11 ms·

Telegram Bot Platform

261 points by thiagoperes 11y ago

DLion 11y ago
I made a simple bot plugins based in Node.js. https://github.com/dlion/smagenBot https://github.com/dlion/smagenBot
hobarrera 11y ago
All the comments on this news item made me really want to try this out and see how it works. I downloaded and installed the desktop version. Created an account with my phone number (okay: if I ever lose my phone, I'll permanently lose access to my account!). I see how to add contacts. I need their phone number. I don't know my friend's numbers. We use facebook, xmpp, email, lots of shit, but nobody still relies on SMS nowadays, and my phonebook is literally under 10 entries long (and I'm sure mum and dad won't be using Telegram). This reliance on old networks really kills it for me. IMHO, linking an account to a device that can get stolen or lost is also something I'll never really understand.
avens19 11y ago
This is great, nice work guys
harryf 11y ago
Bananas or oranges anyone? http://telegram.me/PollBot?startgroup=c4dd5512c96b2952a17396273a72e18f http://telegram.me/PollBot?startgroup=c4dd5512c96b2952a17396...
- ddon 11y ago
  Not found There is no Telegram account with the username you provided.
gioi 11y ago
Just yesterday I was trying to get a bot working on the TextSecure platform. A vastly disappointing experience: almost not existing libraries, sparse and incomplete documentation, unstable protocol breaking without any kind of notice (https://github.com/JavaJens/TextSecure/issues/6 https://github.com/JavaJens/TextSecure/issues/6, for example). And still no way to register without a phone, which would be amazing for this kind of project: https://github.com/WhisperSystems/TextSecure/issues/1085 https://github.com/WhisperSystems/TextSecure/issues/1085 I think Telegram is succeeding in what TextSecure is failing: attracting a widespread community of developers. This is only a confirmation, in my opinion. EDIT: and, by the way, while Telegram security is no good, I wonder why we cannot have both (security & developer-friendliness)
- _jomo 11y ago
  I'm using Cyanogenmod and I wanted to try TextSecure. There is a version for SMS pre-installed, but I'm not a fan of paying money for 128 bytes of data. I don't have any Google Services installed. So I tried finding it on F-Droid, but it wasn't there. I found out there has been a lot of discussion about this. [0][1] I decided to compile it on my own. That requires to use use Google Libraries, oh well. I managed to get that done and was disappointed when I tried to use it. It also requires to have Google Services installed on your phone for push notifications. I don't have that. I tried finding a solution, and other people complained about this and there was the idea to use websockets instead of google push notifications [3]. Someone forked TextSecure and started working on it [4]. Unfortunately that fork isn't stable yet, and it doesn't communicate with 'producion' users of TextSecure [5]. This is where I gave up. It shouldn't be so hard to install a free app on a free system. Also, the websocket fork is somewhat dead [6]. 0: https://f-droid.org/posts/security-notice-textsecure/ https://f-droid.org/posts/security-notice-textsecure/ 1: https://github.com/WhisperSystems/TextSecure/issues/127 https://github.com/WhisperSystems/TextSecure/issues/127 3: https://github.com/WhisperSystems/TextSecure/issues/1000 https://github.com/WhisperSystems/TextSecure/issues/1000 4: https://github.com/JavaJens/TextSecure https://github.com/JavaJens/TextSecure 5: https://github.com/JavaJens/TextSecure/issues/10 https://github.com/JavaJens/TextSecure/issues/10 6: https://github.com/JavaJens/TextSecure/issues/15 https://github.com/JavaJens/TextSecure/issues/15
  - iamthebest 11y ago
    I had the same experience. I am using CyanogenMod as well and as much as I dislike Google I did install the Play services. I can't even remember why but I think I needed it to use the google voice app. Anyway, google play apparently tried to auto-update and bricked itself; now it just says "no connection" when I launch the play store. Last week I tried to install TestSecure but it would not run. It just gave an error message about needing to update play services. I ended up installing the Telegram app in F-Droid.
    - Nullabillity 11y ago
      I've had Play Services brick itself a few times, but uninstalling all updates tends to fix it.
yagop 11y ago
