Wire open-sourced

by arunc • 10 years ago

488 132 10 years ago

gfosco• 10 years ago

A link to a GitHub organization isn't great.. I'd say this is better: https://medium.com/@wireapp/you-can-now-build-your-own-wire-... but even that doesn't clearly explain what Wire is. Visit https://wire.com to find out it's an encrypted video and group chat app.

computator2• 10 years ago

From a Hacker News reader's perspective, the following page seems to be the best explanation of what it does:

https://wire.com/privacy/

Also, the Wikipedia entry is a good overview:

https://en.wikipedia.org/wiki/Wire_Swiss

walterbell6• 10 years ago

From http://fortune.com/2016/07/22/wire-open-source/:

... the move has two main objectives: transparency and building an ecosystem of secure services that can talk to one another ... there is scope for organizations to design Wire-based apps that are tailored to different use cases, such as enterprise communications and digital health, and even automotive and the Internet of things ... "You can register with email and it doesn’t require mobile.” He also pointed out that the apps don’t need to be interoperable, though federation at some point would be nice. “It’s a shame we have so many islands in the communications space,” he added.

HN comments from Wire marketing: https://news.ycombinator.com/threads?id=Siimteller

PhasmaFelis• 10 years ago

I really hate HN posts that just link to an error page, or a spreadsheet, or a Github repo with no readme, or something else that makes no sense unless you already know whatever you're supposed to be taking from it. Please don't do this, everyone.

nanch• 10 years ago

See https://wire.com for more information since the linked repos provide no context. "Crystal clear voice, video and group chats. No advertising. Your data, always encrypted."

qznc• 10 years ago

So, Signal plus video chat?

stemuk2• 10 years ago

Probably not, scince Signal doesn't really support secure web communication (without phone routing).

20andup• 10 years ago

I wonder what the business model is?

computator2• 10 years ago

They might charge for certain premium services in the future, according to https://en.wikipedia.org/wiki/Wire_Swiss#Business_model

detaro• 10 years ago

If I read the TOS correctly, you are also not allowed to write any kind of chat bot against it. If the current hype for bots remains, bot access might be another thing to sell.

mahyarm• 10 years ago

Now all this needs is a few good third party audits, verifiable builds and it's the holy grail of encrypted communications!

ianopolous2• 10 years ago

I would say the Holy Grail would be fully decentralized without needing central servers, but this does look cool nonetheless.

mrbiber2• 10 years ago

I am very hopeful that Briar (https://briarproject.org/) will achieve this. They don't use any centralized infrastructure, the app works even when the net is down, and they have e completely distributed and thus uncensorable forums and blogs.

tilpner• 10 years ago

ring.cx and matrix.org seem promising in that regard.

lazerwalker• 10 years ago

Unfortunately, they explicitly say that the App Store version of the app contains proprietary code.

pigeons• 10 years ago

And an open-source server implementation.

stemuk2• 10 years ago

I wonder how they encrypted their chat on the web client. Scince the Signal protocol is kind of the gold standard right now, probably their solution might in the end be the better one.

eps• 10 years ago

Since the Signal protocol is kind of the gold standard right now

Oy vey. The perils of reading HN too much.

mintplant• 10 years ago

What, in your opinion, is the gold standard?

niftich4• 10 years ago

They use a Rust library [1] they wrote for the Axolotl protocol, which is the old name for the Signal protocol before it was renamed [2]. They refer to their implementation as 'Proteus'.

[1] https://github.com/wireapp/proteus

[2] https://whispersystems.org/blog/signal-inside-and-out/

EDIT: Their webapp is written in Coffeescript, including their cryptography functions used in said webapp [3].

[3] https://github.com/wireapp/wire-webapp/search?q=proteus&type...

moxie5• 10 years ago

Wire does not use Signal Protocol. They used some of our code, but created a protocol of their own devising that we do not recommend.

We renamed the Axolotl ratchet and Axolotl protocol because there was a lot of confusion around what it meant to say "Axolotl." Some people who continue to use the term "Axolotl" do so because they seek to benefit from that confusion.

