The Wire team's blog on its encrypted messenger, covering protocol design, security audits, open-sourcing clients and server, and engineering.
Commenters cite its independent audits to support Wire's security claims, while others question its Axolotl licensing terms and its relationship to Signal.
You're apologizing for a project that has repeatedly damaged user trust with excuses.
These are "valid" reasons for keeping the source code private for a year? By whose book? Yours? Certainly not by mine. I wouldn't let any other business abscond from its promise to keep open source open source in spirit and practice, why would I let Signal?
This is some underhanded, sneaky maneuvering I'm more used to seeing from the Amazons and the Facebooks of the world. These are not the actions of an ethically Good organization. And as has already been demonstrated by Moxie in his lust to power, he's more than capable of deviance. On Wire vs Signal:
"He claimed that we had copied his work and demanded that we either recreate it without looking at his code, or take a license from him and add his copyright header to our code. We explained that we have not copied his work. His behavior was concerning and went beyond a reasonable business exchange — he claimed to have recorded a phone call with me without my knowledge or consent, and he threatened to go public with information about alleged vulnerabilities in Wire’s implementation that he refused to identify." [1]
These are not the machinations of the crypto-idealist, scrappy underdog for justice we are painted by such publications as the New Yorker. This is some straight up cartoon villain twirling their moustache plotting.
So now I'm being sold on a business vision that was just so hot the public's eyes couldn't bear it? We're talking…
I agree that the open-source ability to audit is one of the strong points of foss and that's an allure to keep everyone honest. Look at Signal, ProtonMail, Telegram, and to a lesser extent WhatsApp, AWS and Zoom. Once things get increasingly proprietary, they tend to pull the curtain wider across the stage.
Network traffic - or rather lack thereof - could conceivably be a good place to start. Wireshark not showing you any tangible information when you're sniffing the data? You stand a good change of being positively encrypted, but that's only one end of the end-to-end.
There's an interesting research paper from the 1984 IEEE Symposium on Security and Privacy written by Dianne E. Britton entitled, "Formal Verification of a Secure Network with End-to-End Encryption" - the abstract being:
A formal specification and verification of a simple secure communications network using end-to-end encryption is presented. It is shown that all data sent over the network is encrypted and all heats on the network exchange messages only if they are authorized to do so. The network and its hosts are modelled by a set of concurrent processes that communicate via unidirectional buffers. Each process is viewed as a state machine. The specification has been formally verified using the commercially-available VERUS verification system.
I feel like this would at least illustrate the groundwork current systems have expanded on over the last twenty-odd years, but the paper is behind a research wall.…
I'm not a lawyer but my understanding is that copying semantics could still be argued as creating a derivative work. This is what e.g. Whisper Systems claimed before publishing an axolotl spec, that anyone implementing the spec was doing so by deducing the semantic meaning of a copyleft piece of software and thus was a derivative work of said copyleft piece of software. This meant that the resulting binary was covered under the copyleft license (GPLv3 in that case, but my understanding of EPL is similar) https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7
I don't know if Rich or the other Clojure copyright holders care enough to ever make trouble, but I'm pretty sure most companies with a decent legal team would think thrice before offering a piece of code built using Ferret
GCC has already solved the problem the other commenter you mention brings up with the runtime library exception https://www.gnu.org/licenses/gcc-exception-faq.html but I don't know if you can tack this on to the clojure-derived parts of ferret. I sure wish SFLC or someone was able to do legal counselling for new/small projects like this, I feel like a big reason people shy away from copyleft isn't the hippie dippie bullshit but because these interactions are impossible to reason about by laypersons
From this[1] answer on the IT Security StackExchange site:
> N+1Sec is a similar protocol [to multi-party OTR, which requires participants to be online at all times to renegotiate keying material] with some improvements. Note that these protocols have a lot of algorithmic complexity and tend to scale badly, especially when you add latency into the mix.
It's unclear to me, though I can hardly imagine it being the case, whether this protocol requires all participants to be online at all times. The quoted answer surely sounds like it has that drawback, which is why I never really considered it as an option (leaving the Signal Protocol with "server-side fan-out" as the only good option).
If it does not have that drawback, having another protocol is a great thing, assuming what Wire says is true regarding OpenWhisperSystems trying to get millions from them for implementing a supposedly open source protocol.[2]
[1] https://security.stackexchange.com/a/127331/10863
[2] https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7
The Mobile OS war can still be continued. Mozilla should join forces with Lineage OS instead of wasting time with their own. Do the embrace, extend, extinguish strategy with Android.
Secure messaging is also still a hot topic. Join forces with Signal or Wire or Matrix or XMPP. For example, Wire intends to open source their server code and enable federation [0].
Voice control requires some weight for an Open Source solution. Specifically, we could use something which does not rely on the internet. PocketSphinx is an ok foundation, but needs more work.
[0] https://medium.com/@wireapp/open-sourcing-wire-server-code-ef7866a731d5
Looks great, I was not aware they had open source client.
Given that they were forced to release their Axolotl (aka Signal protocol) under GPLv3+, they try to add some strange restrictions [2]:
"Additionally, if you choose to build an Open Source App, certain restrictions apply, as follows: a. You agree not to change the way the Open Source App connects and interacts with our servers ..."
As I understand I am free to ignore any additions to GPL.
[1] https://medium.com/@wireapp/axolotl-and-proteus-788519b186a7#.dmdxclai3
[2] https://github.com/wireapp/wire