I've beeing developing this https://github.com/yagop/telegram-bot https://github.com/yagop/telegram-bot for a year. Currently most Telegram Bots uses my proyect for building bots. Now it's deprecated and I'm really sad about that.
- sebastianavina 11y ago
  thank you for the effort.
- sajid 11y ago
  I'm really sorry about that. telegram-bot and tg are great projects. Rest assured, many people (including myself) appreciate all your hard work.
- tomlock 11y ago
  Hey! I found your work really useful. Thanks very much for your effort :) I look forward to your next project!
- huangbong 11y ago
  I was one of the users of your bot! Thanks for all that you did.
daniel-levin 11y ago
Telegram is really cool. I have long thought about what additions and modifications I could make to my mobile texting program. Now I have to convince all my friends to move from Whatsapp.
_jomo 11y ago
This is nice, but I really wonder why they don't focus on more important things. For example this issue I opened over a year ago, asking them to use end-to-end encryption by default and for group chats: https://github.com/DrKLO/Telegram/issues/156 https://github.com/DrKLO/Telegram/issues/156 Probably because features are more important than security, sigh.
- free2rhyme214 11y ago
  I second that notion. It comes down to priorities and right now bots > security.
- jhasse 11y ago
  It's not that easy: How would you exchange the private keys when using multiple clients? This would require to user to transfer the private key files or to remember a secure password. Both options aren't possible for usability reasons if you want to beat WhatsApp.
  - _jomo 11y ago
    This has been discussed a lot in the issue thread. Key exchange really isn't the issue. Scanning a QR code or creating a secure connection between the clients to exchange the keys isn't that hard.
    - jhasse 11y ago
      What when I want to login at a computer but don't have my phone with me?
      - chralieboy 11y ago
        Same as using 1Password — you don't. You're trading convenience for increased security.
        sherjilozair 11y ago
ohitsdom 11y ago
I don't have any experience with Telegram. Can anyone share how it compares with Slack?
- eertami 11y ago
  They have completely different goals, Telegram is a competitor to SMS/WhatsApp, not Slack/IRC.
Cieplak 11y ago
I really like that they embrace HATEOAS, e.g., "what can this bot do?", even though the API might not be strictly RESTful (they call it an "HTTP-based interface").
scriptnull 11y ago
Great news ! Check out Github bot for sure people . I am already in love ! This feature is making me remember my own simple telegram bot that helped me to convey 1000 Happy birthdays to my friend in 15 mins. https://gist.github.com/scriptnull/7877b404f33de2b7445a https://gist.github.com/scriptnull/7877b404f33de2b7445a
- mahouse 11y ago
  Your friend sure appreciated that...
  - scriptnull 11y ago
    yeah ! He was surprised and so were my other friends.
joeyspn 11y ago
> Telegram is about freedom and openness – our code is open for everyone, as is our API. Open for usage I guess. It's a pity that the API (and server) source is still closed. The Bot Platform is a cool initiative anyways, so good luck!
- jhasse 11y ago
  Not only for usage. The protocol is open and the clients are GPLv3.
kh_hk 11y ago
OT: Awesome, great, APIs are good. Know what's better? Open specifications and federated services. It's called XMPP and if it's not enough, then something better should be developed. Is this the replacement of SMS? Not sure what people would have thought at the time if they could not send SMS to other mobile carriers. It saddens me even more to see public institutions moving their SMS infrastructure to the new 'carriers'. Protocols are not a new thing. Let's not go back to the time were computers could not talk to each other.
- huskyr 11y ago
  You're right, of course. Unfortunately, the trend right now doesn't seem to be open protocols. Until the pendulum swings back again, i'd like to think that i'm beter off with a platform that isn't being run by Facebook.
  - kh_hk 11y ago
    That is true. What surprises me is how lazy and clueless mobile network operators seem to be despite the power they still hold. They have all the power they need to develop or implement modern messaging protocols. Granted they can't charge for it. Still seems a better option than pushing SMS, MMS and letting new players enter their yard. I am all up for letting mobile network operators just provide internet services. Surely the trend seems to be to flush everything down the Internet tubes and if that's the future, we need something better than a couple of companies that do not respect free choice.