It is great that Wire has finally open sourced their software. They have been advertising themselves as open source for the past two years, though, so I guess they weren't really able to make an announcement about this.

moxie5• 10 years ago

Signal Protocol supports both multi-device and groups out of the box. WhatsApp's choice to use "device routing" was not driven by encryption protocol limitations. The Signal desktop client, for instance, does not use device routing.

pedalpete2• 10 years ago

I don't get how they can make statements like this "Only Wire offers fully encrypted calls, video and group chats available on all your devices". Webrtc is encrypted by default.

pepesza• 10 years ago

Because encryption without authentication is prone to MITM attacks. WebTRC does not have auth layer.

pedalpete2• 10 years ago

But they don't say anything about authentication, and authentication and encryption are two different things...

saghul2• 10 years ago

WebRTC is only the audio / video part. Chat, groupchat, etc are not using it IIRC. Chat could use the data channel, though.

laksjd5• 10 years ago

The other signal/axolotl protocol based systems currently don't support true multi device solutions. It's not a limitation of the protocol, after all Wire is based on it, too, just that Signal/WhatsApp decided not to implement it.

Wire has true multi device support (basically multiple keys per identity)

moxie5• 10 years ago

Not sure what you're definition of "true multi device" is, but Signal Desktop does not do phone routing and functions whether your mobile device has connectivity or not: https://whispersystems.org/blog/signal-desktop-public/

aleken• 10 years ago

Otto is my new best friend. I cannot see any information about a bot API on their site though...

Siimteller12• 10 years ago

There's no not API available. We've been experimenting with a few internal bots (Otto is the most prominent) but that's the extent of it for now.

jalami• 10 years ago

Side note, but it's kind of strange that images on their site require cookies enabled to view. I didn't dig into a reason, I just white-list the sites I want to use cookies and found it odd that there were big white spaces before doing so.

Siimteller12• 10 years ago

Weird, we'll check it out. Thanks for pointing it out.

mei0Iesh• 10 years ago

Thank you! Wire is the best, with multiple device support, clean mobile app, and a desktop client. It'd be nice if it were a standard open protocol so everyone could implement it, and find a way to allow federation. I'd pay to help support.

melle• 10 years ago

I believe all their good intentions and I do hope they succeed. But for me it's too early to tell whether their business model will hold. If they build up a sufficiently large user base, but fail to monetize it and sell the company to e.g. Microsoft or Facebook, then I doubt how much of their original privacy / openness remains.

Another thing that I wonder about: Does being Swiss-based give them a privacy advantage?

laksjd5• 10 years ago

It might be mostly marketing since the Swiss have long switched from a 'swiss banking secrecy' mindset to fairly open cooperation with EU and US investigators.

It's probably nevertheless better than being based in the US, just ask Lavabit ;)

grizzles• 10 years ago

A bold move by Wire. Open source is still a very disruptive play, and the world needs something like this. If they manage this well and triple down on developer engagement, it could work out quite nicely for them. EDIT: Thread title is slightly misleading. It looks like they did a Telegram. There is no server here.

niftich4• 10 years ago

Correct, there's no server. I will avoid blockquoting large amounts of text but on their open source summary page [1], they give you two options:

1. you point your implementation to their server and you have to abide by their additional terms (which is exactly what I'd expect)

- or -

2. you point your implementation to somewhere else, unspecified, and you're only bound by GPLv3

Right now, #2 is moot because there is no compatible server you can host. Once someone implements a compatible server, this will get a lot more exciting.

[1] https://github.com/wireapp/wire#open-source

ZenoArrow• 10 years ago

Does the Wire licence agreement allow you to create a standalone server though?

https://github.com/wireapp/wire/blob/master/README.md

"Additionally, if you choose to build an Open Source App, certain restrictions apply, as follows:

a. You agree not to change the way the Open Source App connects and interacts with our servers"

Even if the company behind Wire seems trustworthy, if I cared about security I wouldn't want any interaction between clients to go through a server I didn't have control over.

deltaprotocol• 10 years ago

I must say that my first impression is beyond positive.

