Beeper 宣佈新的手機號碼註冊方式,另外後續應該不會再更新了

Beeper 連續兩篇更新:「iMessage and Phone Registration Are Back - Kinda」、「Beeper - Moving Forward」。

第一篇提到新的手機號碼註冊方式,需要用舊的 iPhone 手機 jailbreak (iPhone 6iPhone X):

📱 Have an old iPhone (6/6s/SE1/7/8/X) and a Mac or Linux computer (Raspberry Pi works) - you’re in luck! Follow our instructions (takes only 10-15 minutes) to jailbreak your iPhone, install a Beeper tool to generate iMessage registration code, then update to the latest Beeper Mini app and enter your code. Phone number registration will now work! Leave the iPhone plugged into power, at home, connected to wifi.

從「How To - Register Phone Number With iMessage」可以看到是用 jailbreak 的方式取得對應的 token (code) 再丟進 Beeper Mini:

第二篇則是提到貓與老鼠的競賽中不太可能贏:

As much as we want to fight for what we believe is a fantastic product that really should exist, the truth is that we can’t win a cat-and-mouse game with the largest company on earth.

然後後續會把力氣放到新的 IM 開發:

In the new year, we’re shifting focus back to our long-term goal of building the best chat app on earth.

故事差不多就到這邊...?

Beeper Mini 恢復,並且先提供免費使用

前幾天提到「蘋果出手幹掉 Beeper Mini 了」,當天就有進度了,不過到了昨天官方的說明才出來:「Beeper Mini Is Back」,Hacerk News 上對應的討論在「Beeper Mini is back (beeper.com)」這邊可以看到。

目前的 iMessage 只剩下 e-mail 的部分,電話號碼的部分目前是掛的,看起來是想辦法繼續繞:

Phone number registration is not working yet. All users must now sign in with an AppleID. Messages will be sent and received via your email address rather than phone number. We’re currently working on a fix for this.

另外值得一提的是,這幾天 iOS 有推更新,但在「About the security content of iOS 17.2 and iPadOS 17.2」與「About the security content of iOS 16.7.3 and iPadOS 16.7.3」裡面沒看到跟 iMessage 有關的說明。(當然也有可能塞進去卻沒有講...)

所以基於現在的情況,他們決定先免費提供使用 (另外一方面是行銷操作,這樣會帶來更多安裝數量):

We’ve made Beeper free to use. Things have been a bit chaotic, and we’re not comfortable subjecting paying users to this. As soon as things stabilize (we hope they will), we’ll look at turning on subscriptions again. If you want to keep supporting us, feel free to leave the subscription on 🙂.

另外後面的這句話有帶出一些額外的訊息,提到他們有聯絡蘋果,但沒有從蘋果那邊收到任何消息,這也代表他們應該還沒收到 C&D 之類的要求:

Despite reaching out, we still have not heard anything directly from Apple.

貓與老鼠還在繼續玩...

話說隔壁棚 GoogleEpic 那邊的戰場可熱鬧了...

蘋果出手幹掉 Beeper Mini 了

前幾天在「Android 上與 Apple 生態系 iMessage 互通的 app」這篇提到的 Beeper Mini 被蘋果幹掉了:「Apple cuts off Beeper Mini’s access after launch of service that brought iMessage to Android」。

目前的 update 看起來要想辦法繞?

所以看起來蘋果的態度沒有要放,然後接下來應該會貓捉老鼠?不過蘋果的機器上面有硬體可以認證,真的把 iMessage 接上資料庫驗證的話應該就繞不過了...

Android 上與 Apple 生態系 iMessage 互通的 app

Hacker News 上兩篇相關的可以一起看,首先是 Beeper Mini,一套在 Android 上直接與 Apple 生態系 iMessage 相通的 app,而且不需要另外的 Apple 設備當作 Proxy:「Show HN: Beeper Mini – iMessage Client for Android (beeper.com)」。

另外先提一下,這是一套付費軟體 ($1.99/mo),考慮到這算是 reverse engineering 後的產品,不確定 Apple 會不會反制,要付錢使用的人心裡先有個底:

We currently offer a 7 day free trial, afterwards there is a $1.99 per month subscription.

