5 ms·
As someone formerly working for one of the largest WhatsApp messaging API providers, this whole controversy is really unfortunate. The problem boils down to the
by 9dev 6y ago
As someone formerly working for one of the largest WhatsApp messaging API providers, this whole controversy is really unfortunate.
The problem boils down to the way the business API works: as WhatsApp is using e2e messaging, they could not simply offer a standard HTTP API for customers to use. In that case, WhatsApp would have to read messages received via such an API, and user responses to send webhooks.
To solve this problem, they provided a Docker stack that would essentially spin up a specialised WhatsApp Client on the customer’s infrastructure - so you’d be running the API locally, send and receive messages in your own network, and the client would handle encryption before transmitting to the WhatsApp servers. All containers would connect to a local SQL database to store their data, and included a REST API (curiously written in PHP).
To handle high load, you had to spin up more images in distinct patterns and configure sharding per stack.
This was a nice, albeit highly technical solution to the problem. As WhatsApp partners we built lots and lots of additional infrastructure to manage 12000 individual Docker-Compose stacks in a distributed, reliable way. That worked surprisingly well, but obviously is way too complex.
So in the end WhatsApp concluded it would be easier to take care of the container hosting themselves, shoving them into AWS, integrated with the Facebook business manager.
And all this lead to a necessary change in the terms of service, as WhatsApp hosting containers in AWS opened the possibility of e2e no longer being given.
- mpol 6y agoThese are all technical and business considerations that make clear that the change in terms of service are not bad. I don't think the controvery is about the change in terms, but more about what is and was already happening. If WhatsApp is doing things that are just on the border of legal, or let's say unpleasant for a lot of people, every time the terms of service get updated, people will be confronted with them. That is a risk, looking at what WhatsApp is doing. If I were CEO of WhatsApp I would want to be as quiet as possible about what kind of things that are happening outside of view. Every change to these terms of service, every time you point them out, you run the risk of people complaining about all the unpleasant things that are happening.
- intricatedetail 6y agoWhy hosting a docker container is complex? It seems like they set themselves for failure to have an excuse to break e2e.
- rakoo 6y agoIt's not really unfortunate, it's the consequence of having e2e encryption: either you (as a business) have to handle everything or you deletage, and that delegation needs to be clear to the user. Were businesses not ready to run the client themselves ?
- 9dev 6y agoWith unfortunate, I intended to refer to the way the situation was picked up by the general public: The change to the ToS necessary was only intended to make it easier for businesses to get started with the WhatsApp Business API, not a sneaky way to read user's messages. The delegation is still in place in terms of encryption: Everything the client sends or receives is encrypted or decrypted using a client-local private key, even if the client is running on AWS servers, rented by WhatsApp. In theory, noone but the business itself has access to the data the client processes, plus it's an optional service: You're still free to host the client yourself. It's just easy to mess up. Take a look at the documentation for a recommended production setup if you'd like to get a peek: https://developers.facebook.com/docs/whatsapp/installation/prod-multiconnect https://developers.facebook.com/docs/whatsapp/installation/p...