One to one and group chats, group video and audio calls, GIF search built-in, doodles, the best implementation of photos in the message stream that I've seen, poking and playable Spotify and Soundcloud music by just sharing links? All with end-to-end encryption?

I have that "too good to be true" feeling but, still impressed. Just waiting for possible audits and more feedback from the security community.

Edit: It's also Switzerland based, already supports Win10, MacOS, Web, Android and iOS, and to complete has the cleanest design I've seen in a messaging app.

Andrenid• 10 years ago

I've been using it for a while just with 1 other friend who has it, and it's without a doubt my favourite IM as far as interface/functionality/etc.

As usual it's just the matter of getting other people to use it. Everyone I know just uses FB Messenger or Telegram now.

abcd_f• 10 years ago

Looking them up on zefix.ch shows that they appear to be only registered in Switzerland, with Luxembourg ownership and non-Swiss management.

Alan, their CTO and (co-?)founder is Swedish.

Siimteller12• 10 years ago

We have a small office in Zug, main dev center in Berlin and a few people here and there around the globe.

Alan is originally from Croatia.

unicornporn2• 10 years ago

I've been using it with friends and family for awhile on Android and macOS and it's fantastic, in theory. It has however been plagued with lots of bugs. The calling functionality, which I've used a lot, often stalls at "joining" and then nothing happens. It's not as polished or flawless as Telegram. It does not have a feature to compress video before sending for instance. But I can only expect that to change. Especially now, when anyone can write their own client.

Siimteller12• 10 years ago

Compress video before sending is there on mobile (at least on iOS, I need to double check Android, don't have that handy right now).

lobster_johnson2• 10 years ago

It does look good. I wonder how good its group video chat is.

I've been looking for something a little better than GoToMeeting (which is nice but clunky), which we migrated to from Google Hangouts (which generally terrible and also clunky).

My hope was that Slack would launch this quickly, since they acquired Screenhero, but nothing has happened.

For organizational purposes, group chat does need smooth screen sharing, something GTM is quite decent at (but again, not great: For example, only one person share their screen; the "presenter" has to give their presenter role to someone else). Doesn't look like Wire has this yet.

Siimteller12• 10 years ago

Wire doesn't have group video or screen sharing yet (although 1:1 screen sharing is not far off).

mtgx2• 10 years ago

Not sure about the Switzerland thing. My firewall sees connections from U.S. servers when installing and using it.

They may not have the HQ in the U.S., but if they still have servers in the U.S., we've seen with Megaupload, and now KAT, that the U.S. thinks its entitled to jurisdiction over the company.

So at the very least, the company should have its lawyers already work on a strong jurisdiction defense, if they want to be prepared and maintain their credibility once the U.S. gov comes after them.

Siimteller12• 10 years ago

All servers in the EU, the US connections you see are to proxies we use for better performance. Nothing stored there and chat contents E2EE, of course.

newscracker• 10 years ago

I discovered Wire several weeks ago and started using it (more as a replacement for Signal, while my go-to app is still Telegram). I was pretty impressed that the feature set was quite rich (compared to say, Signal, which is also end-to-end encryption by default), with multi-device sync, multi-OS support, photos, videos, sketches, voice messages, video calls, etc.

Wire is still behind Telegram in a few aspects, and I hope it'll become better soon. The main issues I see with Wire currently are:

1. No message delivered and message read indication. This is a big shortcoming for a chat application. Without an indication, it's almost like sending SMS and not knowing if the message reached.

2. The time taken for message delivery seems a lot longer than Telegram's. This in turn affects conversation speed negatively.

3. Finding other users, even those in one's address book (uploaded to Wire), needs a lot of improvement, and is currently buggy. Since Wire also allows signup using email address, it's important to allow users to be associated with multiple email addresses and using any of them for discovery and addition.

