22 ms·

Wire is now on F-Droid

282 points by lucgommans 5y ago

vorpalhex 5y ago
Looks promising. Happy to see a diversity in secure messaging solutions and app stores.
- SecurityLagoon 5y ago
  Messengers are one of the few things that I would appreciate less diversity. They are a means to communicate with people and if I can't reach the people I need to communicate with then they are not useful. I would like to see more competition on XMPP and Matrix clients, rather than on yet another closed ecosystem.
crossroadsguy 5y ago
I think it was the original private and polished messaging app in the recent times but Telegram went past it. While Signal is fighting tooth and nails to not be on F-Droid.
aero-glide2 5y ago
Recommend using SkyDroid to download Fdroid apps, much better search and UI.
- smallerfish 5y ago
  Does it auto update? That's my main peeve with fdroid.
  - jasonjayr 5y ago
    I don't think anything other than Google Play can auto update unless you've rooted your phone. F-droid has a package you can install to the system partition to allow auto-updating.
    - boring_twenties 5y ago
      You don't need root AFAIK, you do need an unlocked bootloader so you can flash the system partition though.
      - lucgommans 5y ago
        Exactly, this is only tangentially related to rooting. Google doesn't need root on your device for their closed Play Services to install software, but the component that you want to have this installation capability does need some system-level permission. Many people grant it that by rooting the device, but installing something like /e/OS (=Android with microG and a few other improvements) is also a way to do this.
      - BizarroLand 5y ago
        On my Moto FDroid does a decent job of keeping my apps updated. I still have to intervene about half of the time though.
    - rhamzeh 5y ago
      Android 12 has a mechanism to allow an app that installed an application to update it in the background, but the client needs to be updated to support it. F-Droid hasn't yet, see issue here [1] - some of the other F-Droid clients, like Droid-ify have [2]. [1] https://gitlab.com/fdroid/fdroidclient/-/issues/1836 https://gitlab.com/fdroid/fdroidclient/-/issues/1836 [2] https://github.com/Iamlooker/Droid-ify/pull/159 https://github.com/Iamlooker/Droid-ify/pull/159
  - redsolver 5y ago
    SkyDroid can update apps without user interaction (even on non-rooted devices) using a workaround which requires a one-time ADB setup. You however still need to open SkyDroid and click a button to start the mass-update process, but this is an intentional design decision - it makes sense to check which app updates are available before blindly updating everything.
- daptaq 5y ago
  Foxy Droid (https://github.com/kitsunyan/foxy-droid https://github.com/kitsunyan/foxy-droid) is also a nice re-implementation of the old UI.
  - piaste 5y ago
    I use Aurora Droid, mostly because the same org also provides an anonymous Play Store frontend with similar UX.
  - TuringTest 5y ago
    And there's also Droid-ify, which uses a Material design style (I haven't used it, I've just found it looking for Foxy-droid)
- simlevesque 5y ago
  Thank you for this. I love F-droid but I hate the app.
- lkxijlewlf 5y ago
  https://www.skydroid.net/ https://www.skydroid.net/ ??? Oh!!! https://skydroid.app/ https://skydroid.app/
politelemon 5y ago
This is a great news and an excellent addition to F-Droid. I hope this is a little nudge to Signal to reconsider inclusion. I believe they're mostly there, they already have an APK built as a reproducible build (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/) with FOSS components (https://signal.org/android/apk/ https://signal.org/android/apk/)
- DarylZero 5y ago
  > https://signal.org/android/apk/ https://signal.org/android/apk/ Direct link for those without javascript: https://updates.signal.org/android/Signal-Android-website-prod-universal-release-5.28.10.apk https://updates.signal.org/android/Signal-Android-website-pr...
- daptaq 5y ago
  I think that Molly (https://molly.im/ https://molly.im/) is a good option if you want to manage "Signal" via F-Droid.
  - gowld 5y ago
    Signal has a reputation that Molly lacks. If Signal team doesn't want to post to F-Droid, it would help if they at least made a statement of support or opposition to Molly.
    - dopu 5y ago
      I doubt they would ever endorse the use of a third party interface to Signal.
      - DarylZero 5y ago
        In fact they have publicly whined about it already
  - riedel 5y ago
    Molly does not seem to be included in the official fdroid repo. You can also simply add the calyxos fdroid repo to get signal via fdroid https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fingerprint=C44D58B4547DE5096138CB0B34A1CC99DAB3B4274412ED753FCCBFC11DC1B7B6 https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fing...
pferde 5y ago
Does it still send your password to the central server, as mentioned in Wire's Wikipedia article? I do not see a mention that they changed it.
- lucgommans 5y ago
  I'd rather it keeps a username/password on their central service, than authenticate with my phone number. End to end encryption is achieved through key verification, same as on Signal, Threema, tg secret chats, PGP, etc. Your password is just one barrier to accessing your account and the security of the chats/calls does not depend on this.
