Uh, no it’s not. The client (which happens to seemingly violate a bunch of open-source licenses) and the code posted to GitHub do not match; occasionally a source dump is posted online but there’s no indication how this relates to what they are shipping, as the released binaries differ and update much more frequently. The author is quite unresponsive about this: https://github.com/overtake/TelegramSwift/issues/163
I have telegram-desktop (on Linux) which is unofficially distributed and compiled on my laptop via AUR[0], FDroid also has a version of telegram which is compiled from sources and not taken from pkg's released by the Telegram group, although they remove non-free parts apparently[1].
I'm not sure about iOS as I don't currently have the means to verify the content of my App Store iOS installed version of telegram, but the fact is that there are (at least) 2 client implementations commonly used that are compiled from source.
[0]: https://git.archlinux.org/svntogit/community.git/tree/trunk/...
[1]: https://www.reddit.com/r/fdroid/comments/9gmkob/why_is_teleg...
the version in github works, but the version on play store different a lot from it..
Well, I was challenging this assertion.
"Does not match" what thing exactly? My point was that people are using the non-packaged versions (I mean, I'm not FOSS mad, I'm just a user and I'm using the FOSS version almost by accident).
I would prefer the FOSS version to be 1:1 what is in the repo (or, even the upstream of the non-free version), but I see the situation as more chrome/chromium. We're not shitting on chrome for being "the most secure webbrowser" despite having non-free elements.
Seemingly because large US tech companies deserve more respect than a guy who was essentially exiled from his country for not handing over his users data?
Sounds like a double standard. Telegrams OSS edition works, so if they're sneaking things in it would have to be a backdoor, which would be INCREDIBLY damaging to their endeavour if it was found, and it would be relatively trivial to find too. So I'm not sure where this FUD is coming from.
Making the argument about the server not being FOSS is valid though, but then if the E2EE is good enough on the client then the server is basically a relay and can't pilfer anything except metadata. (which, if we're honest, is what governments are after anyway)
Chrome is not GPL.
I’ll save you the work: Telegram has updated more often that this repository[1] has been committed to, so the code is perpetually out of date, if it ever shipped at all (apparently it doesn’t compile?). The author has mentioned[2] that they will open source their new client once it has been released, but that promise has not been kept.
You can also compile the official client yourself.
I mean, I could, but the Telegram developers being so opaque about this doesn’t make me feel like this is a good use of my time.
> There are many implementations already.
As far as I can tell, the only implementations for the platforms I care about are the “official” ones (in the sense that they are placed under some random person’s GitHub account and linked to by the Telegram website).
> You can also compile the official client yourself.
I have never been able to get this to work. Either way, what I compile from the “sources” they have put online and what they are shipping are two different things.
Telethon (https://github.com/LonamiWebs/Telethon) is a decent up to date (with MTProto) independent clean-room client implementation in the form of a Python lib.
You might consider trying to take care about it.
" The founder of chat app Telegram has publicly claimed that feds pressured the company to weaken its encryption or install a backdoor.
He said, During our team's 1-week visit to the US last year we had two attempts to bribe our devs by US agencies + pressure on me from the FBI. "
https://www.theregister.co.uk/2017/06/14/telegram_boss_backd...
Which means we must trust Telegram developers to not sell out our data to corrupt law enforcement agencies.
The service is free. Which means they would need to get profitable. Which means they would parse the chats or are already doing it.
Sorry, do you have source for this claim?
That’s good…
> there's code in GitHub that you can compile and run a working client
No, not really. The code pushed to GitHub doesn’t really compile and the author of the project is quite unhelpful in resolving these issues.
> Whether updates are being dropped in a timely fashion or not does not change anything.
It does: the project is licensed under the GPL, and in a sense “benefits” from having the name of the license associated with their product. But they are not compliant with software licenses, they’re basically source-available maybe possibly if you beg them enough, except also the sources they publish cannot be verified to and likely do not correspond to what they are currently shipping. For a project who’s entire goal should be increasing trust in their product’s security, keeping the development process opaque and violating open source licenses (in addition to their adoption of custom crypto, which I will ignore for this because I cannot comment on it) does not inspire trust at all. Plus it’s just plain annoying.