    - rakoo 11y ago
      > They have all the power they need to develop or implement modern messaging protocols. Granted they can't charge for it And they do, at least here in europe: https://gigaom.com/2014/02/20/oranges-libon-messaging-app-lets-you-chat-with-people-who-dont-use-libon/ https://gigaom.com/2014/02/20/oranges-libon-messaging-app-le...
- jhasse 11y ago
  Telegram has an open specification, called MTProto. I guess XMPP wasn't good enough, so they DID develop something "better" (better for this specific use case). Also federated services have their disadvantages, so I wouldn't necessarily say that's better.
colordrops 11y ago
Telegram is not truly open source. They utilize a pre-compiled library for the actual messaging code, as seen here: https://github.com/DrKLO/Telegram/tree/master/TMessagesProj/libs https://github.com/DrKLO/Telegram/tree/master/TMessagesProj/... They would like to have you believe otherwise through their PR efforts, but I wouldn't trust them simply on the fact that they claim they are open source when they are not, and it's not clear what's going on in that binary lib. If they never claimed to be open source in the first place, it would be a different story.
- deleted 11y ago
  [deleted]
- tptacek 11y ago
  wait what What's in this thing? This isn't just some build optimization thing they're doing? Nobody's picked it apart yet?
- _jomo 11y ago
  There is Telegram-FOSS [0]. I believe they have removed the binaries. It's also the version you can find on F-Droid. Edit: Also, the maintainer of the Android app is making all his changes locally and then submits all of them in one giant commit. There are pull requests, but he just includes these in his giant commits. People do have complained about this [1][2], but he obviously doesn't (want to) understand git. 0: https://github.com/slp/Telegram-FOSS/issues https://github.com/slp/Telegram-FOSS/issues 1: https://github.com/DrKLO/Telegram/pull/76 https://github.com/DrKLO/Telegram/pull/76 2: https://github.com/DrKLO/Telegram/issues/1007 https://github.com/DrKLO/Telegram/issues/1007
  - dethstar 11y ago
    The telegram client is open source. But the server side isn't. At least that's what i gathered last time I read about it.
    - tptacek 11y ago
      Why is there a binary blob in their Android repo, and what does it do? Is it just compiled open-source Telegram code?
pbreit 11y ago
I've always been surprised something like this never really got going. I think the issue here is that it needs to be on message platforms that people actually use (iMessage, WhatsApp, Gchat, etc). Is it really not possible to hook in to those platforms?
- asddubs 11y ago
  telegram is getting pretty popular around here. To the point where people you meet ask you for your telegram without explaining what telegram is
  - _jomo 11y ago
    Me and 2 friends decided to get rid of WhatsApp. We told our friends to get Telegram and left the group chats altogether. They joined Telegram that same day. I guess it's not that simple when you're alone, but getting people to switch with a few people is fairly simple.
- ryukafalz 11y ago
  The moment you hook into those systems, you're segmenting your userbase. If you rely on iMessage for transport, you can only talk to Apple users. The situation is similar with Hangouts and WhatsApp - while you're not limited to one device manufacturer, there's no official API, and any attempt to do so is a hack that could break at any time with no warning. Telegram is slightly better in that it at least has a client API, but you're still locked to a single provider (the official Telegram server).
  - pbreit 11y ago
    And that provider is a tiny fraction the size of iMessage, GChat, WhatsApp, et al.
thelad 11y ago
I'm guessing this was inspired by IRC eggdrop bots? Seem awfully similar, just different comms mechanism
gcmartinelli 11y ago
I believe this an amazing move by Telegram. I firmly believe that open platforms tend to win in the long run. Whatsapp should take the hint and open up their platform for developers... Curiously I was thinking about building bot-based services on their platform (largest user base in my country), but basically gave up after seing how closed they are to any initiative like this. Felt even worse after reading things like this: https://twitter.com/gcmartinelli/status/605776036358291456 https://twitter.com/gcmartinelli/status/605776036358291456
