Wire-android: Replace FCM-based notification system by SSE to allow inclusion of Wire into F-Droid repositories

Created on 4 Dec 2018 · 6Comments · Source: wireapp/wire-android

The problem

Wire positions itself as a privacy-conscious messaging service. The most secure and privacy-oriented repository is notGooglePlay but F-Droid. In a study titled 'Understanding the Security Management of Global Third-Party Android Marketplaces', F-Droid was ranked the most reliable and secure marketplace. I have decided - as many other privacy activists - to abandon the Google ecosystem altogether. Apps not offered on F-Droid are off the radar. This is a very unfortunate situation for Wire.

The Solution

As per request of @deanrobertcook and as suggested in #1835 Wire could replace FCM - which introduced a privacy nightmare with Google analytics which exposed Wire users to analytics they didn't consent to - by SSE and thus make Wire compatible for inclusion into the F-Droid repositories. Such a move has recently been made by the privacy-conscious e-mail provider Tutanota. You can read about it in 'How Tutanota replaced Google’s FCM with their own notification system'.

In addition to that, FCM introduces proprietary code - a contradiction to Wire's dedicated open source philosophy. And you should never trust a company which shifts trust to an untrustworthy company whose business model depends on user tracking such as Google. In order to restore trust, remove untrustworthy technology.

feature request

Source

baimafeima

👍32

Most helpful comment

I know, I just think that if you suggest a method using an abbreviation, you should shortly say what it means. You cannot expect everyone to click external links.

fungs on 5 Dec 2018

👍6 👎1

All 6 comments

What's SSE?

fungs on 5 Dec 2018

@fungs It is well explained in the linked blog post. ;)

ArchangeGabriel on 5 Dec 2018

I know, I just think that if you suggest a method using an abbreviation, you should shortly say what it means. You cannot expect everyone to click external links.

fungs on 5 Dec 2018

👍6 👎1

Indeed I was wondering what was SSE and hadn't yet read everything
https://f-droid.org/en/2018/09/03/replacing-gcm-in-tutanota.html

Replaced FCM with SSE

We settled on the SSE (Server Sent Events) because it seemed like a simple solution. By that I mean “easy to implement, easy to debug”. Debugging these types of things can be a major headache so one should not underestimate this factor. Another argument in favour of SSE was relative power efficiency: We didn’t need upstream messages and a constant connection was not our goal.
So, what is SSE?

SSE is a web API which allows a server to send events to the connected clients. It is a relatively old API which is, in my opinion, underused. I’ve never heard about SSE before looking at the federated network Mastodon: They use SSE for real-time timeline updates, and it is working great.

The protocol itself is very simple and resembles good old polling: The client opens a connection, and the server keeps it open. The difference from classical polling is that we keep this connection open for multiple events. The server can send events and data messages; they are just separated by new lines. So the only thing the client needs to do is to open a connection with big timeout and read the stream in a loop.

SSE fits our needs better than WebSocket would (it is cheaper and converges faster, because it’s not duplex). We’ve seen multiple chat apps trying using WebSocket for push notifications and it didn’t seem power efficient.

We had some experience with WebSocket already, and we knew that firewalls don’t like keepalive connections. To solve this, we used the same workaround for SSE as we did for WebSocket: We send “heartbeat” empty messages every few minutes. We made this interval adjustable from the server side and randomised to not overwhelm the server.