  - pferde 5y ago
    Sure, it is just one of the barriers, but it is still a barrier. If their central server gets compromised, every single Wire user has one less barrier protecting them.
vhsdev 5y ago
It's always great to see new software titles land on F-Droid. The rub with messengers is that for each new messenger we've further fragmented our ability to communicate with one another. Rember the telephone? You used to be able to call literally anyone and you didn't have to ask which operator they were using.
- posterboy 5y ago
  Where I'm from, there used to be exactly one opperator.
- TuringTest 5y ago
  Matrix.org should be able to function as the telephone exchange that connects all communication services, as it is well posed to work as a universal connector. If, at some time in the future, it manages to create a usable bridge to connect between two popular private services (say Whatsapp and Telegram, or Teams and Slack) it could start accumulating network effects, and become a desirable target for all other networks so that it is appealing for them to build their own bridges to the Matrix services.
  - kitkat_new 5y ago
    > If, at some time in the future, it manages to create a usable bridge to connect between two popular private services (say Whatsapp and Telegram, or Teams and Slack) it could start accumulating network effects Well, I think usable bridges for such apps are a thing already. See e.g. https://element.io/element-matrix-store https://element.io/element-matrix-store and https://beeper.com https://beeper.com Problems are: - it's a subscription based service - End to end encryption is not active for these services as long as you don't run the bridge yourself (which in principle is possible as well, see e.g. the description at the website of Beeper) which stretches usable a bit... Both problems would likely be solved if these services would provide an API for other messengers and would cooperate on a common standard for E2EE like MLS, however the likelihood for that ... seems pretty small. 1.
- sigg3 5y ago
  This is essentially what signal achieves IMO: it's replacements for sms, mms, audio with added security (plus video and group chat). Using your telephone number as username the experience is transparent and unlike all other messaging apps. I can write texts to whomever and if they do have signal, it defaults to encrypted coms. It's inclusive by design. Other services require usernames and email and whatnot, which effectively ensures it will not be the default. (I understand Apple users cannot change the default messaging app to only use Signal, which is a choice in tune with the walled garden and exclusive by design.)
xanaxagoras 5y ago
I have never heard of wire, I will check it out. Looks interesting on first glance. One thing from the marketing page stood out to me: > Organizations can set up customized alerts, bypassing silent mode on all devices, and trigger responses for crisis teams. Not a knock against Wire, I guess this is just where we are as a society, but I am not a fan of this whatsoever. I would refuse my company access to do this on my personal device. Mail me a pager, I'll turn it on when I'm up.
- 2pEXgD0fZ5cF 5y ago
  This sounds like a feature that spawned from good intentions, but it's obvious in what ways this would get abused once you scale up the amount of Wire users.
- gowld 5y ago
  > Mail me a pager, I'll turn it on when I'm up. What's the point of hiring someone to be on call, if they refuse to be on call?
  - fire 5y ago
    IMO things change quite a bit if you're actually being paid to be on call
  - tasha0663 5y ago
    > What's the point of hiring someone to be on call, if they refuse to be on call? Indeed. I've walked out of interviews over this. The list of things that are actually that critical is incredibly small.
  - xanaxagoras 5y ago
    You quoted me saying I'd be on call ... ?
- lucgommans 5y ago
  > I have never heard of wire, I will check it out. Looks interesting on first glance. It's basically Signal but without the popularity, despite predating it. Why Signal took off and Wire stagnated, I am not sure. The network effect is one part of it, probably caused by Moxie being popular in the community, but another part is that Wire does not seem to care as much about doing cool stuff like private contact discovery that Signal put some real R&D into (and no other service (Threema/Wire/etc.) even bothered to even copy, let alone build upon). Main differences: - Signal is better with metadata - Wire needs no phone number - Wire treats devices equivalently. If you want two phones, that's fine (Signal supports only 1 mobile device and N slave desktop devices; can't have desktop without mobile or more than one mobile) and is mostly feature-complete on each platform (Signal misses e.g. gifs on desktop) - Signal's apps are a bit more polished than Wire's, slightly better UX - Now that Signal has been gaining popularity and Wire, um, not as far as I can tell, Wire seems to be focusing more on corporate use. But it's still possible to register free accounts: https://app.wire.com/auth/?hl=en#createaccount https://app.wire.com/auth/?hl=en#createaccount - I think Wire has a bots system that Signal does not (and is generally more open to integrations), but I could be wrong here
