellior 6y ago
  So what, concretely, should Threema have done?
  - FreshFries 6y ago
oss2020 6y ago
From README.md ( https://github.com/threema-ch/threema-android https://github.com/threema-ch/threema-android ): > This source code repository will be updated for every public non-beta release. There will be one commit per released version. [...] For the time being, we do not accept contributions via GitHub. [...] To report bugs and request new features, please contact the Threema support team through threema.ch/support. Commits are useless (one commit per release), issue tracker on GitHub is disabled, contributions not public, no public discussions. I like Threema and appreciate them open sourcing their apps, but this is not what I call open source development. I really hope they will reconsider this. Both Threema and the community could benefit from this, but dumping the source code here and then isn't going to cut it when the competition is meanwhile doing real open source development. But at least we have reproducible builds now, this is still a great step forward.
- est31 6y ago
  > Commits are useless (one commit per release) FTR Telegram is released in a similar fashion: https://github.com/Telegram-FOSS-Team/Telegram-FOSS https://github.com/Telegram-FOSS-Team/Telegram-FOSS They do have releases more often than Threema though which means the commits are smaller.
sschueller 6y ago
Nice to see documentation to do reproducible builds on Android. Kind of ironic that doing reproducible builds on iOS is insanely hard for that Apple sells itself as being a safe and secure space.
ljlolel 6y ago
One can still use Threema even if compromised using Horcrux Encrypted Messaging: https://horcruxencryptedmessaging.jperla.com/ https://horcruxencryptedmessaging.jperla.com/
simfoo 6y ago
Love Threema, works extremely well and stable and offers a good compromise security-wise with the optional key verification through QR code
olah_1 6y ago
One random thing I love about Threema is their slow release development cycle. It seems like they only do a new release when there is something big, and then all the tiny little changes are bundled with it. It makes the app feel more stable. In comparison, some apps release once or twice per week and the user is left thinking “oh great, what is going to break this time?”
jsl123 6y ago
Anyone got a 'reproducible build'? While building I get this: --- snip ------------------------------------ Task :app:processStore_googleReleaseResources FAILED * What went wrong: Execution failed for task ':app:processStore_googleReleaseResources'. > A failure occurred while executing com.android.build.gradle.internal.tasks.Workers$ActionFacade > AAPT2 aapt2-4.1.1-6503028-linux Daemon #12: Unexpected error during link, attempting to stop daemon. This should not happen under normal circumstances, please file an issue if it does. --- snip ------------------------------------ Does some Android expert know what to do here?
- jsl123 6y ago
  The build process needs to be run on more than one cpu in parallel... On a 4 cpu system the build run through.
  - dbrgn 6y ago
    I suspect it's not about the CPU count, but about RAM. On a constrained system, it's possible that the build cannot complete. A few gigabytes of RAM are required, with 8 GiB it should definitely work. Additionally, if you're on macOS, you need to increase the resource limits in under "Docker Preferences > Resources > Memory".

157 points by nickexyz 6y ago

The link for the acual info, should have posted that: https://threema.ch/en/open-source https://threema.ch/en/open-source

deleted 6y ago
[deleted]
testingFlights 6y ago
No, the blog post contains additional information about previous reviews. The announcement is the correct link.

DerWOK 6y ago

Link to GitHub repo https://github.com/threema-ch https://github.com/threema-ch

nikivi 6y ago

How can 1,99$ one time payment cover the costs of storing all the messages/media for all users?

dbrgn 6y ago
Messages are not stored, only forwarded. This means that very little server infrastructure is required. Additionally, there are offerings for companies (mostly the same app, but with MDM management possibilities) that use subscription based pricing: https://work.threema.ch/ https://work.threema.ch/
testingFlights 6y ago
Messages are not stored, they are deleted as soon as they are downloaded from the server. So if you assume that energy cost is low and servers can be used for a long time, it feels like this could pay for lots of sent messages. They host everything themselves, so only the physical space for servers needs to be rented.
crutee341 6y ago
They don't store the messages on their servers. All messages are only stored on the end devices of the users. The servers operate only as a message relay and only store the message until the message is delivered.
_trampeltier 6y ago
At moment the API is not free to use, sadly

dbrgn 6y ago

Collection of relevant information: - "Open source" technical landing page: https://threema.ch/open-source/ https://threema.ch/open-source/ - GitHub account: https://github.com/threema-ch/ https://github.com/threema-ch/ - Reproducible builds: https://threema.ch/en/open-source/reproducible-builds https://threema.ch/en/open-source/reproducible-builds

74d-fe6-2c6 6y ago
https://github.com/threema-ch/threema-android/blob/997fd7baacf314bb0238cca4912bd4d3d28b6886/app/assets/passwords/bad_passwords.txt#L1515 https://github.com/threema-ch/threema-android/blob/997fd7baa... ;D
bla3 6y ago
Great to see they document how to do reproducible builds. I don't know docker well -- are docker images automatically reproducible and open-source as well? If not, do they have documentation on how to reproduce their docker image somewhere as well?
- dbrgn 6y ago
  The dockerfile is included in the scripts directory. It's mostly just Ubuntu + Android SDK/NDK. https://github.com/threema-ch/threema-android/blob/main/scripts/Dockerfile https://github.com/threema-ch/threema-android/blob/main/scri...