- techaddict009 11y ago
  http://www.whatshash.com/ http://www.whatshash.com/ Someone built whatsapp bot! I dont know if they used some official api or what.
  - gcmartinelli 11y ago
    Thanks for the reference! I've seen some implementations (https://github.com/asdofindia/python-whatsapp-bot https://github.com/asdofindia/python-whatsapp-bot) but usually Whatsapp bans accounts that do it.
ommunist 11y ago
PingBot for server health monitoring anyone? or we'll just spam chats with Elisa clones?
sweis 11y ago
I briefly looked at Telegram's crypto code a couple months ago. Here's a few funny things I spotted: Telegram's message format uses ambiguous padding, so they have to try all padding lengths when validating a message: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/HandshakeAction.java#L346 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... That loop leaks timing information, as does the "Utilities.arraysEquals" method it uses. I'm not sure if it opens up a timing attack, but it's suspect: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/Utilities.java#L283 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... There is another spot where they pad with zero bytes without any authentication. This may leave room to mess with the protocol: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/HandshakeAction.java#L261 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... There are also some weird things throughout the code, like using SecureRandom.nextDouble() all over: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/android/SecretChatHelper.java#L1531 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/HandshakeAction.java#L164 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...
- Kiro 11y ago
  What does leaking timing information mean?
  - m_mueller 11y ago
    Response timing can be indicative of the key, especially if you have the crypto algorithm's code (source/IR/machine code).
  - sweis 11y ago
    Nate Lawson has a good explanation of timing attacks (against my own code): http://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/ http://rdist.root.org/2009/05/28/timing-attack-in-google-key...
orzfly 11y ago
Create you own bot with Node.js! https://github.com/orzFly/node-telegram-bot https://github.com/orzFly/node-telegram-bot
task_queue 11y ago
Telegram is the company that ignores proven crypto standards, rolls their own crypto without any verification or audit, then offers a $200k bounty to "break" their crypto by requiring developers to work with an arm tied behind their back by reducing the types of attacks that could be made in the real world. Seems MTProto is the same as its always been https://news.ycombinator.com/item?id=6931457 https://news.ycombinator.com/item?id=6931457 http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest http://www.cryptofails.com/post/70546720222/telegrams-crypta...
vijucat 11y ago
I woke up one night with the idea that if WhatsApp allowed API integration, it would so awesome : you could message DHL or UPS with your waybill tracking number, and they could push updates to you. More interestingly, the WhatsApp text box then effectively becomes a REPL shell to a remote API : you could ask for stopping updates, updates only once a day, etc; If the remote server implements a DSL, you could do a LOT. The possibilities were endless and exciting. But I have a feeling WhatsApp / their new owner are going to just let the opportunity pass by. If anyone at FB is reading this : guys, Business integration with WhatsApp is where the next $250 billion is. That's how FB will get a permanent, maybe even irreversible, grip on mobile. Imagine every service business providing updates via WhatsApp by integrating with their backend.
- detaro 11y ago
  They did announce plans for B2C use cases earlier this year (and of course are already used for conducting business, but only for communicating with a human on the other end
wodenokoto 11y ago
Can telegram be considered safe? I looked at eff's guide to secure chat earlier today and was quite confused that it seeming,y scores full marks and not-full marks. https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard

261 points by thiagoperes 11y ago

DLion 11y ago

I made a simple bot plugins based in Node.js. https://github.com/dlion/smagenBot https://github.com/dlion/smagenBot

All the comments on this news item made me really want to try this out and see how it works. I downloaded and installed the desktop version. Created an account with my phone number (okay: if I ever lose my phone, I'll permanently lose access to my account!). I see how to add contacts. I need their phone number. I don't know my friend's numbers. We use facebook, xmpp, email, lots of shit, but nobody still relies on SMS nowadays, and my phonebook is literally under 10 entries long (and I'm sure mum and dad won't be using Telegram). This reliance on old networks really kills it for me. IMHO, linking an account to a device that can get stolen or lost is also something I'll never really understand.

avens19 11y ago

This is great, nice work guys

harryf 11y ago

Bananas or oranges anyone? http://telegram.me/PollBot?startgroup=c4dd5512c96b2952a17396273a72e18f http://telegram.me/PollBot?startgroup=c4dd5512c96b2952a17396...

ddon 11y ago
Not found There is no Telegram account with the username you provided.

gioi 11y ago

Just yesterday I was trying to get a bot working on the TextSecure platform. A vastly disappointing experience: almost not existing libraries, sparse and incomplete documentation, unstable protocol breaking without any kind of notice (https://github.com/JavaJens/TextSecure/issues/6 https://github.com/JavaJens/TextSecure/issues/6, for example). And still no way to register without a phone, which would be amazing for this kind of project: https://github.com/WhisperSystems/TextSecure/issues/1085 https://github.com/WhisperSystems/TextSecure/issues/1085 I think Telegram is succeeding in what TextSecure is failing: attracting a widespread community of developers. This is only a confirmation, in my opinion. EDIT: and, by the way, while Telegram security is no good, I wonder why we cannot have both (security & developer-friendliness)

_jomo 11y ago
I'm using Cyanogenmod and I wanted to try TextSecure. There is a version for SMS pre-installed, but I'm not a fan of paying money for 128 bytes of data. I don't have any Google Services installed. So I tried finding it on F-Droid, but it wasn't there. I found out there has been a lot of discussion about this. [0][1] I decided to compile it on my own. That requires to use use Google Libraries, oh well. I managed to get that done and was disappointed when I tried to use it. It also requires to have Google Services installed on your phone for push notifications. I don't have that. I tried finding a solution, and other people complained about this and there was the idea to use websockets instead of google push notifications [3]. Someone forked TextSecure and started working on it [4]. Unfortunately that fork isn't stable yet, and it doesn't communicate with 'producion' users of TextSecure [5]. This is where I gave up. It shouldn't be so hard to install a free app on a free system. Also, the websocket fork is somewhat dead [6]. 0: https://f-droid.org/posts/security-notice-textsecure/ https://f-droid.org/posts/security-notice-textsecure/ 1: https://github.com/WhisperSystems/TextSecure/issues/127 https://github.com/WhisperSystems/TextSecure/issues/127 3: https://github.com/WhisperSystems/TextSecure/issues/1000 https://github.com/WhisperSystems/TextSecure/issues/1000 4: https://github.com/JavaJens/TextSecure https://github.com/JavaJens/TextSecure 5: https://github.com/JavaJens/TextSecure/issues/10 https://github.com/JavaJens/TextSecure/issues/10 6: https://github.com/JavaJens/TextSecure/issues/15 https://github.com/JavaJens/TextSecure/issues/15
- iamthebest 11y ago
  I had the same experience. I am using CyanogenMod as well and as much as I dislike Google I did install the Play services. I can't even remember why but I think I needed it to use the google voice app. Anyway, google play apparently tried to auto-update and bricked itself; now it just says "no connection" when I launch the play store. Last week I tried to install TestSecure but it would not run. It just gave an error message about needing to update play services. I ended up installing the Telegram app in F-Droid.
  - Nullabillity 11y ago
    I've had Play Services brick itself a few times, but uninstalling all updates tends to fix it.