stratosmacker 5y ago
I think Element (https://element.io/ https://element.io/) is worth looking at for anyone who wants something decentralized. Unfortunately I have exactly 1 contact who uses it, but that was true of Signal as well 8 years ago
- quadrangle 5y ago
  For clarity, Element is merely a client (the main one) for Matrix.org. What matters is whether people are on Matrix rather than whether they use the Element client. But most Matrix users surely do use Element.
  - btdmaster 5y ago
    matrix.org is just one instance, it is very important that people choose different instances so that interoperability is kept.
    - feanaro 5y ago
      I think the poster was referring to the protocol instead of the instance.
      - pooper 5y ago
        Maybe this was a case of user error but I know I was not the only person who had difficulty joining Mozilla's riot with their existing riot username when Mozilla first opened their server.
- jokowueu 5y ago
  The usability and UI after all these years are just terrible Spaces was implemented but again the UI is just terrible Other clients are better as an im like fluffy chat tho
  - feanaro 5y ago
    "Just terrible" isn't very constructive criticism. I think it has improved and continues to improve significantly.
deadalus 5y ago
- hartator 5y ago
  Fun that the first opportunity they had to make a difference they choose censorship over openness.
  - npteljes 5y ago
    They are making the difference by providing their excellent service.
- vecplane 5y ago
  Why exactly did they ban Gab?
  - deadalus 5y ago
    F-Droid banned Gab for being a “free speech zone” that will “tolerate all opinions”.[0] Now Gab has been banned from Google Play Store, Apple App Store as well as from F-droid due to negative media pressure. [0]https://f-droid.org/en/2019/07/16/statement.html https://f-droid.org/en/2019/07/16/statement.html
  - dleslie 5y ago
    Here's their statement[0], and this is the meat of it: > F-Droid as a project soon celebrates its 9th birthday. In these 9 years, F-Droid’s mission was and is to create a place where people could download software they can trust – meaning only free, libre and open source software is available on its flagship repository. As a project, it tried to stay neutral all the time. But sometimes, staying neutral isn’t an option but instead will lead to the uprise of previously mentioned oppression and harassment against marginalized groups. We don’t want and won’t support that. F-Droid is taking a political stance here. > F-Droid won’t tolerate oppression or harassment against marginalized groups. Because of this, it won’t package nor distribute apps that promote any of these things. This includes that it won’t distribute an app that promotes the usage of previously mentioned website, by either its branding, its pre-filled instance domain or any other direct promotion. This also means F-Droid won’t allow oppression or harassment to happen at its communication channels, including its forum. In the past week, we failed to fulfill this goal on the forum, and we want to apologize for that. 0: https://f-droid.org/en/2019/07/16/statement.html https://f-droid.org/en/2019/07/16/statement.html
nimbius 5y ago
no one came here for politics, this is HN. real questions for the hackers: how/why does this apk contain nonfree assets in a GPL codebase? https://en.wikipedia.org/wiki/Wire_(software) https://en.wikipedia.org/wiki/Wire_(software) Wire's source code is accompanied by the GPLv3 but the readme file states that a number of additional restrictions specified by the Wire Terms of Use take precedence the legal stipulations here seem to conflict with GPL3.
- commoner 5y ago
  Section 7 of GPLv3 nullifies additional restrictions that are attached to the client (with a few exceptions):[1] > All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. For example, all of the following are "further restrictions" that are voided by Section 7:[2] > a. You agree not to change the way the Open Source App connects and interacts with our servers; b. You agree not to weaken any of the security features of the Open Source App; c. You agree not to use our servers to store data for purposes other than the intended and original functionality of the Open Source App However, these terms are restated in the Wire Terms of Use.[3] Any user who uses the Wire app or a modified derivative of the Wire app to breach these Terms of Use while interacting with the official Wire server instance is still in danger of violating other laws like the Computer Fraud and Abuse Act[4] in the U.S., with respect to how the app interacts with the server. [1] https://github.com/wireapp/wire-webapp/blob/dev/LICENSE https://github.com/wireapp/wire-webapp/blob/dev/LICENSE [2] https://github.com/wireapp/wire-webapp https://github.com/wireapp/wire-webapp [3] https://wire.com/en/legal/terms-of-use-personal/ https://wire.com/en/legal/terms-of-use-personal/ [4] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
wanderingmind 5y ago
https://wire.com/legal/licenses/ https://wire.com/legal/licenses/ gives Error 404, so we have no idea what license they are under and we are supposed to trust and use them.
- karussell 5y ago
  Server is AGPL: https://github.com/wireapp/wire-server/blob/develop/LICENSE https://github.com/wireapp/wire-server/blob/develop/LICENSE and clients are GPL it seems.