另外一篇相關的是「iMessage, explained (jjtech.dev)」,原文是今年八月的文章,應該就是 Beeper Mini 那篇而被貼出來的關係,在「iMessage, explained」這裡。

裡面解釋了他自己實作 pypush 時怎麼處理 iMessage 的部分:

This blog post is going to be a cursory overview of the internals iMessage, as I’ve discovered during my work on pypush, an open source project that reimplements iMessage.

專案裡面有提到 Apple 在這邊有段 obfuscated code,由於只有註冊階段需要用到,他選擇直接跑環境起來執行,產生出對應的 data 後就不用再跑,也就省掉 reverse engineering 這塊功夫:

pypush currently uses the Unicorn CPU emulator and a custom MachO loader to load a framework from an old version of macOS, in order to call some obfuscated functions.

This is only necessary during initial registration, so theoretically you can register on one device, and then copy the config.json to another device that doesn't support the Unicorn emulator. Or you could switch out the emulator for another x86 emulator if you really wanted to.

另外一個先前的消息是 Apple 說要支援 RCS:「Apple announces that RCS support is coming to iPhone next year」,目前大家的猜測是跟歐盟一直在要求 Apple 開放 iMessage 有關。

Signal 的簡訊花費在 $6m/year

Signal 的「Privacy is Priceless, but Signal is Expensive」這篇 PR 稿裡面提到了各項支出,Hacker News 上的討論在「Privacy is priceless, but Signal is expensive (signal.org)」這邊可以翻到。

裡面可以看到目前的數字 (以 2023 年十一月推算):

Storage: $1.3 million dollars per year.
Servers: $2.9 million dollars per year.
Registration Fees: $6 million dollars per year.
Total Bandwidth: $2.8 million dollars per year.
Additional Services: $700,000 dollars per year.

Current Infrastructure Costs (as of November 2023): Approximately $14 million dollars per year.

我比較感興趣的有幾塊,一個是標題提到的簡訊,在「Registration Fees」這個段落的說明裡可以看到列了兩個項目,一個是下載 Signal 的費用,另外一個是簡訊 SMS 認證的費用:

Signal incurs expenses when people download Signal and sign up for an account, or when they re-register on a new device. We use third-party services to send a registration code via SMS or voice call in order to verify that the person in possession of a given phone number actually intended to sign up for a Signal account.

這邊有些要確認的,下載軟體的頻寬應該是包括在 Total Bandwidth... 而且推敲起來,金額應該不算大:

  • 手機上的應用應該是由 AppleApp StoreGooglePlay 平台提供,不需要 Signal 提供頻寬下載。
  • 桌面應用端的部分,無論是 Windows、Mac 還是 Linux 的平台,看起來是透過 updates.signal.org 下載,這個名稱目前是指到 Cloudflare 上面,透過 traceroute 看起來不是 premium account (HiNet 用戶是導去美西的 SFO 機房),也許是 Cloudflare 的贊助帳號?

所以我會先假設這邊 $6m/year 的費用應該都是 SMS,在後面這段看起來也有提出來:

The cost of these registration services for verifying phone numbers when people first install Signal, or when they re-register on a new device, currently averages around $6 million dollars per year.

另外會這麼高也是因為現在 SMS pumping 很流行,也就是攻擊者與電信商合作 (或是同一組人),透過假造大量的認證需求,讓 app 後面的公司需要付大量的簡訊費用:

另外一個感興趣的是頻寬的部分,裡面有提到有一個比較吃頻寬的項目,是處理不在通訊錄上面的通話或是視訊。這邊 Signal 為了避免 IP address 的洩漏,會避免直接讓兩邊接通,而是透過 relay 接通:

To take one example, Signal always routes end-to-end encrypted calls from people who aren’t in your contacts through a relay server that obscures IP address information.

光這部份大約是 20PB/year 的量,費用約 $1.7m/year (上面有提到整個頻寬費用約 $2.8m/year):

At current traffic levels, the amount of outbound bandwidth that is required to support Signal voice and video calls is around 20 petabytes per year (that’s 20 million gigabytes) which costs around $1.7 million dollars per year in bandwidth fees just for calling[.]