yagop 11y ago

I've beeing developing this https://github.com/yagop/telegram-bot https://github.com/yagop/telegram-bot for a year. Currently most Telegram Bots uses my proyect for building bots. Now it's deprecated and I'm really sad about that.

sebastianavina 11y ago
thank you for the effort.
sajid 11y ago
I'm really sorry about that. telegram-bot and tg are great projects. Rest assured, many people (including myself) appreciate all your hard work.
tomlock 11y ago
Hey! I found your work really useful. Thanks very much for your effort :) I look forward to your next project!
huangbong 11y ago
I was one of the users of your bot! Thanks for all that you did.

daniel-levin 11y ago

Telegram is really cool. I have long thought about what additions and modifications I could make to my mobile texting program. Now I have to convince all my friends to move from Whatsapp.

_jomo 11y ago

This is nice, but I really wonder why they don't focus on more important things. For example this issue I opened over a year ago, asking them to use end-to-end encryption by default and for group chats: https://github.com/DrKLO/Telegram/issues/156 https://github.com/DrKLO/Telegram/issues/156 Probably because features are more important than security, sigh.

free2rhyme214 11y ago
I second that notion. It comes down to priorities and right now bots > security.
jhasse 11y ago
It's not that easy: How would you exchange the private keys when using multiple clients? This would require to user to transfer the private key files or to remember a secure password. Both options aren't possible for usability reasons if you want to beat WhatsApp.
- _jomo 11y ago
  This has been discussed a lot in the issue thread. Key exchange really isn't the issue. Scanning a QR code or creating a secure connection between the clients to exchange the keys isn't that hard.
  - jhasse 11y ago
    What when I want to login at a computer but don't have my phone with me?
    - chralieboy 11y ago
      Same as using 1Password — you don't. You're trading convenience for increased security.
      - sherjilozair 11y ago

ohitsdom 11y ago

I don't have any experience with Telegram. Can anyone share how it compares with Slack?

eertami 11y ago
They have completely different goals, Telegram is a competitor to SMS/WhatsApp, not Slack/IRC.

Cieplak 11y ago

I really like that they embrace HATEOAS, e.g., "what can this bot do?", even though the API might not be strictly RESTful (they call it an "HTTP-based interface").

scriptnull 11y ago

Great news ! Check out Github bot for sure people . I am already in love ! This feature is making me remember my own simple telegram bot that helped me to convey 1000 Happy birthdays to my friend in 15 mins. https://gist.github.com/scriptnull/7877b404f33de2b7445a https://gist.github.com/scriptnull/7877b404f33de2b7445a

mahouse 11y ago
Your friend sure appreciated that...
- scriptnull 11y ago
  yeah ! He was surprised and so were my other friends.

joeyspn 11y ago

> Telegram is about freedom and openness – our code is open for everyone, as is our API. Open for usage I guess. It's a pity that the API (and server) source is still closed. The Bot Platform is a cool initiative anyways, so good luck!

jhasse 11y ago
Not only for usage. The protocol is open and the clients are GPLv3.

kh_hk 11y ago

OT: Awesome, great, APIs are good. Know what's better? Open specifications and federated services. It's called XMPP and if it's not enough, then something better should be developed. Is this the replacement of SMS? Not sure what people would have thought at the time if they could not send SMS to other mobile carriers. It saddens me even more to see public institutions moving their SMS infrastructure to the new 'carriers'. Protocols are not a new thing. Let's not go back to the time were computers could not talk to each other.

