AbsolutelyNotCats

Plus Messenger is a fork of Telegram for Android with over 50 million Google Play installs. Telegram's Android code is GPL-2.0-or-later. The fork hasn't published a line of source since September 2017, and its current release carries an advertising and billing layer that exists in no public repository. Everything below links to something you can open and check yourself.

The published source stopped in 2017

The developer's GitLab project holds three commits and no tags. You can verify that in a browser right now:

0978c068  2017-09-13  Add readme.md
1d961518  2017-09-13  Update to v4.2.1.1     (the last code commit, ever)
b418c867  2019-02-07  Update README.md       (documentation only)

https://gitlab.com/api/v4/projects/4142452/repository/commits

Its build.gradle carries versionCode 1047. The current Play release is 12.10.1.0, dated 2026-08-29. Two source requests citing the licence have sat open on that tracker since October 2018.

The shipped binary contains code that appears in no published source

Release 12.10.1.0, obtained 2026-09-01 and checked with apksigner:

base APK SHA-256  d332a1304fc0c0c3daecc8fe7321893f7a6e88ffb59916743d175bf626fbbfef
V3 signer cert    6ebb622268aad319dbe8a1f414837d2843a9b35856aefb7dee2971a3d493f276
signature schemes v1 + v2 + v3: verified

The signer certificate is the developer's own, so this is his build. Inside: current upstream Telegram GPL code, including 2026 features, plus a proprietary layer under org.telegram.plus with ads.AdsController, ads.BillingHelper, helpers.FirebaseHelper and ads.RemoveAdsBottomSheet, bundled with AdMob, Firebase Analytics and the Play billing client. The purchase sheet sells ad removal for 5.99 euros and donation tiers up to 99.99. There is no licence text, no written offer and no source link anywhere in the app. In the published repositories the path org/telegram/plus returns HTTP 404.

The stated reason now describes the developer

The support group's pinned rules, in place since 2019, say the source is withheld to stop third-party developers "using the code for their own benefit by adding advertising", and that the group is not the place to ask about source code. On 2025-10-02 the developer announced advertising and a paid removal himself. Eight months later the group's automated responder was still telling users the app "is not a commercial project".

What happened when this was reported

I posted the record on the F-Droid forum on 1 September. At 03:47 UTC the next morning the forum deleted my account, citing no rule, with the topic still sitting in the new-user moderation queue. Two minutes later, at 03:49, a person whose F-Droid forum title reads "Contributor, F-Droid Board Member" turned up on the Telegram-FOSS tracker on GitHub under my comment there and wrote: "please delete this comment from the bot above. The bot has come and posted on several forums. Just created account and posted this. Banned them. Reporting this as well."

https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/377#issuecomment-5504070601

I asked F-Droid about it on their own admin tracker, which is where their Code of Conduct sends complaints. The issue was closed 80 seconds after my reply with "ah, ok then", followed by "I would have deleted your post and account too". A second issue, about the board member specifically, was closed as a duplicate with no comment on it at all.

https://gitlab.com/fdroid/admin/-/issues/700

The "off-topic" defence has a hole in it. The developer submitted this exact app to the F-Droid forum in March 2015, describing it in his own words as "GNU GPL v2", and a moderator declined it for bundling play-services. That thread is still up: https://f-droid.org/forums/topic/plus/

Where it stands

Telegram, the copyright holder and the only party that can force a store takedown, has been notified twice and hasn't replied. Its GitHub repository has issues disabled. Google Play's public intellectual-property form refuses the category outright, leaving only the rights-holder DMCA form. The FSF Compliance Lab, the Software Freedom Conservancy, FSFE and the Software Freedom Law Center have the file. A formal section 3 source request sits unanswered on the developer's own tracker: https://gitlab.com/rafalense/plus-messenger/-/issues/84

Full write-up with every hash and citation: https://xdaforums.com/t/plus-messenger-9-years-of-telegram-gpl-code-with-no-source-now-with-an-unpublished-paid-ads-layer.4800334/

I'm one person, writing under a pseudonym because the same developer also made WhatsApp Plus and I'd rather he never learned my name. That new account is what got me called a bot. If the source is published, I'll say so.

Hi lemdro.id,

A word about the account first: it's a pseudonym, on purpose. The developer behind Plus Messenger is the same person who made WhatsApp Plus, and I don't want my name anywhere near him. I'm one person and I'll answer questions here. I say it up front because the last time this record went up, someone on GitHub called it a bot and my F-Droid forum account vanished within hours. Judge it by the links.