- zksmk 5y ago
  Why would you follow that link in particular? You can find all the license information here: https://wire.com/en/legal/terms-of-use-personal/ https://wire.com/en/legal/terms-of-use-personal/ , scroll down and click on license information, there's like a 100 different licenses for the 100 different things they used in the software.
  - wanderingmind 5y ago
    Because that is the link given in their main github repo. I'm not ready to trust someone with my privacy who can't even properly manage their weblinks.
    - wanderingmind 5y ago
      License link provided here: https://github.com/wireapp/wire https://github.com/wireapp/wire
wjd2030 5y ago
I downloaded an app from F-Droid once, it was Spotify. Later that week I started getting strange spanish songs on my recently played. Checked my logged in sessions and there were several from latam. I deleted the app.
- mdp2021 5y ago
  Have you cross checked the signatures?
  - wjd2030 5y ago
    Nope, and it was totally my fault, though at the time I tried to find a way to report the app and I didnt see it (though I could've missed it)
    - mdp2021 5y ago
      > totally my fault Not totally: the big question remains of how a tampered-with package can reach a prominent repository.
- usr1106 5y ago
  Spotify on F-Droid? F-Droid has only open source apps. Is Spotify open source? I have serious doubts about this story. (Not a Spotify user, low-volume F-Droid user)
- marcodiego 5y ago
  I don't think Spotify has ever been on f-droid. Can you post a link?
- lucgommans 5y ago
  I'm fairly sure you must have gotten a fake f-droid store that installs malware instead. I didn't know those were out there. The real one can be found at: https://f-droid.org https://f-droid.org You can also download individual apps (APK files) from the website, so you don't need the store if you don't want updates. Also note how Spotify is not listed if you use their search, because (like others already said) it's not open source and thus not on F-Droid.
walterbell 5y ago
E2EE messenger Wire comes from the people who created Skype and contributed to the royalty-free audio codec Opus (https://opus-codec.org/ https://opus-codec.org/) which now enables WebRTC (used by modern conferencing apps including Zoom, Jitsi, GoToMeeting). They contributed to the IETF encrypted group-messaging protocol MLS (https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/), which will live alongside TLS. IETF MLS is one step on a long path to messenger interoperability, e.g. Matrix plans to implement MLS. Contributors to MLS include Apple, Cisco and Facebook. Wire does not mandate disclosure of phone number or address book contacts. Their free client has been relatively stagnant for a few years as they focused on business customers, but it was so far ahead of others on usability that it's still relatively current.
- thorwawayrus53 5y ago
  Why would facebook contribute? How does it help their business model?
  - gefhfffh 5y ago
    WhatsApp MLS makes encryption more scalable
- emptysongglass 5y ago
  I was an early cheerleader of Wire but it almost sunk my "tech goodwill" among friends because its reliability of notifications on mobile was poor for years. I still don't know if they've fixed it. [1] [1] https://github.com/wireapp/wire-android/issues/777 https://github.com/wireapp/wire-android/issues/777
  - yellow_lead 5y ago
    They must not be using FCM. It's a shame that Google and Apple essentially mandate FCM / APNS to have reliable notifications. Though, I understand the need for battery saving, etc.
    - 5y ago
patchtopic 5y ago
from the wire.com pricing page, it costs $$$ for more than 5 users, I assume that means connecting to their servers. Does that mean if a group of friends used the wire service for IM they have to pay to join a group chat of more than 5 users? It does mention the server can be self hosted - If self hosted is it free from all licencing costs?
newscracker 5y ago
Amidst this positive news, note that Wire does not allow you to export your chat data, if you ever decide it’s not for you. I recall that this was an explicit decision by the company. Its backups are also platform specific. So if you switch from one mobile platform to another (or between desktop platforms or any other combination), you can’t restore your chats from a backup. I still like that Wire doesn’t require a phone number, is multi platform and syncs conversations across all devices. But the above caveats meant that I had to stop using it.
- lewisl9029 5y ago
  Well, that's unfortunate. I gave Wire a try quite a while ago and left because of these exact issues. Was hoping that they might have addressed them by now, but looks like that's not the case. What I really want is an E2E encrypted messaging app that handles message history the way normal people would want and expect, i.e. all past messages on all devices kept forever and never randomly lost, unless manually deleted. Would love suggestions if people know something that fits the bill.
ideamotor 5y ago
Wire is now on many music streaming services ...
- karlzt 5y ago
  Link? What music streaming services?
daypay 5y ago
Session (https://getsession.org/ https://getsession.org/) is also worth looking into. Recently our group moved from Signal to here. Anyone have experience to share here?

