News for hackers. Stuff that matters.

A comment on Why Telegram is insecure (2015). Parent comment

Re:Why Telegram is insecure (2015) by dijit on Sunday January 06, 2019 @11:33AM (#18839068)
Sorry, that's just not true.

I have telegram-desktop (on Linux) which is unofficially distributed and compiled on my laptop via AUR[0], FDroid also has a version of telegram which is compiled from sources and not taken from pkg's released by the Telegram group, although they remove non-free parts apparently[1].

I'm not sure about iOS as I don't currently have the means to verify the content of my App Store iOS installed version of telegram, but the fact is that there are (at least) 2 client implementations commonly used that are compiled from source.

[0]: https://git.archlinux.org/svntogit/community.git/tree/trunk/...

[1]: https://www.reddit.com/r/fdroid/comments/9gmkob/why_is_teleg...

[ Parent | on HN ]
Re:Why Telegram is insecure (2015) by saagarjha on Sunday January 06, 2019 @12:38PM (#18839432)
> I'm not sure about iOS as I don't currently have the means to verify the content of my App Store iOS installed version of telegram

I’ll save you the work: Telegram has updated more often that this repository[1] has been committed to, so the code is perpetually out of date, if it ever shipped at all (apparently it doesn’t compile?). The author has mentioned[2] that they will open source their new client once it has been released, but that promise has not been kept.

1: https://github.com/peter-iakovlev/Telegram-iOS

2: https://github.com/peter-iakovlev/TelegramCore/issues/11

[ Parent | on HN ]
Re:Why Telegram is insecure (2015) by j16sdiz on Sunday January 06, 2019 @11:47AM (#18839142)
how is it not true?

the version in github works, but the version on play store different a lot from it..

[ Parent | on HN ]
Re:Why Telegram is insecure (2015) by dijit on Sunday January 06, 2019 @11:58AM (#18839211)
>and the code posted to GitHub do not match;

Well, I was challenging this assertion.

"Does not match" what thing exactly? My point was that people are using the non-packaged versions (I mean, I'm not FOSS mad, I'm just a user and I'm using the FOSS version almost by accident).

I would prefer the FOSS version to be 1:1 what is in the repo (or, even the upstream of the non-free version), but I see the situation as more chrome/chromium. We're not shitting on chrome for being "the most secure webbrowser" despite having non-free elements.

Seemingly because large US tech companies deserve more respect than a guy who was essentially exiled from his country for not handing over his users data?

Sounds like a double standard. Telegrams OSS edition works, so if they're sneaking things in it would have to be a backdoor, which would be INCREDIBLY damaging to their endeavour if it was found, and it would be relatively trivial to find too. So I'm not sure where this FUD is coming from.

Making the argument about the server not being FOSS is valid though, but then if the E2EE is good enough on the client then the server is basically a relay and can't pilfer anything except metadata. (which, if we're honest, is what governments are after anyway)

[ Parent | on HN ]
Re:Why Telegram is insecure (2015) by saagarjha on Sunday January 06, 2019 @12:33PM (#18839402)
> I would prefer the FOSS version to be 1:1 what is in the repo (or, even the upstream of the non-free version), but I see the situation as more chrome/chromium.

Chrome is not GPL.

[ Parent | on HN ]