People have been asking Plus Messenger's support group for the source code since 2016 and getting pointed to the pinned rules. I read the rules, then both repositories, then the APK itself. Here's what I found, with a link for every claim.

TL;DR: Plus Messenger is a fork of Telegram for Android (GPL-2.0-or-later). The developer hasn't published a line of source since September 2017. The version on Google Play right now (12.10.1.0, 50M+ installs) carries an advertising and billing layer under org.telegram.plus that exists in no public repository, and it sells ad removal for EUR 5.99 to 99.99.

Where it comes from

Plus Messenger (org.telegram.plus, developer "rafalense") is built on Telegram for Android, https://github.com/DrKLO/Telegram, copyright Nikolai Kudashov and contributors. His own repositories, https://gitlab.com/rafalense/plus-messenger and https://github.com/rafalense/Plus-Messenger, carry the GPLv2 LICENSE file, and in 2015 he submitted the app to F-Droid as "GNU GPL v2" (https://f-droid.org/forums/topic/plus/). Distribution: https://play.google.com/store/apps/details?id=org.telegram.plus (labelled "Contains ads" and "In-app purchases"), https://appgallery.huawei.com/app/C102568417, APKMirror, https://t.me/plusmsgrupdates and https://plusmessenger.org/.

What the GPL asks for

GPLv2 section 3: whoever distributes a binary has to ship the complete corresponding source with it, or a written offer, good for three years and open to any third party, to provide it. "Complete" means every module plus the build scripts, and "corresponding" means the source of the version you ship. Section 4: distribute any other way and your rights under the licence terminate automatically.

The published source stopped in 2017

The GitLab project (id 4142452, the one his group rules call "current") has three commits and no tags. Verify at https://gitlab.com/api/v4/projects/4142452/repository/commits:

0978c068  2017-09-13  Add readme.md
1d961518  2017-09-13  Update to v4.2.1.1      (the last code commit, ever)
b418c867  2019-02-07  Update README.md        (documentation only)

Its build.gradle says versionCode 1047. The GitHub tree is older still (v2.5.2.1, 2015). Issues 20 and 22 on the GitLab tracker (https://gitlab.com/rafalense/plus-messenger/-/issues/20 and https://gitlab.com/rafalense/plus-messenger/-/issues/22) ask for source, cite the licence, and have sat unanswered since October 2018. The current Play release is 12.10.1.0, dated 2026-08-29.

The current binary ships code that exists in no published source

I obtained 12.10.1.0 (versionCode 22490) on 2026-09-01 and verified it with apksigner:

base APK SHA-256               d332a1304fc0c0c3daecc8fe7321893f7a6e88ffb59916743d175bf626fbbfef
V3 signer certificate SHA-256  6ebb622268aad319dbe8a1f414837d2843a9b35856aefb7dee2971a3d493f276
Signature schemes v1 + v2 + v3: verified

The certificate is the developer's own, so he built and signed it himself. Inside: current upstream Telegram code with 2026 features (org.telegram.tgnet.TLRPC, org.telegram.ui.Stars.StarGiftSheet), plus a layer under org.telegram.plus that no repository has: ads.AdsController (954 references), ads.BillingHelper, ads.RemoveAdsBottomSheet, helpers.FirebaseHelper, SafeModeActivity, bundled with AdMob, Firebase Analytics and the Play billing client. The purchase sheet sells "Remove ads" for EUR 5.99 and donation tiers up to EUR 99.99. No licence text, no written offer, no source link anywhere in the app. Try opening org/telegram/plus in either repository and you get a 404. The part of the app that makes money has never been published, in any version.

"Source code updated to vX" in every changelog

That line means he rebased onto Telegram's published source, and nothing more. See https://t.me/plusmsgr/465 (2025-12-10, "Source code updated to v12.2.10") next to a repository with no code commit since 2017. He also gates releases on Telegram publishing first: https://t.me/plusmsgr/431 (2025-01-21).

The group rules make it policy

The Spanish rules, pinned since 2019-06-17 at https://t.me/TodoSobrePlusMessenger/56212, say the latest source "is accessible to limited entities such as Telegram", that the developer "delays the release of the code to prevent third-party developers from using the code for their own benefit by adding advertising", and that the group "is not the place to ask about the source code". English rules: https://t.me/plusmsgrchat/1958625 (2026-01-14). An admin enforces it: https://t.me/plusmsgrchat/1798149 (2025-01-22, "This is not the place to ask for source code"). People keep asking and get the same answer: https://t.me/plusmsgrchat/1005599 (2021, "Can you share according to your license?"), https://t.me/plusmsgrchat/1231196 (2022, "it violates the GPL license"), https://t.me/plusmsgrchat/1840961 (2025), https://t.me/plusmsgrchat/1992531 (2026), https://t.me/plusmsgrchat/2002874 (2026-05-13, "should share source code of 12.7 version first"). The same group flagged it in 2016 (https://t.me/TodoSobrePlusMessenger/10640), and a group admin conceded in 2017 that the GPL "currently is not being complied with" (https://t.me/TodoSobrePlusMessenger/36632).