Additionally, it'd be nice for Wire to add the following:

1. Groups, super groups and channels for different use cases (all these terms are taken from Telegram).

2. Usernames to add people without exchanging phone numbers or email addresses. Along with this, @mentions to draw attention would be great.

3. If message editing is available, that'd be super cool, although I don't know about the complexity and limitations of such a feature in an E2E encrypted chat application. Telegram now allows editing messages for a limited time, and I no longer have to feel bad about typos, autocorrect, etc., and add more (annoying) messages in the conversation with corrections.

4. Easily mute conversations, for a short duration or permanently, from conversations or notifications.

5. Ephemeral (self-destructing) messages. I use this in Telegram's secret chats to exchange sensitive information that I don't want lingering around anywhere (of course, I trust the other party I'm talking to; so screenshots and related concerns don't arise).

I can't wait to move completely from Telegram to an E2E encrypted chat/call platform that's rich in features and works well. Wire is the only one I know of that fits the bill at this point in time, though it needs improvement. Having the code open source and independently audited by security experts would really help boost the confidence of users who value privacy.

_bojan• 10 years ago

Didn't see that coming. I think Wire is struggling to get new users and this move could put them on the map.

Siimteller12• 10 years ago

We've actually nicely accelerated user growth this year. Going the OS route was always the plan, especially given the target audience of hacktavists, human rights organizations, journalists. Open source is tablestakes to be taken seriously. It's also just one of the steps towards more transparency.

zedred4• 10 years ago

I tried installing it and only had a single contact show up. And it turns out that contact had long since uninstalled the app (said it was very unreliable), but the server was still showing her as registered.

From the app store numbers, it looks like Wire is still not even to a million monthly active users. For a funded app with a large full time staff and generous marketing budget, that's a pretty terrible sign several years after launching. I know that the founders are rich, but why would they continue funding an app that isn't showing adoption?

saghul2• 10 years ago

Lots of good stuff in there, thanks Wire! I just wish they had gone with something other than GPLv3 for libraries, like LGPL. Looks like they changed them on December, from MPL 2.0 to GPLv3.

At any rate, there are lots of us who can use the code with that license :-)

sanjeetsuhag• 10 years ago

Can anyone explain to me why they use an UpsideDownTableViewController ?

jtreanor• 10 years ago

This is usually because the default scroll position of a conversation is at the bottom rather than the top so it significantly simplifies scrolling logic (which can get pretty complex).

I am surprised they are using a table view rather than a collection view for this though.

philo23• 10 years ago

From memory, the easiest way to have the "top" of a table view at the bottom of the screen (like in Messages, so the latest message bubble appears at the bottom) is to flip the table view upside down using an affineTransform and then also flip each cell in the table view upside down as well (so the cell is the right way up again).

This means you can insert new rows (message bubbles) at index 0 and they'll appear at the bottom, which makes it considerably easiest to add new messages.

arthurk• 10 years ago

Is there a way to download the OSX app without the Mac App Store?

stephenr8• 10 years ago

Why, because a sandboxed app guaranteed to be from the author you think it's from is just too good a thing, and you prefer the heady rush of getting bombarded with MacUpdate spam when you get your apps?

Fine, some developers don't want to use the MAS. Their choice. I don't understand users not wanting to use it. It's the simplest possible way to install an app and get automatic updates for those apps.

saiko-chriskun3• 10 years ago

I also avoid the MAS when possible.

y7• 10 years ago

What MacUpdate spam?

Not using the Mac App Store gives you more control over your apps. It allows you to distribute apps to OSX machines without an internet connection, it allows you to rollback versions or choose not to update, etc.

Siimteller12• 10 years ago

No. No plans to offer that at the moment.

lipis2• 10 years ago

You will be able to build your own if you like once we'll release the source for the Desktop apps..

laksjd5• 10 years ago

They offer a password reset function. How does that work? Do they hold my private key in escrow? I'd certainly hope not! Or does the password reset work by creating a new keypair? If so, does this at least generate WhatsApp style security warnings for people chatting with me?

