MAX Messenger to Open Source Code and Launch Developer Program for Alternative Clients
The Russian messenger MAX is preparing to open its platform to external developers through a new initiative called the MAX Developer Program. The service will provide an API and grant access to the source code of the official client, enabling the creation of alternative applications for both corporate environments and specialized user scenarios.
Participation is limited to IT companies based in Russia and friendly countries. Applicants must prove experience in delivering large-scale IT projects and demonstrate compliance with security standards. Selected developers are required to follow secure development practices, implement strong encryption, and pass independent code audits to ensure protection of user data and infrastructure.
Approved participants will receive technical documentation, the design system, and the full source code of the official MAX client. They will also obtain access tokens for platform integration and gain access to pre-built mechanisms for user registration and fraud prevention, eliminating the need to develop these components independently.
While interface customization and new usage scenarios are permitted, all third-party clients must strictly adhere to the API terms of use, particularly regarding security requirements. Applications for the program can be submitted through the dedicated portal at dev.max.ru, although the exact start date of the program has not been announced.
Related articles
Web Certificate Trust Chains and State Access Risks Explained Amid Russian Banking Sanctions
The article explains the hierarchical structure of web certificates used for site authentication and traffic encryption, starting from highly protected root certificates stored in air-gapped facilities with Shamir's secret sharing for key protection. Intermediate certificates extend the chain of trust down to leaf certificates deployed on websites. Russian banks have turned to certificates issued under the MinTsifry root after Western and Chinese CAs refused service due to sanctions. The piece highlights that any nation-state with access to a root private key, whether FSB, NSA, or others, could theoretically issue fraudulent certificates for any domain. It notes the limitations of the X.509 standard, which lacks native support for multi-CA signatures, and suggests that separate browsing environments or PGP-style web-of-trust models could mitigate risks. The author concludes that security is already reduced by reliance on any state-controlled CA and that the choice is ultimately which intelligence agency one prefers to trust.
InfoWatch Details ARMA Wall NGFW Development for Industrial Systems Under Russian Import Substitution Rules
InfoWatch has published the second part of its interview series describing the ongoing development of the ARMA Wall next-generation firewall for industrial control systems. The product prioritizes on-premise processing without cloud agents to meet strict customer security policies and certification requirements. Engineers combine proprietary detection feeds with external sources, including indicators from NKCKI, while maintaining hundreds of thousands of signatures without disabling legacy rules for older Siemens controllers. Migration support relies on manual pre-project audits rather than automated tools, and the company works closely with domestic SCADA vendors to embed NGFW capabilities inside long-lifecycle OT environments. ARMA Wall is positioned as a more flexible and cost-effective alternative to data diodes because it allows granular command-level filtering and can emulate one-way traffic when required. The solution is already deployed at Roscosmos subsidiary RKK Energia after full certification and categorization.
WhatsApp Developing AI Content Labeling Feature for Channel Admins to Meet EU Transparency Rules
WhatsApp, owned by Meta, is rolling out a new function that allows channel administrators to mark posts containing AI-generated or AI-edited media. The feature appears in the latest Android beta and stems directly from European Union requirements for transparency around artificial intelligence content. Administrators can long-press a message after publication and select an option to add an AI content label, which then displays a visible tag informing subscribers that the material was created or modified by neural network tools. The requirement applies specifically to images, videos, and other media files, while generated text remains exempt from mandatory labeling. WABetaInfo researchers spotted the change, noting that the label may become permanent once applied and that the rollout could initially target only jurisdictions with relevant legislation. Broader availability for iOS users and global deployment remain under consideration.
Developer Builds Decentralized Messenger to Navigate Russian Laws 149-FZ and 152-FZ
A solo developer has created a lightweight messenger called Gram using the $mol framework and HyperBaza technology, designed to operate without collecting personal data or requiring logins. The project specifically examines compliance with Russian Federal Laws 149-FZ and 152-FZ, which regulate instant messaging services and personal data processing. The application supports encrypted peer-to-peer messaging, group chats via registries, and proof-of-work spam protection, while running primarily offline with optional decentralized nodes. Because messages remain encrypted on servers and no user identification occurs, the developer argues that obligations under the laws do not apply to private or home use. Public nodes must be shut down to avoid legal requirements such as phone-based identification and six-month message storage. The full source code is available on GitHub, and the service can be forked for deployment outside Russian jurisdiction.