WA 6y ago

Great news, I hope this helps to increase trust in Threema and to get traction. I use Threema with a lot of contacts already (I’m German).

nix23 6y ago
>I hope this helps to increase trust in Threema and to get traction. You can thank the Swiss Goverment that THIS will not happen. Because of the two "crypto" scandals.
nmy 6y ago
I moved my family group chat to Threema. After the initial pushback, everyone seem to be happy with it now.

tom_mellior 6y ago

Nice. So I guess the business model is now purely about hosting the central servers for everyone? I'm fine with that, I hope it works out for them. I've been a satisfied Threema user for years. The main problem, as with all messenger systems, is network effects. The less optimistic views are that (a) this will destroy their business since people will manage to write self-hosted servers that make Threema's hosting services redundant, or (b) that they know that their business is on the way out, and this is giving back to the community before they fold. I hope that's not the case.

yreg 6y ago
Open sourcing the apps doesn't make them free. They will continue to generate income from the app stores.
- tom_mellior 6y ago
  Open sourcing the apps doesn't make them free in the app stores. But it means that anyone can publish a build for free, no? Either on GitHub or wherever, for people who can install an APK on their device. Or in the app store, as a rival "free Threema clone" or whatever (I guess one would have to be careful about trademark issues).
  - wasmitnetzen 6y ago
    You still need a license to create new accounts on the official servers. So if you want to be in the official network, you have to pay.
    - tom_mellior 6y ago
      If you want to be in the official network, yes. But like I said, open sourcing the client possibly open sources the relevant parts of the protocol that would allow compatible, maybe even federated, self-hostable and free servers.
      - 6y ago

est31 6y ago

This is a great start! Note though that public git repos doesn't mean they have public issue trackers, or they are taking pull requests. Instead they want you to sign a CLA and then send patches by e-mail (sic). https://threema.ch/en/open-source/contributions/ https://threema.ch/en/open-source/contributions/ Also each new (beta) version will be squashed into an entire commit, instead of commits being atomic. But the license is FLOSS so it technically qualifies as that. As an user of Threema, I wish them good luck.

uselpa 6y ago

Is Forward Secrecy implemented in the latest version? This used to be a main disadvantage compared to Signal, for example.

throwaway9d0291 6y ago
Only on the transport layer. See page 10 of their whitepaper [0]. [0]: https://threema.ch/press-files/2_documentation/cryptography_whitepaper.pdf https://threema.ch/press-files/2_documentation/cryptography_...
- est31 6y ago
  For voice calls it seems to exist though! > The audio stream is encrypted with the SRTP protocol, with DTLS-SRTP being used for the key exchange. The certificates used for the DTLS session are cryptographically linked to the keys used for Threema’s end-to-end encryption by means of including the certificate fingerprints in signaling messages. DTLS version 1.2 is enforced.
  - throwaway9d0291 6y ago
    From the Whitepaper: "Due to the inherently asynchronous nature of mobile messengers, providing reliable Forward Secrecy on the end-to-end layer is difficult. Key negotiation for a new chat session would require the other party to be online before the first message can be sent." That's not a problem for voice calls because voice calls inherently require both participants to be online. Though I am curious why Signal's approach [0] wouldn't work for Threema. [0]: https://www.signal.org/blog/asynchronous-security/ https://www.signal.org/blog/asynchronous-security/
    - dbrgn 6y ago
      Threema predates Signal (and even TextSecure v2). Using plain NaCl boxes also has certain advantages: The crypto is quite simple and you can encrypt a message statelessly for a recipient if you have their public key. With the Signal protocol, if I understand it correctly, you need to pre-generate and exchange a number of keys. With this process, I think you can run out of keys if you encrypt a lot of messages without the other party being online. And you need to exchange those keys before you can even communicate with each other.

