Android

Hi lemdro.id,

A word about the account first: it's a pseudonym, on purpose. The developer behind Plus Messenger is the same person who made WhatsApp Plus, and I don't want my name anywhere near him. I'm one person and I'll answer questions here. I say it up front because the last time this record went up, someone on GitHub called it a bot and my F-Droid forum account vanished within hours. Judge it by the links.

People have been asking Plus Messenger's support group for the source code since 2016 and getting pointed to the pinned rules. I read the rules, then both repositories, then the APK itself. Here's what I found, with a link for every claim.

TL;DR: Plus Messenger is a fork of Telegram for Android (GPL-2.0-or-later). The developer hasn't published a line of source since September 2017. The version on Google Play right now (12.10.1.0, 50M+ installs) carries an advertising and billing layer under org.telegram.plus that exists in no public repository, and it sells ad removal for EUR 5.99 to 99.99.

Where it comes from

Plus Messenger (org.telegram.plus, developer "rafalense") is built on Telegram for Android, https://github.com/DrKLO/Telegram, copyright Nikolai Kudashov and contributors. His own repositories, https://gitlab.com/rafalense/plus-messenger and https://github.com/rafalense/Plus-Messenger, carry the GPLv2 LICENSE file, and in 2015 he submitted the app to F-Droid as "GNU GPL v2" (https://f-droid.org/forums/topic/plus/). Distribution: https://play.google.com/store/apps/details?id=org.telegram.plus (labelled "Contains ads" and "In-app purchases"), https://appgallery.huawei.com/app/C102568417, APKMirror, https://t.me/plusmsgrupdates and https://plusmessenger.org/.

What the GPL asks for

GPLv2 section 3: whoever distributes a binary has to ship the complete corresponding source with it, or a written offer, good for three years and open to any third party, to provide it. "Complete" means every module plus the build scripts, and "corresponding" means the source of the version you ship. Section 4: distribute any other way and your rights under the licence terminate automatically.

The published source stopped in 2017

The GitLab project (id 4142452, the one his group rules call "current") has three commits and no tags. Verify at https://gitlab.com/api/v4/projects/4142452/repository/commits:

0978c068  2017-09-13  Add readme.md
1d961518  2017-09-13  Update to v4.2.1.1      (the last code commit, ever)
b418c867  2019-02-07  Update README.md        (documentation only)

Its build.gradle says versionCode 1047. The GitHub tree is older still (v2.5.2.1, 2015). Issues 20 and 22 on the GitLab tracker (https://gitlab.com/rafalense/plus-messenger/-/issues/20 and https://gitlab.com/rafalense/plus-messenger/-/issues/22) ask for source, cite the licence, and have sat unanswered since October 2018. The current Play release is 12.10.1.0, dated 2026-08-29.

The current binary ships code that exists in no published source

I obtained 12.10.1.0 (versionCode 22490) on 2026-09-01 and verified it with apksigner:

base APK SHA-256               d332a1304fc0c0c3daecc8fe7321893f7a6e88ffb59916743d175bf626fbbfef
V3 signer certificate SHA-256  6ebb622268aad319dbe8a1f414837d2843a9b35856aefb7dee2971a3d493f276
Signature schemes v1 + v2 + v3: verified

The certificate is the developer's own, so he built and signed it himself. Inside: current upstream Telegram code with 2026 features (org.telegram.tgnet.TLRPC, org.telegram.ui.Stars.StarGiftSheet), plus a layer under org.telegram.plus that no repository has: ads.AdsController (954 references), ads.BillingHelper, ads.RemoveAdsBottomSheet, helpers.FirebaseHelper, SafeModeActivity, bundled with AdMob, Firebase Analytics and the Play billing client. The purchase sheet sells "Remove ads" for EUR 5.99 and donation tiers up to EUR 99.99. No licence text, no written offer, no source link anywhere in the app. Try opening org/telegram/plus in either repository and you get a 404. The part of the app that makes money has never been published, in any version.