282 points by lucgommans 5y ago

vorpalhex 5y ago

Looks promising. Happy to see a diversity in secure messaging solutions and app stores.

SecurityLagoon 5y ago
Messengers are one of the few things that I would appreciate less diversity. They are a means to communicate with people and if I can't reach the people I need to communicate with then they are not useful. I would like to see more competition on XMPP and Matrix clients, rather than on yet another closed ecosystem.

crossroadsguy 5y ago

I think it was the original private and polished messaging app in the recent times but Telegram went past it. While Signal is fighting tooth and nails to not be on F-Droid.

aero-glide2 5y ago

Recommend using SkyDroid to download Fdroid apps, much better search and UI.

smallerfish 5y ago
Does it auto update? That's my main peeve with fdroid.
- jasonjayr 5y ago
  I don't think anything other than Google Play can auto update unless you've rooted your phone. F-droid has a package you can install to the system partition to allow auto-updating.
  - boring_twenties 5y ago
    You don't need root AFAIK, you do need an unlocked bootloader so you can flash the system partition though.
    - lucgommans 5y ago
      Exactly, this is only tangentially related to rooting. Google doesn't need root on your device for their closed Play Services to install software, but the component that you want to have this installation capability does need some system-level permission. Many people grant it that by rooting the device, but installing something like /e/OS (=Android with microG and a few other improvements) is also a way to do this.
    - BizarroLand 5y ago
      On my Moto FDroid does a decent job of keeping my apps updated. I still have to intervene about half of the time though.
  - rhamzeh 5y ago
    Android 12 has a mechanism to allow an app that installed an application to update it in the background, but the client needs to be updated to support it. F-Droid hasn't yet, see issue here [1] - some of the other F-Droid clients, like Droid-ify have [2]. [1] https://gitlab.com/fdroid/fdroidclient/-/issues/1836 https://gitlab.com/fdroid/fdroidclient/-/issues/1836 [2] https://github.com/Iamlooker/Droid-ify/pull/159 https://github.com/Iamlooker/Droid-ify/pull/159
- redsolver 5y ago
  SkyDroid can update apps without user interaction (even on non-rooted devices) using a workaround which requires a one-time ADB setup. You however still need to open SkyDroid and click a button to start the mass-update process, but this is an intentional design decision - it makes sense to check which app updates are available before blindly updating everything.
daptaq 5y ago
Foxy Droid (https://github.com/kitsunyan/foxy-droid https://github.com/kitsunyan/foxy-droid) is also a nice re-implementation of the old UI.
- piaste 5y ago
  I use Aurora Droid, mostly because the same org also provides an anonymous Play Store frontend with similar UX.
- TuringTest 5y ago
  And there's also Droid-ify, which uses a Material design style (I haven't used it, I've just found it looking for Foxy-droid)
simlevesque 5y ago
Thank you for this. I love F-droid but I hate the app.
lkxijlewlf 5y ago
https://www.skydroid.net/ https://www.skydroid.net/ ??? Oh!!! https://skydroid.app/ https://skydroid.app/

politelemon 5y ago

This is a great news and an excellent addition to F-Droid. I hope this is a little nudge to Signal to reconsider inclusion. I believe they're mostly there, they already have an APK built as a reproducible build (https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/) with FOSS components (https://signal.org/android/apk/ https://signal.org/android/apk/)

DarylZero 5y ago
> https://signal.org/android/apk/ https://signal.org/android/apk/ Direct link for those without javascript: https://updates.signal.org/android/Signal-Android-website-prod-universal-release-5.28.10.apk https://updates.signal.org/android/Signal-Android-website-pr...
daptaq 5y ago
I think that Molly (https://molly.im/ https://molly.im/) is a good option if you want to manage "Signal" via F-Droid.
- gowld 5y ago
  Signal has a reputation that Molly lacks. If Signal team doesn't want to post to F-Droid, it would help if they at least made a statement of support or opposition to Molly.
  - dopu 5y ago
    I doubt they would ever endorse the use of a third party interface to Signal.
    - DarylZero 5y ago
      In fact they have publicly whined about it already
- riedel 5y ago
  Molly does not seem to be included in the official fdroid repo. You can also simply add the calyxos fdroid repo to get signal via fdroid https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fingerprint=C44D58B4547DE5096138CB0B34A1CC99DAB3B4274412ED753FCCBFC11DC1B7B6 https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fing...

pferde 5y ago

Does it still send your password to the central server, as mentioned in Wire's Wikipedia article? I do not see a mention that they changed it.

