News for hackers. Stuff that matters.
Re:Threema Goes Open Source by est31 on Thursday September 03, 2020 @10:05AM (#24364158)
This is really big news. I use Threema because it is the only messenger out there that is:

a) always end to end encrypted (unlike Telegram)

b) supports account creation without any phone number (unlike Signal)

c) supports phones without google messaging service (unlike Signal, it formally supports it as well but in reality it's just a big battery drain)

It not being open source was always a bit sad for me, because most of the other apps on my phone are open source.

I'm curious about the multi device sync. I hope that it will be implemented in a way that doesn't use passwords but pair syncing. This is bad from a usability perspective (firefox abandoned it because of usability), but the only way I'm aware of how syncing can be made secure.

Re:Threema Goes Open Source by tweetle_beetle on Thursday September 03, 2020 @10:22AM (#24364333)
Out of curiosity what does Threema do that Element[1] (née Riot.im) doesn't? It seems to tick those boxes, but admittedly is still in quite active development and may not be as polished.

[1]https://element.io/

Re:Threema Goes Open Source by Arathorn on Thursday September 03, 2020 @12:39PM (#24365838)
It's more a question of "what does does Element do that Threema doesn't"?

Element is a Matrix client, so you connect to the global open Matrix decentralised network, rather than just closed-source servers run by a (newly-sold) company like Threema. Typical Matrix implementations are entirely Apache licensed open source, so you get full control and visibility both clientside and serverside. Matrix also already provides synchronised multi-device conversations, as well as more advanced cross-signing verification for E2EE key validation than Threema. Finally, Matrix is an open standard protocol maintained by the non-profit Matrix.org Foundation, that anyone can contribute to via the open governance process (https://matrix.org/foundation, https://matrix.org/docs/spec/proposals etc) - the Matrix standard gives developers full freedom to write their own clients/servers/bots/bridges/whatever.

Personally I'd say that Element & Threema have similar levels of UX polish these days (but I'm biased, working on Element). It's perhaps true that Threema's relatively limited featureset means that polish is easier to achieve.

Re:Threema Goes Open Source by qbonnard on Thursday September 03, 2020 @11:00AM (#24364677)
I kinda forced a friend of mine into using element/riot. He mostly complained about the lack of "polish" (which I also feel, and I'm a rather "frugal" user). He proposed Threema as an alternative, so I guess that the polish is quite the missing box.

The box I'm missing in Threema (unless I'm wrong of course) is the "not centralized" one. If for some reason (and admittedly, there aren't many realistic ones), Threema's servers/organisation are corrupted, the whole networks falls, right?

Re:Threema Goes Open Source by 0xy on Thursday September 03, 2020 @06:25PM (#24369585)
Element is significantly worse. Threema feels polished and actually works, meanwhile Element's UX is so obviously designed by security engineers that it's incomprehensible and useless.

There are still major, glaring and game-breaking bugs and UX quirks in Element even after a full frontend rewrite (that, by the way, made security UX significantly worse).

Re:Threema Goes Open Source by detaro on Thursday September 03, 2020 @10:57AM (#24364648)
It did these things years before Riot did for starters. It does less, but well-polished IMHO.
Re:Threema Goes Open Source by tweetle_beetle on Thursday September 03, 2020 @11:07AM (#24364750)
Right you are. I like to think that I'm fairly knowledgeable in this space, but Threema totally passed me by. Maybe it's more popular in german speaking communities (or I'm just more than I thought)?
Re:Threema Goes Open Source by gravitas on Thursday September 03, 2020 @11:32AM (#24365014)
Threema is a pay-to-play client on the App stores ($3 USD on Google Play, €4 on the Apple store), inhibiting it's adoption when the playing field is full of free clients. The inability to try-before-buy (regardless of technical merit) turns away casual users who might give it a shot "just because", myself included. (Theory: the world has been burnt a thousand times over by shitty ad-infested mobile apps and no longer trusts buying before trying. I sure don't.)
Re:Threema Goes Open Source by detaro on Thursday September 03, 2020 @11:49AM (#24365199)
And of course, the world has been burned by shitty ad-infested apps because nobody wants to pay for apps... (not that I necessarily disagree with you - I only got Threema because of a trustworthy recommendation)
Re:Threema Goes Open Source by gravitas on Thursday September 03, 2020 @12:17PM (#24365567)
nod I have had others tell me Threema is good, but it's a "walled garden" until now; Signal has won over hearts and minds by being FOSS and having no cost-based barrier to entry even for casual users. As a FOSS advocate I went with Whisper from the start and recommend Signal to everyone (with a fairly high take rate, non tech worker friends and neighbors) with a simple text link to install and saying something like "it's free and encrypted so nobody can see us talk." (KISS explanation)