"Source code updated to vX" in every changelog

That line means he rebased onto Telegram's published source, and nothing more. See https://t.me/plusmsgr/465 (2025-12-10, "Source code updated to v12.2.10") next to a repository with no code commit since 2017. He also gates releases on Telegram publishing first: https://t.me/plusmsgr/431 (2025-01-21).

The group rules make it policy

The Spanish rules, pinned since 2019-06-17 at https://t.me/TodoSobrePlusMessenger/56212, say the latest source "is accessible to limited entities such as Telegram", that the developer "delays the release of the code to prevent third-party developers from using the code for their own benefit by adding advertising", and that the group "is not the place to ask about the source code". English rules: https://t.me/plusmsgrchat/1958625 (2026-01-14). An admin enforces it: https://t.me/plusmsgrchat/1798149 (2025-01-22, "This is not the place to ask for source code"). People keep asking and get the same answer: https://t.me/plusmsgrchat/1005599 (2021, "Can you share according to your license?"), https://t.me/plusmsgrchat/1231196 (2022, "it violates the GPL license"), https://t.me/plusmsgrchat/1840961 (2025), https://t.me/plusmsgrchat/1992531 (2026), https://t.me/plusmsgrchat/2002874 (2026-05-13, "should share source code of 12.7 version first"). The same group flagged it in 2016 (https://t.me/TodoSobrePlusMessenger/10640), and a group admin conceded in 2017 that the GPL "currently is not being complied with" (https://t.me/TodoSobrePlusMessenger/36632).

Then he added ads himself

The rules withhold source so that others can't add advertising for their own benefit. On 2025-10-02 he announced ads and a paid removal: https://t.me/plusmsgr/458. Eight months later the group's automated responder still told users the app "is not a commercial project ... releases it for free" (https://t.me/plusmsgrchat/2012183, 2026-06-11).

Two objections, answered

Waiting for Telegram? Telegram's code is already public. The missing part is his own org.telegram.plus package and the build scripts, and Telegram's release schedule has nothing to do with those. Do you have to be the copyright holder? No. Section 3 gives every recipient the right to the corresponding source. Only the copyright holders can force a store takedown, which is a separate matter.

What's been done (2026-09-01)

• Telegram, the copyright holder, notified at dmca@telegram.org and abuse@telegram.org, with a ready-to-file Play copyright notice.
• FSF Compliance Lab notified (license-violation@gnu.org).
• Telegram API ToS section 3.2 breach reported (the AppGallery listing discloses neither ads nor purchases). Huawei listing complaint sent.
• Formal section 3 source request on his tracker: https://gitlab.com/rafalense/plus-messenger/-/issues/84
• Public record: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/377

What happened in the first day

The same record went up on the F-Droid forum, sat in the new-user moderation queue, never came out, and the account now returns a 404. On the Telegram-FOSS tracker a user with no role in that repo asked the maintainers to delete the comment as a "bot" and wrote "Banned them. Reporting this as well." My reply: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/377#issuecomment-5505528103

Nobody has quoted a wrong line yet. If you find one, quote it and I'll fix it.

What ends this

Publish the complete corresponding source for the version he ships (every change over upstream, including org.telegram.plus, plus build scripts), or accompany every binary with a written offer open to any third party. Until then, the way I read section 4, he's distributing Telegram's code without a licence to do so. That's the one sentence here that is my reading rather than a checkable fact. Everything else you can check: the GitLab API, apksigner verify --print-certs, a jadx decode listing org/telegram/plus, and each t.me message at its own timestamp.

Full write-up with every hash and citation: https://xdaforums.com/t/regarding-plus-messenger-and-the-gpl-no-source-since-2017-an-unpublished-ad-layer-50m-installs.4800302/

Thanks for reading

We have a partial port of GrapheneOS to the Pixel 11 series after a week of work on it. We're unable to complete the port due to lack of support for ARM hardware memory tagging in software, firmware and near certainly hardware. It appears Google cut an important security feature to save money.

ARM hardware memory tagging (MTE) is used by GrapheneOS across the entire base OS including the kernel and every standard base OS process. It's only temporarily disabled for a few device-specific processes. It greatly improves protection against nearly all remote exploits and many local exploits.

