Technology

The count of engineers means absolutely nothing.

This journalist writes with the same amount of confidence as ChatGPT.

Headline is terrible. The big red flags are that they don't do end-to-end encryption by default, the servers are in Dubai, and use a proprietary algorithm.

Last part should be clarified further. They didn't reinvent AES or anything. It's more like a protocol that puts together existing algorithms. It means they can use transport layers without TLS or anything else that wraps your messages in crypto otherwise.

https://core.telegram.org/mtproto

I'd still say this is a red flag. How you wrap encryption around your messages has several pits you can fall into. It's not as bad as reinventing AES, though.

There are good reasons to dislike Telegram, but having "just" 30 engineers is not one of them. Software development is not a chair factory, more people does not equal more or better quality work as much as 9 women won't give birth to a baby in a month.

Edit:

Galperin told TechCrunch. “‘Thirty engineers’ means that there is no one to fight legal requests, there is no infrastructure for dealing with abuse and content moderation issues.”

I don't think fighting legal requests and content moderation is an engineer's job. However, the article can't seem to get it straight whether it's 30 engineers, or 30 staff overall. In the latter case, the context changes dramatically and I don't have the knowledge to tell if 30 staff is enough to deal with legal issues. I would imagine that Telegram would need a small army of lawyers and content moderators for that. Again, not engineers, though.

Someone needs to make a browser extension that hides any article with "experts say" in the title

To be fair, in a large company, there is usually only about 30 people who are actually good and know what is going on, and hundred of others who are checking in trash.

The security software I maintained had one engineer.

Your move, sec nerds.

talking to carlson is a red flag

Engineer to lawyer ratio is the best indicator of how worried to be. What's the demoninator for telegram?

Summary:

• Telegram founder Pavel Durov claimed in an interview that the company only employs "about 30 engineers."
• Security experts say this is a major red flag for Telegram's cybersecurity, as it suggests the company lacks the resources to effectively secure its platform and fight off hackers.
• Telegram's chats are not end-to-end encrypted by default, unlike more secure messaging apps like Signal or WhatsApp. Users have to manually enable the "Secret Chat" feature to get end-to-end encryption.
• Telegram also uses its own proprietary encryption algorithm, which has raised concerns about its security.
• As a social media platform with nearly 1 billion users, Telegram is an attractive target for both criminal and government hackers, but it seems to have very limited staff dedicated to cybersecurity.
• Security experts have long warned that Telegram should not be considered a truly secure messaging app, and Durov's recent statement may indicate that the situation is worse than previously thought.

“Without end-to-end encryption, huge numbers of vulnerable targets, and servers located in the UAE? Seems like that would be a security nightmare,” Matthew Green, a cryptography expert at Johns Hopkins University, told TechCrunch. (Telegram spokesperson Remi Vaughn disputed this, saying it has no data centers in the UAE.)

good job Remi, that was the main concern lmao

telegram isn't e2e encrypted by default?! that seems like the major concern here.

i double checked the ui and i had to create a new secret chat to see any indicator of encryption presence or absence