而最大的費用還是各種人事支出的部分 (i.e. 經濟規模還沒有大到反過來),佔 $19m/year:

In total, around 50 full-time employees currently work on Signal[.]

To sustain our ongoing development efforts, about half of Signal’s overall operating budget goes towards recruiting, compensating, and retaining the people who build and care for Signal. When benefits, HR services, taxes, recruiting, and salaries are included, this translates to around $19 million dollars per year.

在 Hacker News 上有人貼了「Signal Technology Foundation - Nonprofit Explorer - ProPublica」這個,這邊有申報資料可以翻,比 PR 稿上面細。

ISP 偽造出合法的 SSL certificate,對放在德國的 xmpp.ru 進行 MITM 監聽

標題有點複雜,先講一下 http-01 認證,這是目前 Let's Encrypt 上最常被使用的認證方式,是透過 HTTP 協定完成認證,你只要能回答 http://www.example.com/.well-known/acme-challenge/XXX 的內容就能過。

一般來說,這個 HTTP 位置只有這台伺服器的 owner 才有辦法提供,也就能確保不是任何人都可以申請。

但因為這邊走的是 HTTP,對於 ISP 這種比較特別的身分來說,他可以從中架設 HTTP 的 MITM Proxy 做到這件事情。

而有了合法的 SSL certificate 之後,中間的 MITM Proxy 就不只能聽 HTTP 了,還可以聽 HTTPS 的內容 (甚至修改內容)。

這次發生的事情就是在德國的 LinodeHetzner 機房內的服務,俄羅斯最大的 XMPP 服務 xmpp.ru 被搞出這件事情 (XMPP 是一個開放協定,不熟的話可以想像成類似 Line 或是 Telegram 的服務,但 XMPP 是開放協定,可以用自己喜歡的軟體連上):「Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service」。

他們在 Hetzner 的伺服器上有發現 network offline 的訊號:

[Tue Jul 18 12:58:29 2023] igb 0000:04:00.0 enp4s0: igb: enp4s0 NIC Link is Down
[Tue Jul 18 12:58:48 2023] igb 0000:04:00.0 enp4s0: igb: enp4s0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX

而在這個 network offline 的時間不久後 Let's Encrypt 發出了 xmpp.ru 與 jabber.ru 的 SSL certificate (crt.sh 上可以查到,在 99976947049997621208):

18 July 2023 issuing time is about the same when Hetzner server has lost network link for several seconds.

這些徵兆符合改接到 MITM Proxy 上的行為。

這次的事情很大條,因為這些伺服器是在德國,不是在俄羅斯... 事情才剛開始被報導出來,後續得繼續追蹤,而且應該也會促成新的機制被引入?

Slack 宣佈漲價

Slack 宣佈了漲價的計畫:「Everything you need to know about our first price change and plan updates」。

從今年九月開始漲價,Pro 的月費從 US$8 漲到 US$8.75 (+9.375%),年費從 US$80 漲到 US$87 (+8.75%):

On September 1, 2022, monthly Pro plans will increase from $8 USD to $8.75 USD per user per month, and annual Pro plans will increase from $6.67 USD to $7.25 USD per user per month (pricing for other countries is available here).

現有用戶有一次用原價 renew 一年的機會:

Current customers on an annual Pro plan can lock in the existing annual rate of $6.67 USD per user per month for another year by early-renewing the annual Pro plan before September 1.

看起來八月底得來刷一下了...

幾個其他 Teams 的替代方案 (但還是連到 Teams 伺服器)

這邊講的替代方案不是換掉 Teams,而是找其他的方法連上 Teams 伺服器,畢竟用 Teams 的人大多都沒得選...