Pixel 8 launched with hardware MTE support in October 2023. We integrated it into our hardened_malloc project and began using it across the OS later that month. Android and the Pixel OS never started using it by default. Android Advanced Protection Mode in Android 16 enables it for a few processes.

Apple's Memory Integrity Enforcement (MIE) is an always enabled feature on the iPhone 17. It's simply a high quality implementation of MTE using the latest standard extensions. It uses MTE in the most secure mode in the kernel and a large portion of userbase. They did a very good job integrating it.

Apple's MIE and Android 16+ AAPM don't use MTE for user installed apps unless those explicitly opt in. GrapheneOS enables it for more apps automatically and has a toggle for users to opt-in for every user installed app. There's a per-app toggle to opt-out for incompatible apps which is uncommon.

Neither iOS or Android encourage app developers to opt into MTE and other more aggressive security features used in the base OS. Apple's docs warn developers of performance and stability issues. Even Signal doesn't opt-in. Our approach enables forcing using MTE in the standard allocators regardless.

Pixel 11 does have security improvements including moving to post-quantum secure verified boot (ML-DSA) and replacing Samsung Shannon IMS with AOSP IMS. Titan M3 should significantly improve protection against data extraction in Before First Unlock state. It's too bad they ruined it by cutting MTE.

Pixel 11 series is a lot more expensive for an incremental improvement to the CPU, the same underpowered GPU and reduced RAM for the Pro base models. They finally caught up to the last generation of Qualcomm cellular radio. It's overpriced, the upgrades aren't impressive and losing MTE is appalling.

Compared to the Pixel 11, a Snapdragon 8 Elite Gen 5 has 40% higher single threaded CPU performance, 80% higher multi threaded performance, over 100% higher GPU performance and a far better cellular radio. It also finally has MTE. The next gen is what will be in the first Motorola with GrapheneOS.

Pixel 9a and earlier (including Nexus devices) were the Android Open Source Project reference devices. Pixel support was removed from AOSP with Android 16. It's now harder to support Pixels than many other devices and massive progress towards open source firmware and driver libraries was discarded.

Compared to the stock Pixel OS, GrapheneOS ships AOSP patches months earlier and Linux kernel patches many months earlier. However, we rely on them for firmware and most driver updates. We also want to move to new kernel branches earlier. These things can be improved with our Motorola partnership.

We strongly recommend against buying Pixel 11 devices. Pixel 8, 9 and 10 have much better overall security for GrapheneOS. Pixel 10 is cheaper with similar hardware and MTE. Pixel 11's Titan M3 should improve BFU security for users without a strong passphrase, but losing MTE craters AFU security.

We haven't determined what to do about this situation. It may be best for us to skip the Pixel 11 series devices. We can shift our focus entirely to the upcoming Motorola devices instead. Pixel 10a was really a 9th gen Pixel, so hopefully the Pixel 11a does the same with 10th gen and includes MTE.

Some people are cursed with motion sickness, which can make it impossible to read or use a phone in a moving vehicle without suffering waves of nausea. There’s a surprisingly simple trick that can make smartphones usable in such situations. Apple deployed it on the iPhone a couple of years ago, and now Google’s own version is finally coming (slowly) to Android.

Motion sickness is caused by a disagreement between what your inner ear senses and what your eyes see. If you’re looking at a book or a screen while in a car, the sensory mismatch can lead to a pretty unpleasant time. As part of iOS 18 in 2024, Apple released a feature called Motion Cues that places a network of moving dots on the screen to alleviate motion sickness, and it seems to work surprisingly well. Google’s version is similar, but it’s called Motion Assist.

Google began testing Motion Assist back in 2024, but it never expanded beyond an internal test until now. Android Authority reports Motion Assist is appearing on Pixel phones running Android 17, but there’s no app or update you can install to get the feature—it’s being delivered by Play Services as part of a staged rollout.

Note that F-Droid already has apps like this one: https://f-droid.org/packages/dev.davidv.motionsickness/