In what way is the comment misleading? While "Telegram" might refer to "the Telegram app" or "the Telegram service", when talking about open-source, it nearly always refers to the service. Of the two, the source of the central server is arguably much more important, since it's possible to at least track if the app tries to exfiltrate any data.

The source of the central server is useless since if they release it there is no way to prove they are running the same software on their servers.

Signal has a fascinating blog post from 2017 about how to use Intel's Software Guard Extensions (SGX) to actually let clients confirm that the software they're communicating with is the exact version they expect it to be.

https://signal.org/blog/private-contact-discovery/

SGX is definitely not bulletproof (https://medium.com/@maniacbolts/signal-increases-their-relia...), but it exists to do exactly this job, and Signal is using it.

The source isn't "useless", it allows you to run your own server.

Yeah, and then you need to modify the client to use that server, have everyone you communicate with install that client, and also not brand it as "Signal" because it has nothing to do with the Signal network anymore, and you can't communicate with "regular" Signal users.

So, from the point of view of anyone using the Signal service, the utility of the source is near-useless.

in this case, shouldn't the client code be enough to show that bona fide E2E is happening?

...except Telegram X, their alternative Android client.

> IMHO the only good argument against Telegram is that direct messages don't use end-to-end encryption by default.

I'd add two more:

1. End-to-end encryption being device-specific. Example: if you start a secret chat from your phone, you can't view it on your other devices. Other end-to-end encrypted solutions don't have this drawback.

2. End-to-end encryption being available only in one-to-one communications. Take this with a grain of salt, but I don't think it's available at all in group chats and channels.

taken individually, these all seem like minor nitpicks. but together, they make for a pretty high-friction E2E experience on telegram. the first time I try to have a "secret chat" with someone, it's often the first time they realize that telegram isn't E2E by default or that it even has that feature! I have to wonder about the design decisions made here. it seems pretty obvious that the combination of limitations is going to result in the vast majority of messages not being E2E. in practice, "secret chat" on telegram is only worth the trouble when both participants understand they are doing something shady.

For me device-limited E2E is actually a feature as I'm sure that no kind of weird sync stuff will leak my data from the device.

Also, E2E chats are not available on the desktop version of Telegram.

Telegram X is made by a different unofficial dev. Telegram has an open API. You can build your own clients.

It's published by Telegram LLC on Google Play. Can't be more official than Telegram itself distributing it.

Telegram's official dev account is 'Telegram FZ-LLC'.

https://play.google.com/store/apps/developer?id=Telegram+FZ-...

Telegram X is not the official version.It is an unofficial client for testing design and app speed. It has a different UI