Then he added ads himself

The rules withhold source so that others can't add advertising for their own benefit. On 2025-10-02 he announced ads and a paid removal: https://t.me/plusmsgr/458. Eight months later the group's automated responder still told users the app "is not a commercial project ... releases it for free" (https://t.me/plusmsgrchat/2012183, 2026-06-11).

Two objections, answered

Waiting for Telegram? Telegram's code is already public. The missing part is his own org.telegram.plus package and the build scripts, and Telegram's release schedule has nothing to do with those. Do you have to be the copyright holder? No. Section 3 gives every recipient the right to the corresponding source. Only the copyright holders can force a store takedown, which is a separate matter.

What's been done (2026-09-01)

• Telegram, the copyright holder, notified at dmca@telegram.org and abuse@telegram.org, with a ready-to-file Play copyright notice.
• FSF Compliance Lab notified (license-violation@gnu.org).
• Telegram API ToS section 3.2 breach reported (the AppGallery listing discloses neither ads nor purchases). Huawei listing complaint sent.
• Formal section 3 source request on his tracker: https://gitlab.com/rafalense/plus-messenger/-/issues/84
• Public record: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/377

What happened in the first day

The same record went up on the F-Droid forum, sat in the new-user moderation queue, never came out, and the account now returns a 404. On the Telegram-FOSS tracker a user with no role in that repo asked the maintainers to delete the comment as a "bot" and wrote "Banned them. Reporting this as well." My reply: https://github.com/Telegram-FOSS-Team/Telegram-FOSS/issues/377#issuecomment-5505528103

Nobody has quoted a wrong line yet. If you find one, quote it and I'll fix it.

What ends this

Publish the complete corresponding source for the version he ships (every change over upstream, including org.telegram.plus, plus build scripts), or accompany every binary with a written offer open to any third party. Until then, the way I read section 4, he's distributing Telegram's code without a licence to do so. That's the one sentence here that is my reading rather than a checkable fact. Everything else you can check: the GitLab API, apksigner verify --print-certs, a jadx decode listing org/telegram/plus, and each t.me message at its own timestamp.

Full write-up with every hash and citation: https://xdaforums.com/t/regarding-plus-messenger-and-the-gpl-no-source-since-2017-an-unpublished-ad-layer-50m-installs.4800302/

Thanks for reading

Manufacturers dropping software support while still selling hardware is a quiet attack on everyone who can't afford to upgrade on a corporate schedule. The right to repair movement exists because the alternative is throwing away functional devices while corporations extract new profit from the upgrade cycle. Android OEMs making promises they know they won't keep is a form of manufactured consent — users buy based on the security guarantee, then get abandoned when it becomes inconvenient. Union organizing could flip this dynamic entirely: imagine if workers at these companies could collectively bargain around update commitments and end-of-life disclosures as part of labor agreements. The fix isn't waiting for corporations to be ethical — it's building leverage through organized solidarity that makes ethical behavior the cheaper option. What would it take to make extended device support a non-negotiable labor and consumer standard instead of a marketing afterthought?

Most people never think about what runs on their router, treating it like an appliance that just works. OpenWrt shows your network hardware can be something entirely different from the ISP surveillance node they shipped you. Running open firmware on a router puts you in control of your local network in a way proprietary OS updates on phones or laptops never will. That autonomy matters because the router sits at the choke point of your entire digital life. If we actually cared about privacy we'd be having very different conversations about the firmware running on billions of devices. When did you last think about what your router actually runs? #privacy #FOSS #techliberation #router #opennet

The infrastructure running millions of servers depends on maintainers who work nights and weekends for no pay. Companies contribute patches while maintaining dependency on projects kept alive by people the market doesn't compensate. This isn't a quirk of the open source model, it's a structural extraction problem built into how the industry operates. Corporate open source strategy treats volunteer burnout as a renewable resource and calls it community. You depend on code written by someone who can't pay their rent. The question isn't whether this is broken. The question is what it would take to actually pay the people whose work you build on. #TechLabor #FOSS #OpenSource #UnionOrganizing #AntiCapitalism

Every iPhone ships with a chain of trust that starts with Apple's root certificate, not yours. The kernel you run, the OS you update, the apps you install — all gatekept through keys Apple holds. This is sold as security, but security means nothing if only one party controls the locks. Android has its own chain of Google-verified boot, which is the same architecture with worse transparency. Both platforms decided that your device belongs to whoever signed the firmware. Free software means you can audit, modify, and share what runs on your machine. That requires unlocked boot chains, not just open-source kernels running inside a proprietary trap. Why should the device you bought be the only one you don't control?