lucgommans 5y ago
I'd rather it keeps a username/password on their central service, than authenticate with my phone number. End to end encryption is achieved through key verification, same as on Signal, Threema, tg secret chats, PGP, etc. Your password is just one barrier to accessing your account and the security of the chats/calls does not depend on this.
- pferde 5y ago
  Sure, it is just one of the barriers, but it is still a barrier. If their central server gets compromised, every single Wire user has one less barrier protecting them.

vhsdev 5y ago

It's always great to see new software titles land on F-Droid. The rub with messengers is that for each new messenger we've further fragmented our ability to communicate with one another. Rember the telephone? You used to be able to call literally anyone and you didn't have to ask which operator they were using.

posterboy 5y ago
Where I'm from, there used to be exactly one opperator.
TuringTest 5y ago
Matrix.org should be able to function as the telephone exchange that connects all communication services, as it is well posed to work as a universal connector. If, at some time in the future, it manages to create a usable bridge to connect between two popular private services (say Whatsapp and Telegram, or Teams and Slack) it could start accumulating network effects, and become a desirable target for all other networks so that it is appealing for them to build their own bridges to the Matrix services.
- kitkat_new 5y ago
  > If, at some time in the future, it manages to create a usable bridge to connect between two popular private services (say Whatsapp and Telegram, or Teams and Slack) it could start accumulating network effects Well, I think usable bridges for such apps are a thing already. See e.g. https://element.io/element-matrix-store https://element.io/element-matrix-store and https://beeper.com https://beeper.com Problems are: - it's a subscription based service - End to end encryption is not active for these services as long as you don't run the bridge yourself (which in principle is possible as well, see e.g. the description at the website of Beeper) which stretches usable a bit... Both problems would likely be solved if these services would provide an API for other messengers and would cooperate on a common standard for E2EE like MLS, however the likelihood for that ... seems pretty small. 1.
sigg3 5y ago
This is essentially what signal achieves IMO: it's replacements for sms, mms, audio with added security (plus video and group chat). Using your telephone number as username the experience is transparent and unlike all other messaging apps. I can write texts to whomever and if they do have signal, it defaults to encrypted coms. It's inclusive by design. Other services require usernames and email and whatnot, which effectively ensures it will not be the default. (I understand Apple users cannot change the default messaging app to only use Signal, which is a choice in tune with the walled garden and exclusive by design.)

xanaxagoras 5y ago

I have never heard of wire, I will check it out. Looks interesting on first glance. One thing from the marketing page stood out to me: > Organizations can set up customized alerts, bypassing silent mode on all devices, and trigger responses for crisis teams. Not a knock against Wire, I guess this is just where we are as a society, but I am not a fan of this whatsoever. I would refuse my company access to do this on my personal device. Mail me a pager, I'll turn it on when I'm up.

2pEXgD0fZ5cF 5y ago
This sounds like a feature that spawned from good intentions, but it's obvious in what ways this would get abused once you scale up the amount of Wire users.
gowld 5y ago
> Mail me a pager, I'll turn it on when I'm up. What's the point of hiring someone to be on call, if they refuse to be on call?
- fire 5y ago
  IMO things change quite a bit if you're actually being paid to be on call
- tasha0663 5y ago
  > What's the point of hiring someone to be on call, if they refuse to be on call? Indeed. I've walked out of interviews over this. The list of things that are actually that critical is incredibly small.
- xanaxagoras 5y ago
  You quoted me saying I'd be on call ... ?
lucgommans 5y ago
> I have never heard of wire, I will check it out. Looks interesting on first glance. It's basically Signal but without the popularity, despite predating it. Why Signal took off and Wire stagnated, I am not sure. The network effect is one part of it, probably caused by Moxie being popular in the community, but another part is that Wire does not seem to care as much about doing cool stuff like private contact discovery that Signal put some real R&D into (and no other service (Threema/Wire/etc.) even bothered to even copy, let alone build upon). Main differences: - Signal is better with metadata - Wire needs no phone number - Wire treats devices equivalently. If you want two phones, that's fine (Signal supports only 1 mobile device and N slave desktop devices; can't have desktop without mobile or more than one mobile) and is mostly feature-complete on each platform (Signal misses e.g. gifs on desktop) - Signal's apps are a bit more polished than Wire's, slightly better UX - Now that Signal has been gaining popularity and Wire, um, not as far as I can tell, Wire seems to be focusing more on corporate use. But it's still possible to register free accounts: https://app.wire.com/auth/?hl=en#createaccount https://app.wire.com/auth/?hl=en#createaccount - I think Wire has a bots system that Signal does not (and is generally more open to integrations), but I could be wrong here