With some digging I've found a way to verify key fingerprints so that's nice, but it's manual, not QR assisted :(

happyslobro• 10 years ago

I found a file that is available as either MIT or GPL. Or is it only available under a union of the terms of both licenses? An intersection? Who knows, IANAL. https://github.com/wireapp/wire-webapp/blob/0cf9bf4/aws/main...

Why do people copy the license all over the place like that?

spicyj• 10 years ago

That file is GPL but parts of it were adapted from MIT-licensed code (which the MIT license allows). It can be treated as GPL.

belorn2• 10 years ago

MIT has one condition: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

As the code include this, the author who distribute the code can thus prove in court that they are compliant with the wishes of the author/s of the MIT licensed software.

The added GPL means that copies of this specific version also adds additional conditions that those distributing this version also need to follow. This mean in practice that they need to follow the GPL license and include the MIT copyright notice as stated above, in order to follow all the different authors wishes. Thankfully, MIT and GPL is compatible, so none of the conditions are contradicting with each other.

reubano• 10 years ago

IANAL but I thought the compatibility was only one way. I.e., you can use MIT code in a GLP project but you can't do the reverse. My understanding is if you use GPL code in an MIT project, you have to make your entire project GPL.

jacek• 10 years ago

I am a user. I switched myself and my family from Skype a few months ago and it has been great so far. Quality of video and audio is great, Android app works very well (better than web based desktop versions). And it also works in a browser, which is great for me (Linux user).

vasili1112• 10 years ago

Where is Windows client source code?

Siimteller12• 10 years ago

It's all on GuyHub. Our windows client is webapp in Electron wrapper so that's what you're looking for.

Siimteller12• 10 years ago

Darn autocorrect. That's Github, of course.

lipis2• 10 years ago

We will release the Electron's code as well in the coming weeks :)

maxpert• 10 years ago

Good to see people using Rust in production :)

redthrow• 10 years ago

Why does this Android app require a phone number to sign up?

At least Hangouts lets me use the app without a phone number.

walterbell6• 10 years ago

You can register with just an email, using a desktop web browser at http://app.wire.com, then use that account to login on mobile. Unclear why it's not possible to register a new email-only account from the mobile app.

vasili1112• 10 years ago

I hope they will fix this.

Siimteller12• 10 years ago

We had this, was confusing UX. Considering bringing it back.

mtgx2• 10 years ago

I've been asking for three things from Signal for the past almost two years:

1) desktop app

2) video call support

3) self-deleting messages

Signal finally (sort of) delivered a desktop app, but it still doesn't have the other two. Wire has the first two, but it's still lacking the last one. I hope one of them will have all three of these features soon.

walterbell6• 10 years ago

This HN comment (22 days ago) says Wire has a prototype of ephemeral messages, but insufficient demand, https://news.ycombinator.com/item?id=12014056

This Twitter comment (5 days ago) says Wire is looking into self-destructing messages, https://twitter.com/wire/status/755078974728970240

prayerslayer• 10 years ago

Not sure if these are for realsies, but there are some API keys in the webapp repository:

https://github.com/wireapp/wire-webapp/blob/master/app/scrip...

Siimteller12• 10 years ago

Thanks, nothing critical but we'll clear this up.

mrmondo• 10 years ago

Sorry if I've missed it somewhere but I'm looking for some independent, transparent reports on its security implementation. I was wondering if anyone could help me with finding this - or if perhaps they haven't been done I guess that would answer my question?

07• 10 years ago

Hmm, seems interesting.

iamleppert• 10 years ago

I wish they would have preserved the commit history. Future note to those open sourcing projects:

Preserve the commit history! It's very useful! Even if it takes more effort to review the history and remove stuff that you're not allowed to show or whatever.

yetii• 10 years ago

Android client uses Scala - might be changer for Scala on Android

premium-concern• 10 years ago

Why?

Wire open-sourced

Related Stories