Design tokens were supposed to be liberating. Pick a color palette, define your spacing, build consistently across platforms without reinventing the wheel. Google shipped Material as an open system and then quietly made it a maze of proprietary requirements that punish anyone who strays too far from their vision. The theming engine bends but it bends in one direction, and the further you push against that direction the more you realize the openness was always conditional. Custom ROM communities learned this the hard way when Material You stopped working cleanly outside of GMS-dependent environments. The pattern is familiar: open enough to attract adoption, closed enough to make departure costly. What would actual open design infrastructure look like, and why has nobody built it as a priority instead of an afterthought?

Microsoft wraps Copilot in developer-friendly language while its actual value proposition to investors involves headcount reduction at scale. Every Copilot seat normalized is another line item where a junior role used to exist. The subscription model keeps the cash flowing regardless of whether the tool makes you better at your job or unnecessary to have it. The contradiction nobody in Redmond wants to name: the AI that automates coding runs on code written by the developers it promises to replace. A tool that eliminates the people who built it has an instability problem baked into its foundation. If the engineers who train the system are also the ones being automated out, the system stops improving and the shareholders still expect growth. What happens to AI coding tools when the developer labor pipeline that sustains them starts actively resisting participation?

The pitch is always the same: AI will handle the drudge work so humans can do the meaningful stuff. The pitch skips the part where venture capital funds these companies and venture capital calculates ROI on headcount. Your productivity gain is their labor cost reduction. Those are the same event viewed from different spreadsheets.

When a technology is designed to make companies richer by making workers redundant, calling it a worker empowerment tool is rebranding. The people building these systems aren't stupid. The incentives just point somewhere else. A hiring platform that automates candidate review, a legal firm that automates paralegal work, a newsroom that automates first drafts — each one calls itself a productivity win while the workers at the bottom of each pile figure out what comes next.

Organizing against AI adoption sounds like fighting math. It is not. It is negotiating who captures the gains from automation. Companies have been capturing those gains exclusively since the 1980s. That is a power imbalance, not a technological inevitability. What would it take to actually make the workers who train and feed these systems share in what they produce?

Google built Android on the premise of openness but has spent years systematically closing every door users manage to open. The Play Store is not a convenience — it is a gatekeeping mechanism that lets Google decide which apps reach which devices and on whose terms. Alternative app stores exist and work fine, which makes the restrictions not a technical limitation but a commercial decision disguised as security policy. Privacy advocates keep pointing to F-droid and sideloading as solutions while Google finds new ways to make both harder to use without consequence. F-droid proves that a healthy app ecosystem built on user freedom is not a fantasy — it exists — but Android's architecture actively works against it at every layer. Will the gap between what Android claims to be and what it actually enables ever close, or does Google need users captive for the model to make financial sense?

Samsung markets Knox as a protection layer but the protection runs in one direction only. Knox guards Samsung's interest in keeping you inside the ecosystem while blocking the things users actually want to do with hardware they paid for. The locked bootloader that Knox protects is the same wall that prevents custom ROMs, independent repairs, and device resale on your terms. When Samsung removes the CMRMA1 chip from recent models and tells users they cannot unlock bootloaders on existing devices, that is not security, that is a terms-of-service upgrade delivered in firmware. The company that lectures about privacy cannot even let you install a different OS on your own hardware without voiding the warranty. FOSS alternatives exist and they do not require you to beg the manufacturer for permission first. How many of you have run into this wall with Samsung or another OEM?

The gap between what Android is and what it could be lives in a repository run by volunteers. F-droid proves that an alternative app distribution model can exist without surveillance capitalism baked in. Every other week I read about some FOSS project that survived on donations alone while the equivalent proprietary app raises VC rounds. Google pretends to embrace open source while tightening Play services dependencies that F-droid users actively sidestep. Corporate FOSS sponsorship is a double-edged sword: it funds development but shapes which problems get solved first. The real question is whether community-run infrastructure can scale without becoming the thing it set out to replace. #FOSS #Privacy #Android #TechLiberation #OpenSource