stratosmacker 5y ago

I think Element (https://element.io/ https://element.io/) is worth looking at for anyone who wants something decentralized. Unfortunately I have exactly 1 contact who uses it, but that was true of Signal as well 8 years ago

quadrangle 5y ago
For clarity, Element is merely a client (the main one) for Matrix.org. What matters is whether people are on Matrix rather than whether they use the Element client. But most Matrix users surely do use Element.
- btdmaster 5y ago
  matrix.org is just one instance, it is very important that people choose different instances so that interoperability is kept.
  - feanaro 5y ago
    I think the poster was referring to the protocol instead of the instance.
    - pooper 5y ago
      Maybe this was a case of user error but I know I was not the only person who had difficulty joining Mozilla's riot with their existing riot username when Mozilla first opened their server.
jokowueu 5y ago
The usability and UI after all these years are just terrible Spaces was implemented but again the UI is just terrible Other clients are better as an im like fluffy chat tho
- feanaro 5y ago
  "Just terrible" isn't very constructive criticism. I think it has improved and continues to improve significantly.

deadalus 5y ago

hartator 5y ago
Fun that the first opportunity they had to make a difference they choose censorship over openness.
- npteljes 5y ago
  They are making the difference by providing their excellent service.
vecplane 5y ago
Why exactly did they ban Gab?
- deadalus 5y ago
  F-Droid banned Gab for being a “free speech zone” that will “tolerate all opinions”.[0] Now Gab has been banned from Google Play Store, Apple App Store as well as from F-droid due to negative media pressure. [0]https://f-droid.org/en/2019/07/16/statement.html https://f-droid.org/en/2019/07/16/statement.html
- dleslie 5y ago
  Here's their statement[0], and this is the meat of it: > F-Droid as a project soon celebrates its 9th birthday. In these 9 years, F-Droid’s mission was and is to create a place where people could download software they can trust – meaning only free, libre and open source software is available on its flagship repository. As a project, it tried to stay neutral all the time. But sometimes, staying neutral isn’t an option but instead will lead to the uprise of previously mentioned oppression and harassment against marginalized groups. We don’t want and won’t support that. F-Droid is taking a political stance here. > F-Droid won’t tolerate oppression or harassment against marginalized groups. Because of this, it won’t package nor distribute apps that promote any of these things. This includes that it won’t distribute an app that promotes the usage of previously mentioned website, by either its branding, its pre-filled instance domain or any other direct promotion. This also means F-Droid won’t allow oppression or harassment to happen at its communication channels, including its forum. In the past week, we failed to fulfill this goal on the forum, and we want to apologize for that. 0: https://f-droid.org/en/2019/07/16/statement.html https://f-droid.org/en/2019/07/16/statement.html

nimbius 5y ago

no one came here for politics, this is HN. real questions for the hackers: how/why does this apk contain nonfree assets in a GPL codebase? https://en.wikipedia.org/wiki/Wire_(software) https://en.wikipedia.org/wiki/Wire_(software) Wire's source code is accompanied by the GPLv3 but the readme file states that a number of additional restrictions specified by the Wire Terms of Use take precedence the legal stipulations here seem to conflict with GPL3.

commoner 5y ago
Section 7 of GPLv3 nullifies additional restrictions that are attached to the client (with a few exceptions):[1] > All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying. For example, all of the following are "further restrictions" that are voided by Section 7:[2] > a. You agree not to change the way the Open Source App connects and interacts with our servers; b. You agree not to weaken any of the security features of the Open Source App; c. You agree not to use our servers to store data for purposes other than the intended and original functionality of the Open Source App However, these terms are restated in the Wire Terms of Use.[3] Any user who uses the Wire app or a modified derivative of the Wire app to breach these Terms of Use while interacting with the official Wire server instance is still in danger of violating other laws like the Computer Fraud and Abuse Act[4] in the U.S., with respect to how the app interacts with the server. [1] https://github.com/wireapp/wire-webapp/blob/dev/LICENSE https://github.com/wireapp/wire-webapp/blob/dev/LICENSE [2] https://github.com/wireapp/wire-webapp https://github.com/wireapp/wire-webapp [3] https://wire.com/en/legal/terms-of-use-personal/ https://wire.com/en/legal/terms-of-use-personal/ [4] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

wanderingmind 5y ago

https://wire.com/legal/licenses/ https://wire.com/legal/licenses/ gives Error 404, so we have no idea what license they are under and we are supposed to trust and use them.

