from Hacker News

Telegram Bot Platform

by thiagoperes on 6/24/15, 6:15 PM with 90 comments

  • by gioi on 6/24/15, 7:15 PM

    Just yesterday I was trying to get a bot working on the TextSecure platform. A vastly disappointing experience: almost not existing libraries, sparse and incomplete documentation, unstable protocol breaking without any kind of notice (https://github.com/JavaJens/TextSecure/issues/6, for example). And still no way to register without a phone, which would be amazing for this kind of project: https://github.com/WhisperSystems/TextSecure/issues/1085

    I think Telegram is succeeding in what TextSecure is failing: attracting a widespread community of developers. This is only a confirmation, in my opinion.

    EDIT: and, by the way, while Telegram security is no good, I wonder why we cannot have both (security & developer-friendliness)

  • by sweis on 6/24/15, 11:13 PM

    I briefly looked at Telegram's crypto code a couple months ago. Here's a few funny things I spotted:

    Telegram's message format uses ambiguous padding, so they have to try all padding lengths when validating a message: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

    That loop leaks timing information, as does the "Utilities.arraysEquals" method it uses. I'm not sure if it opens up a timing attack, but it's suspect: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

    There is another spot where they pad with zero bytes without any authentication. This may leave room to mess with the protocol: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

    There are also some weird things throughout the code, like using SecureRandom.nextDouble() all over: https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/... https://github.com/DrKLO/Telegram/blob/master/TMessagesProj/...

  • by yagop on 6/24/15, 7:45 PM

    I've beeing developing this https://github.com/yagop/telegram-bot for a year. Currently most Telegram Bots uses my proyect for building bots.

    Now it's deprecated and I'm really sad about that.

  • by kh_hk on 6/24/15, 8:55 PM

    OT:

    Awesome, great, APIs are good.

    Know what's better? Open specifications and federated services. It's called XMPP and if it's not enough, then something better should be developed.

    Is this the replacement of SMS? Not sure what people would have thought at the time if they could not send SMS to other mobile carriers. It saddens me even more to see public institutions moving their SMS infrastructure to the new 'carriers'.

    Protocols are not a new thing. Let's not go back to the time were computers could not talk to each other.

  • by _jomo on 6/24/15, 8:07 PM

    This is nice, but I really wonder why they don't focus on more important things. For example this issue I opened over a year ago, asking them to use end-to-end encryption by default and for group chats: https://github.com/DrKLO/Telegram/issues/156

    Probably because features are more important than security, sigh.

  • by joeyspn on 6/24/15, 8:44 PM

    > Telegram is about freedom and openness – our code is open for everyone, as is our API.

    Open for usage I guess. It's a pity that the API (and server) source is still closed. The Bot Platform is a cool initiative anyways, so good luck!

  • by colordrops on 6/24/15, 8:55 PM

    Telegram is not truly open source. They utilize a pre-compiled library for the actual messaging code, as seen here:

    https://github.com/DrKLO/Telegram/tree/master/TMessagesProj/...

    They would like to have you believe otherwise through their PR efforts, but I wouldn't trust them simply on the fact that they claim they are open source when they are not, and it's not clear what's going on in that binary lib. If they never claimed to be open source in the first place, it would be a different story.

  • by gcmartinelli on 6/24/15, 9:46 PM

    I believe this an amazing move by Telegram. I firmly believe that open platforms tend to win in the long run.

    Whatsapp should take the hint and open up their platform for developers... Curiously I was thinking about building bot-based services on their platform (largest user base in my country), but basically gave up after seing how closed they are to any initiative like this. Felt even worse after reading things like this: https://twitter.com/gcmartinelli/status/605776036358291456

  • by daniel-levin on 6/24/15, 7:50 PM

    Telegram is really cool. I have long thought about what additions and modifications I could make to my mobile texting program. Now I have to convince all my friends to move from Whatsapp.

  • by scriptnull on 6/24/15, 8:10 PM

    Great news ! Check out Github bot for sure people . I am already in love ! This feature is making me remember my own simple telegram bot that helped me to convey 1000 Happy birthdays to my friend in 15 mins. https://gist.github.com/scriptnull/7877b404f33de2b7445a

  • by vijucat on 6/25/15, 3:59 AM

    I woke up one night with the idea that if WhatsApp allowed API integration, it would so awesome : you could message DHL or UPS with your waybill tracking number, and they could push updates to you.

    More interestingly, the WhatsApp text box then effectively becomes a REPL shell to a remote API : you could ask for stopping updates, updates only once a day, etc; If the remote server implements a DSL, you could do a LOT.

    The possibilities were endless and exciting.

    But I have a feeling WhatsApp / their new owner are going to just let the opportunity pass by. If anyone at FB is reading this : guys, Business integration with WhatsApp is where the next $250 billion is. That's how FB will get a permanent, maybe even irreversible, grip on mobile. Imagine every service business providing updates via WhatsApp by integrating with their backend.

  • by hobarrera on 6/29/15, 6:01 AM

    All the comments on this news item made me really want to try this out and see how it works.

    I downloaded and installed the desktop version. Created an account with my phone number (okay: if I ever lose my phone, I'll permanently lose access to my account!).

    I see how to add contacts. I need their phone number. I don't know my friend's numbers. We use facebook, xmpp, email, lots of shit, but nobody still relies on SMS nowadays, and my phonebook is literally under 10 entries long (and I'm sure mum and dad won't be using Telegram).

    This reliance on old networks really kills it for me. IMHO, linking an account to a device that can get stolen or lost is also something I'll never really understand.

  • by task_queue on 6/25/15, 3:29 AM

    Telegram is the company that ignores proven crypto standards, rolls their own crypto without any verification or audit, then offers a $200k bounty to "break" their crypto by requiring developers to work with an arm tied behind their back by reducing the types of attacks that could be made in the real world.

    Seems MTProto is the same as its always been

    https://news.ycombinator.com/item?id=6931457

    http://www.cryptofails.com/post/70546720222/telegrams-crypta...

  • by harryf on 6/24/15, 7:12 PM

  • by Cieplak on 6/24/15, 8:02 PM

    I really like that they embrace HATEOAS, e.g., "what can this bot do?", even though the API might not be strictly RESTful (they call it an "HTTP-based interface").

  • by wodenokoto on 6/25/15, 3:55 PM

    Can telegram be considered safe? I looked at eff's guide to secure chat earlier today and was quite confused that it seeming,y scores full marks and not-full marks.

    https://www.eff.org/secure-messaging-scorecard

  • by pbreit on 6/24/15, 9:01 PM

    I've always been surprised something like this never really got going. I think the issue here is that it needs to be on message platforms that people actually use (iMessage, WhatsApp, Gchat, etc). Is it really not possible to hook in to those platforms?

  • by orzfly on 6/24/15, 11:23 PM

    Create you own bot with Node.js! https://github.com/orzFly/node-telegram-bot

  • by DLion on 6/27/15, 9:58 AM

    I made a simple bot plugins based in Node.js. https://github.com/dlion/smagenBot

  • by thelad on 6/24/15, 9:13 PM

    I'm guessing this was inspired by IRC eggdrop bots? Seem awfully similar, just different comms mechanism

  • by ohitsdom on 6/24/15, 8:08 PM

    I don't have any experience with Telegram. Can anyone share how it compares with Slack?

  • by avens19 on 6/24/15, 7:12 PM

    This is great, nice work guys

  • by ommunist on 6/24/15, 10:22 PM

    PingBot for server health monitoring anyone? or we'll just spam chats with Elisa clones?