Wire messenger server code open-sourced

So I checked if this matches their privacy whitepaper [0] that claims to list what they store. It almost does, with one notable exception and one minor one.

* All of your contacts.

Wire contacts, they only store non-wire contacts in a hashed form, and there's an opt out for non-wire contacts.

* Unencrypted profile

(Isn't this just profile picture (which is shown to people you haven't connected with), and name anyways?) They do say so in the privacy policy.

* Every active conversation you have.

Specifically they claim to store:

Who/when it was created, who is involved (which seems critical to be able to route messages), and conversation name

* Every archived conversation you have.

I assume they store the same as for non-archived conversations, seems necessary to be able to add new devices.

* The frequency that you communicate with your contacts ('top contacts').

Ya... that's not listed as far as I can tell. Arguably "aggregated usage statistics"... but it's not really aggregated.

* Every group that you're in.

This is the same as conversations... they clearly need to know this to route messages.

* The unencrypted titles and avatars of everyone's groups.

Titles is listed. Avatars of groups isn't... seems like a minor oversight though given that they're like a profile picture, and profile pictures are publicly available.

[0] https://wire.com/resource/Wire%20Privacy%20Whitepaper/downlo...

I've

I don't know much about security so I really have no constructive criticism, obviously, one can easily make lots of investigative inferences from the information Wire collects and that is troubling enough.

If I understand correctly signal stores only metadata. My question whats the format of the metadata what kind of information does it retain. Is it anywhere close to what Wire is storing?

I would appreciate clarifications on this.

Sounds like the amount of information a typical web forum stores about its users private messages.

I am not saying if this is good or bad in general, but just... I could live with it in 2005 when Vbulletin was all the rage, and I can live with it now.

Also, other chat clients like Skype, Paltalk, Yahoo Messenger, Facebook Messenger also store this information---its kind of a requirement to do any kind of search over previous messages, and allow people to find their contacts or talk to random unacquainted individuals.

Maybe this is a big negative for Wire if their PR basically touts "security" and "encryption", when the reality is they want to be secure against middlemen only.

Isn't there some music-learning app too? Chordify, I think it was called.

Snowdrift.coop is doing this, too.

And darcs hub.

And a little bit of Rust, too!

https://github.com/wireapp/wire-server/tree/master/libs/libz...

No most of the source is still missing.

As a service, what it's provided is consistency for the group of friends I use it with. We've tried XMPP and Matrix on multiple accounts and had trouble on the server and client side. Wire is out of the box a great option with open source ideologies and some feature we liked that weren't available with XMPP or Riot.

They could have done the same thing with existing protocols, but I do like the way it was done and how well it works for us, and as a consumer of the service it's satisfied areas where XMPP/Matrix felt.. fragile.

Not that XMPP or Matrix are vastly inferior, there's certainly an issue or two we've had with Wire, but just how well it worked for us immediately was largely why we've stuck to it.

XMPP is terribly fragmented and the clients all suck.

I can't respond for XMPP, but the same question probably goes for Matrix (or any other open comms standard). Reasons you might use Wire over Matrix are probably if you prefer the app's UI/UX to any of the Matrix clients out there, or if you like some of Wire's more unusual features like sketch-sharing, or if you want compulsory E2E crypto, decent group VoIP calling, or a system which does not consider itself beta.

Conversely, the reasons you might use Matrix over Wire is if you want an open standard for the protocol (simple HTTP+JSON), or an ecosystem of different clients, servers, bots & bridges, or Apache licensed impls rather than AGPL, or implementations which were built from the outset as FOSS, or to decentralise history across an open federation of multiple servers rather than be forced to federate via a centralised service, and bridges through to things like IRC, Slack, Gitter etc.

I was able to get my grandmother and non-techie friends to use it. What Signal and Wire have over other encrypted chat is user experience. I'm no longer a tin-foil hat crypto nerd only talking to other tinfoil hat crypto-nerds.

Video calling works splendidly, which is why my wife and I chose Wire.

Back when our boy was just a few months old and my wife's maternity leave came to an end, keeping in touch with video made going back to work a less difficult. She'd call every time she needed some assurance that we were OK, and I could show her we were, in high resolution.

Signal didn't have video calling back then, and Skype is out of the question because I really distrust Microsoft.

I assume it's the same thing as signal is for me: it's the thing with UX good enough to convince some of my friends to use it. They wouldn't use buggy xmpp, tox clients or things without many of the features like ricochet.

I like testing these tools with cryptonerd friends though.

I was hopeful at first. A large VC funded company with a big full time team should run circles around a small open source effort, but their security is still way behind Signal. I was also quickly put off by their "less than honest" marketing.

Open source is a development model and not a business model.

Also mind the license. It means anyone competing with Wire has to comply with the AGPL which is specific to servers. If you modify the code, you must publish it, whilst Wire can retain their own modifications to the server.

One of the details we haven't quite settled on yet. Safe to assume that once all of the server code is open then at first you'd need to roll your own apps pointing to the right server.

Since a lot of the interest for self hosting comes from companies then a nicely packaged version is somewhere in the future.