karussell 5y ago
Server is AGPL: https://github.com/wireapp/wire-server/blob/develop/LICENSE https://github.com/wireapp/wire-server/blob/develop/LICENSE and clients are GPL it seems.
zksmk 5y ago
Why would you follow that link in particular? You can find all the license information here: https://wire.com/en/legal/terms-of-use-personal/ https://wire.com/en/legal/terms-of-use-personal/ , scroll down and click on license information, there's like a 100 different licenses for the 100 different things they used in the software.
- wanderingmind 5y ago
  Because that is the link given in their main github repo. I'm not ready to trust someone with my privacy who can't even properly manage their weblinks.
  - wanderingmind 5y ago
    License link provided here: https://github.com/wireapp/wire https://github.com/wireapp/wire

wjd2030 5y ago

I downloaded an app from F-Droid once, it was Spotify. Later that week I started getting strange spanish songs on my recently played. Checked my logged in sessions and there were several from latam. I deleted the app.

mdp2021 5y ago
Have you cross checked the signatures?
- wjd2030 5y ago
  Nope, and it was totally my fault, though at the time I tried to find a way to report the app and I didnt see it (though I could've missed it)
  - mdp2021 5y ago
    > totally my fault Not totally: the big question remains of how a tampered-with package can reach a prominent repository.
usr1106 5y ago
Spotify on F-Droid? F-Droid has only open source apps. Is Spotify open source? I have serious doubts about this story. (Not a Spotify user, low-volume F-Droid user)
marcodiego 5y ago
I don't think Spotify has ever been on f-droid. Can you post a link?
lucgommans 5y ago
I'm fairly sure you must have gotten a fake f-droid store that installs malware instead. I didn't know those were out there. The real one can be found at: https://f-droid.org https://f-droid.org You can also download individual apps (APK files) from the website, so you don't need the store if you don't want updates. Also note how Spotify is not listed if you use their search, because (like others already said) it's not open source and thus not on F-Droid.

walterbell 5y ago

E2EE messenger Wire comes from the people who created Skype and contributed to the royalty-free audio codec Opus (https://opus-codec.org/ https://opus-codec.org/) which now enables WebRTC (used by modern conferencing apps including Zoom, Jitsi, GoToMeeting). They contributed to the IETF encrypted group-messaging protocol MLS (https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/), which will live alongside TLS. IETF MLS is one step on a long path to messenger interoperability, e.g. Matrix plans to implement MLS. Contributors to MLS include Apple, Cisco and Facebook. Wire does not mandate disclosure of phone number or address book contacts. Their free client has been relatively stagnant for a few years as they focused on business customers, but it was so far ahead of others on usability that it's still relatively current.

thorwawayrus53 5y ago
Why would facebook contribute? How does it help their business model?
- gefhfffh 5y ago
  WhatsApp MLS makes encryption more scalable
emptysongglass 5y ago
I was an early cheerleader of Wire but it almost sunk my "tech goodwill" among friends because its reliability of notifications on mobile was poor for years. I still don't know if they've fixed it. [1] [1] https://github.com/wireapp/wire-android/issues/777 https://github.com/wireapp/wire-android/issues/777
- yellow_lead 5y ago
  They must not be using FCM. It's a shame that Google and Apple essentially mandate FCM / APNS to have reliable notifications. Though, I understand the need for battery saving, etc.
  - 5y ago

patchtopic 5y ago

from the wire.com pricing page, it costs $$$ for more than 5 users, I assume that means connecting to their servers. Does that mean if a group of friends used the wire service for IM they have to pay to join a group chat of more than 5 users? It does mention the server can be self hosted - If self hosted is it free from all licencing costs?

newscracker 5y ago

Amidst this positive news, note that Wire does not allow you to export your chat data, if you ever decide it’s not for you. I recall that this was an explicit decision by the company. Its backups are also platform specific. So if you switch from one mobile platform to another (or between desktop platforms or any other combination), you can’t restore your chats from a backup. I still like that Wire doesn’t require a phone number, is multi platform and syncs conversations across all devices. But the above caveats meant that I had to stop using it.

lewisl9029 5y ago
Well, that's unfortunate. I gave Wire a try quite a while ago and left because of these exact issues. Was hoping that they might have addressed them by now, but looks like that's not the case. What I really want is an E2E encrypted messaging app that handles message history the way normal people would want and expect, i.e. all past messages on all devices kept forever and never randomly lost, unless manually deleted. Would love suggestions if people know something that fits the bill.

ideamotor 5y ago

Wire is now on many music streaming services ...

karlzt 5y ago
Link? What music streaming services?

daypay 5y ago

Session (https://getsession.org/ https://getsession.org/) is also worth looking into. Recently our group moved from Signal to here. Anyone have experience to share here?