在「Teams is killing my Mac every day (microsoft.com)」這邊看到的一些資料可以嘗試,裡面有很多抱怨 Teams 的問題,但還是有些人有給出一些 workaround。

大家主要遇到的問題除了 CPU 吃很兇以外,另外就是記憶體這塊。

一種方法是是用 Edge 瀏覽器的 extension 來跑,我本來想看看 Linux 上的 Brave 能不能裝,但沒有看到對應的安裝連結,大概是 Edge 限定:

If you don't want to use the Microsoft Teams app (which uses a lot of resources), you can:

1. Install the Microsoft Edge Web browser on your Mac

2. Log into https://teams.microsoft.com

3. Click ... > Apps > Install this site as an app

This will create an Edge app for Teams that uses almost no resources but has feature parity with the regular Microsoft Teams app.

We tell all of our students to do this, and it has solved all Microsoft Teams performance issues on student Macs (both Intel and Apple Silicon).

另外有人提到其實官方是有放 M1 的 preview 版本的,雖然不是正式版,但總是比 Intel 版本會好一些:

If you're running an Apple Silicon Mac you can get an early build of Teams osx-arm64 from the exploration build link listed here.[0]

I've been running a daily build for a few weeks and it's noticeably better than the Intel build on an M1 Pro. It launches in half the time and feels far more responsive (probably due to not needing to use the Rosetta JIT for Electron). That said it's still a daily "exploration" build so YMMV.

[0] https://raw.githubusercontent.com/ItzLevvie/MicrosoftTeams-msinternal/master/defconfig

據說會少吃一點點記憶體,就真的大概一點點:

Can confirm it is snappier on a M1 Macbook Pro and using *less* RAM, maybe about 10% less.

但據說這個 preview 版本在自我更新時會跳到 Intel 版本,還要再找一下 workaround 關掉自動更新:

How do you prevent it from automatically updating to the Intel version? I keep downloading the preview builds and they keep getting updated.

後面還有看到有人說他直接實體隔離,把這些肥滋滋的 app 跑在另外一台 Mac 上,然後透過 Universal Control 使用,大多數的情況下都夠用,真的有需要分享畫面時再跑在自己機器上,用完就可以關掉:

Thanks for the tip. I'll give this a try!

For work, I have to run Microsoft Teams, Slack, and Discord. Of those 3, Slack surprisingly uses the least amount of memory (~700 MB), and Teams uses the most (~1.5 GB). I dusted off an old Intel Mac (literally) and interact with it using Universal Control. It only runs those 3 chat apps + mail. It's turned out to be a great way to offload resource hogs and as an added benefit, it minimizes distractions. I'll occasionally glance at the dock to see if there are any notification badges, whereas on my main Mac, I'd feel compelled to deal with notifications immediately.

When I have to share my screen or focus on a conversation, I'll fire up one of those 3 apps on my main (M1) Mac and quit it when I'm done.

Universal Control still feels rough around the edges, but it has saved me from ditching my Macbook Air and shelling out for an M1 Macbook Pro. Sometimes there are issues with reconnecting to the Intel Mac, but it seems to resolve itself if I wait a bit or turn off/on wifi.

大家都在找方法 XDDD

找機會研究 Zulip...

Hacker News 上看到「Mattermost – open-source platform for secure collaboration (github.com/mattermost)」這篇,結果最高分的 thread 上面大家都在討論 Mattermost 的缺點,然後大家提到 Zulip 是個不錯的方案...

先前用過兩次 Mattermost,一次是獨立自己架起來的版本,另外一次是 bundle 在 GitLab 裡面的。後面這次用的時候有種濃濃的 copycat 的感覺 (在同公司的 Focalboard 也是類似的感覺),後來砍掉就沒繼續再看了。

從 Hacker News 上討論可以看到只有一部份 open source:

And not only that, Zulip is 100% FOSS, wherea Mattermost is Open Core, so the Open Source portion is missing key features.

來找機會架 Zulip 起來玩看看...

Telegram 推出 Premium 方案

Telegram 宣佈推出 Premium 了:「700 Million Users and Telegram Premium」。看了一下有點長度,就直接放 iThome 的報導:「Telegram正式推出付費訂閱服務Telegram Premium」。

更新 Telegram 後就會在 Settings 裡面看到 Premium 的設定可以選,然後看起來走 IAP,我自己是在台灣的 iOS 上面買,NT$160/mo,裡面提到的功能基本上都用不到 (大概只有 no ads),但還是買起來...