huskyr 11y ago
You're right, of course. Unfortunately, the trend right now doesn't seem to be open protocols. Until the pendulum swings back again, i'd like to think that i'm beter off with a platform that isn't being run by Facebook.
- kh_hk 11y ago
  That is true. What surprises me is how lazy and clueless mobile network operators seem to be despite the power they still hold. They have all the power they need to develop or implement modern messaging protocols. Granted they can't charge for it. Still seems a better option than pushing SMS, MMS and letting new players enter their yard. I am all up for letting mobile network operators just provide internet services. Surely the trend seems to be to flush everything down the Internet tubes and if that's the future, we need something better than a couple of companies that do not respect free choice.
  - rakoo 11y ago
    > They have all the power they need to develop or implement modern messaging protocols. Granted they can't charge for it And they do, at least here in europe: https://gigaom.com/2014/02/20/oranges-libon-messaging-app-lets-you-chat-with-people-who-dont-use-libon/ https://gigaom.com/2014/02/20/oranges-libon-messaging-app-le...
jhasse 11y ago
Telegram has an open specification, called MTProto. I guess XMPP wasn't good enough, so they DID develop something "better" (better for this specific use case). Also federated services have their disadvantages, so I wouldn't necessarily say that's better.

colordrops 11y ago

Telegram is not truly open source. They utilize a pre-compiled library for the actual messaging code, as seen here: https://github.com/DrKLO/Telegram/tree/master/TMessagesProj/libs https://github.com/DrKLO/Telegram/tree/master/TMessagesProj/... They would like to have you believe otherwise through their PR efforts, but I wouldn't trust them simply on the fact that they claim they are open source when they are not, and it's not clear what's going on in that binary lib. If they never claimed to be open source in the first place, it would be a different story.

deleted 11y ago
[deleted]
tptacek 11y ago
wait what What's in this thing? This isn't just some build optimization thing they're doing? Nobody's picked it apart yet?
_jomo 11y ago
There is Telegram-FOSS [0]. I believe they have removed the binaries. It's also the version you can find on F-Droid. Edit: Also, the maintainer of the Android app is making all his changes locally and then submits all of them in one giant commit. There are pull requests, but he just includes these in his giant commits. People do have complained about this [1][2], but he obviously doesn't (want to) understand git. 0: https://github.com/slp/Telegram-FOSS/issues https://github.com/slp/Telegram-FOSS/issues 1: https://github.com/DrKLO/Telegram/pull/76 https://github.com/DrKLO/Telegram/pull/76 2: https://github.com/DrKLO/Telegram/issues/1007 https://github.com/DrKLO/Telegram/issues/1007
- dethstar 11y ago
  The telegram client is open source. But the server side isn't. At least that's what i gathered last time I read about it.
  - tptacek 11y ago
    Why is there a binary blob in their Android repo, and what does it do? Is it just compiled open-source Telegram code?

pbreit 11y ago

I've always been surprised something like this never really got going. I think the issue here is that it needs to be on message platforms that people actually use (iMessage, WhatsApp, Gchat, etc). Is it really not possible to hook in to those platforms?

asddubs 11y ago
telegram is getting pretty popular around here. To the point where people you meet ask you for your telegram without explaining what telegram is
- _jomo 11y ago
  Me and 2 friends decided to get rid of WhatsApp. We told our friends to get Telegram and left the group chats altogether. They joined Telegram that same day. I guess it's not that simple when you're alone, but getting people to switch with a few people is fairly simple.
ryukafalz 11y ago
The moment you hook into those systems, you're segmenting your userbase. If you rely on iMessage for transport, you can only talk to Apple users. The situation is similar with Hangouts and WhatsApp - while you're not limited to one device manufacturer, there's no official API, and any attempt to do so is a hack that could break at any time with no warning. Telegram is slightly better in that it at least has a client API, but you're still locked to a single provider (the official Telegram server).
- pbreit 11y ago
  And that provider is a tiny fraction the size of iMessage, GChat, WhatsApp, et al.