(this is a US-centric comment, as phone numbers are rather static here; unlike other countries, not having a number isn't really how it works for most people on the big 4 carriers and their secondary MVNOs)

Re:Threema Goes Open Source by kabacha on Wednesday September 09, 2020 @02:49AM (#24418014)
The world has also been burned by paying for apps that turn out to be actually shitty and-or ad-infested.

48hour refunds on google play should have addressed this conundrum but it seems people just aren't aware of it :(

Re:Threema Goes Open Source by kenniskrag on Thursday September 03, 2020 @04:14PM (#24368365)
You can get a refund if you go to the play store and use the refund mechanism within a timeframe.
Re:Threema Goes Open Source by gravitas on Friday September 04, 2020 @09:07AM (#24374554)
Technically true and only easy if done within the first 2 hours, after that it's cumbersome (requires a desktop browser to go into order history). I will posit that it takes longer than 48 hours to decide if you want to continue using a chat/messaging app - the dynamics require multiple live humans to interact on their timescales, it's not just playing a game or whatnot on your own.
Re:Threema Goes Open Source by wasmitnetzen on Thursday September 03, 2020 @01:10PM (#24366181)
Yeah, my German-speaking + privacy-minded friends usually have it. I would estimate I can reach about 30% of my German contacts on Threema (if they have any IM at all).

But there's not a single non-German contact on there.

Re:Threema Goes Open Source by est31 on Thursday September 03, 2020 @11:07AM (#24364745)
Matrix is more of a chat protocol than a messaging app. I signed up once and had to agree to rules of behaviour and stuff like that. Threema is also more likely to be present on other people's phones.
Re:Threema Goes Open Source by AnonHP on Thursday September 03, 2020 @10:30AM (#24364430)
> I use Threema because it is the only messenger out there that is:

> a) always end to end encrypted (unlike Telegram)

> b) supports account creation without any phone number (unlike Signal)

Wire (wire.com) has had these for a long time with multi-device sync and also being open source.

Re:Threema Goes Open Source by est31 on Thursday September 03, 2020 @10:53AM (#24364610)
From what I saw, it doesn't meet c) though?

https://github.com/wireapp/wire-android/issues/1903

Re:Threema Goes Open Source by soal on Saturday September 05, 2020 @06:54PM (#24387491)
Looks like it does. On Android it has entry in menu "Maintaint connection to server" which creates persistent notification. Notifications worked on my un-googled phone.
Re:Threema Goes Open Source by Markoff on Thursday September 03, 2020 @04:26PM (#24368496)
I've had never problems with any battery drain with Signal on phone without gapps

much more annoying it's unreliable message delivery especially when your switch frequently between wifi and Mobile data, there are some other issues, but they killed it for me with PIN code nag

Re:Threema Goes Open Source by rglullis on Thursday September 03, 2020 @10:23AM (#24364351)
Are they opening up their servers as well? If I can not self host it may be as well as closed.
Re:Threema Goes Open Source by ramshorns on Thursday September 03, 2020 @01:51PM (#24366627)
If the client app is open source and the messaging is end-to-end encrypted, I would say it's a lot better than being completely closed. The encryption, which you should now be able to verify, means you don't have to trust the server with your message data.

Though, sure, it would be better for the server software to be open source and rehostable too.

Re:Threema Goes Open Source by est31 on Thursday September 03, 2020 @11:16AM (#24364845)
IDK for a messaging app it's not that important to me, because the main value it provides is that service itself to which my network is connected.

Also, the hardest part of such apps is the client component, not the server component. If need arises it shouldn't be hard to build one compatible to the clients.

Re:Threema Goes Open Source by yoavm on Thursday September 03, 2020 @10:48AM (#24364553)
It looks like they're open sourcing the apps only.