harryf 6y ago

Ah Threema. Threema is a perfect example of why successful global startups can't happen in Switzerland today Apologies upfront to anyone at Threema reading this but I have rant a little (PS: I live in Switzerland although I have no connection to Threema)... Threema was launched in 2013 ( https://en.wikipedia.org/wiki/Threema#History https://en.wikipedia.org/wiki/Threema#History ), 4 years after WhatsApp. Threema was always a paid app who's USP was security. After WhatsApp was bought by Facebook in 2014, Threema dominated the paid iOS app listings in the the German speaking world (posted about that before here - https://news.ycombinator.com/item?id=18840587 https://news.ycombinator.com/item?id=18840587 ) showing a significant minority care about their privacy and are willing to pay for it. Given this strong signal from it's user, you'd think Threema would realise there's a huge opportunity to become a leading app in messaging... Sadly not. In fact Threema coasted, allowing Signal to launch an iOS app in 2014 ( https://en.wikipedia.org/wiki/Signal_(software)#History https://en.wikipedia.org/wiki/Signal_(software)#History ) and basically come from "zero" to "the app" for people that care about their privacy. Meanwhile Threema seemed to decide enterprise was the future in 2016 ( https://threema.ch/en/blog/posts/threema-for-organizations-threema-work https://threema.ch/en/blog/posts/threema-for-organizations-t... ) ... perhaps inspired by Slack that had launched in 2013 and already had traction? Seen from a distance, Threema had every opportunity to become a major player in messaging but failed to do so. Why? I'm guessing because the founders lacked the experience or the right people to guide them from startup into massive growth. The market told them they had a product / market fit. The next stage was product / channel fit and them pour in the marketing dollars for real growth, but sadly Switzerland lacks the people with that kind of experience. There are few that even have the experience of growing a company from 10 to 100 employees... In the last 10 years Switzerland has become a great place to launch tech startups, with the ETH and EPFL plus Google and others having engineering offices here. But sadly from there what's lacking is people with the experience growing startups. That needs to change...

tom_mellior 6y ago
So what, concretely, should Threema have done?
- FreshFries 6y ago

oss2020 6y ago

From README.md ( https://github.com/threema-ch/threema-android https://github.com/threema-ch/threema-android ): > This source code repository will be updated for every public non-beta release. There will be one commit per released version. [...] For the time being, we do not accept contributions via GitHub. [...] To report bugs and request new features, please contact the Threema support team through threema.ch/support. Commits are useless (one commit per release), issue tracker on GitHub is disabled, contributions not public, no public discussions. I like Threema and appreciate them open sourcing their apps, but this is not what I call open source development. I really hope they will reconsider this. Both Threema and the community could benefit from this, but dumping the source code here and then isn't going to cut it when the competition is meanwhile doing real open source development. But at least we have reproducible builds now, this is still a great step forward.

est31 6y ago
> Commits are useless (one commit per release) FTR Telegram is released in a similar fashion: https://github.com/Telegram-FOSS-Team/Telegram-FOSS https://github.com/Telegram-FOSS-Team/Telegram-FOSS They do have releases more often than Threema though which means the commits are smaller.

sschueller 6y ago

Nice to see documentation to do reproducible builds on Android. Kind of ironic that doing reproducible builds on iOS is insanely hard for that Apple sells itself as being a safe and secure space.

ljlolel 6y ago

One can still use Threema even if compromised using Horcrux Encrypted Messaging: https://horcruxencryptedmessaging.jperla.com/ https://horcruxencryptedmessaging.jperla.com/

simfoo 6y ago

Love Threema, works extremely well and stable and offers a good compromise security-wise with the optional key verification through QR code

olah_1 6y ago

One random thing I love about Threema is their slow release development cycle. It seems like they only do a new release when there is something big, and then all the tiny little changes are bundled with it. It makes the app feel more stable. In comparison, some apps release once or twice per week and the user is left thinking “oh great, what is going to break this time?”

jsl123 6y ago

Anyone got a 'reproducible build'? While building I get this: --- snip ------------------------------------ Task :app:processStore_googleReleaseResources FAILED * What went wrong: Execution failed for task ':app:processStore_googleReleaseResources'. > A failure occurred while executing com.android.build.gradle.internal.tasks.Workers$ActionFacade > AAPT2 aapt2-4.1.1-6503028-linux Daemon #12: Unexpected error during link, attempting to stop daemon. This should not happen under normal circumstances, please file an issue if it does. --- snip ------------------------------------ Does some Android expert know what to do here?

jsl123 6y ago
The build process needs to be run on more than one cpu in parallel... On a 4 cpu system the build run through.
- dbrgn 6y ago
  I suspect it's not about the CPU count, but about RAM. On a constrained system, it's possible that the build cannot complete. A few gigabytes of RAM are required, with 8 GiB it should definitely work. Additionally, if you're on macOS, you need to increase the resource limits in under "Docker Preferences > Resources > Memory".