thelad 11y ago

I'm guessing this was inspired by IRC eggdrop bots? Seem awfully similar, just different comms mechanism

gcmartinelli 11y ago

I believe this an amazing move by Telegram. I firmly believe that open platforms tend to win in the long run. Whatsapp should take the hint and open up their platform for developers... Curiously I was thinking about building bot-based services on their platform (largest user base in my country), but basically gave up after seing how closed they are to any initiative like this. Felt even worse after reading things like this: https://twitter.com/gcmartinelli/status/605776036358291456 https://twitter.com/gcmartinelli/status/605776036358291456

techaddict009 11y ago
http://www.whatshash.com/ http://www.whatshash.com/ Someone built whatsapp bot! I dont know if they used some official api or what.
- gcmartinelli 11y ago
  Thanks for the reference! I've seen some implementations (https://github.com/asdofindia/python-whatsapp-bot https://github.com/asdofindia/python-whatsapp-bot) but usually Whatsapp bans accounts that do it.

ommunist 11y ago

PingBot for server health monitoring anyone? or we'll just spam chats with Elisa clones?

sweis 11y ago

I briefly looked at Telegram's crypto code a couple months ago. Here's a few funny things I spotted: Telegram's message format uses ambiguous padding, so they have to try all padding lengths when validating a message: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/HandshakeAction.java#L346 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... That loop leaks timing information, as does the "Utilities.arraysEquals" method it uses. I'm not sure if it opens up a timing attack, but it's suspect: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/Utilities.java#L283 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... There is another spot where they pad with zero bytes without any authentication. This may leave room to mess with the protocol: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/HandshakeAction.java#L261 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... There are also some weird things throughout the code, like using SecureRandom.nextDouble() all over: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/android/SecretChatHelper.java#L1531 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/src/main/java/org/telegram/messenger/HandshakeAction.java#L164 https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

Kiro 11y ago
What does leaking timing information mean?
- m_mueller 11y ago
  Response timing can be indicative of the key, especially if you have the crypto algorithm's code (source/IR/machine code).
- sweis 11y ago
  Nate Lawson has a good explanation of timing attacks (against my own code): http://rdist.root.org/2009/05/28/timing-attack-in-google-keyczar-library/ http://rdist.root.org/2009/05/28/timing-attack-in-google-key...

orzfly 11y ago

Create you own bot with Node.js! https://github.com/orzFly/node-telegram-bot https://github.com/orzFly/node-telegram-bot

task_queue 11y ago

Telegram is the company that ignores proven crypto standards, rolls their own crypto without any verification or audit, then offers a $200k bounty to "break" their crypto by requiring developers to work with an arm tied behind their back by reducing the types of attacks that could be made in the real world. Seems MTProto is the same as its always been https://news.ycombinator.com/item?id=6931457 https://news.ycombinator.com/item?id=6931457 http://www.cryptofails.com/post/70546720222/telegrams-cryptanalysis-contest http://www.cryptofails.com/post/70546720222/telegrams-crypta...

vijucat 11y ago

I woke up one night with the idea that if WhatsApp allowed API integration, it would so awesome : you could message DHL or UPS with your waybill tracking number, and they could push updates to you. More interestingly, the WhatsApp text box then effectively becomes a REPL shell to a remote API : you could ask for stopping updates, updates only once a day, etc; If the remote server implements a DSL, you could do a LOT. The possibilities were endless and exciting. But I have a feeling WhatsApp / their new owner are going to just let the opportunity pass by. If anyone at FB is reading this : guys, Business integration with WhatsApp is where the next $250 billion is. That's how FB will get a permanent, maybe even irreversible, grip on mobile. Imagine every service business providing updates via WhatsApp by integrating with their backend.

detaro 11y ago
They did announce plans for B2C use cases earlier this year (and of course are already used for conducting business, but only for communicating with a human on the other end

wodenokoto 11y ago

Can telegram be considered safe? I looked at eff's guide to secure chat earlier today and was quite confused that it seeming,y scores full marks and not-full marks. https://www.eff.org/secure-messaging-scorecard https://www.eff.org/secure-messaging-scorecard