News for hackers. Stuff that matters.
Re:Automattic invests in Matrix by vertex-four on Thursday May 21, 2020 @08:19AM (#23257510)
Every individual Matrix room is a multi-master, non-ACID database which uses its own data as security- and privacy-related configuration. Given how hard this is to get right, I'd really, really like to see Jepsen tests and a security audit done on more than the crypto aspect of Matrix.
Re:Automattic invests in Matrix by Arathorn on Thursday May 21, 2020 @08:46AM (#23257727)
There's a massive academic paper dedicated to Matrix's theoretical correctness (and the correctness of the Synapse implementation) going to be published in a few weeks. Wish it was already out, because it's spectacular :)

That said, nobody's done any Jepsen tests yet as far as we know, but we'd really welcome them!

Re:Automattic invests in Matrix by vertex-four on Thursday May 21, 2020 @08:51AM (#23257764)
Getting a Jepsen test done involves paying Aphyr for it, which I imagine you could do with this lovely new investment. Information here: https://jepsen.io/analyses
Re:Automattic invests in Matrix by Arathorn on Thursday May 21, 2020 @08:59AM (#23257813)
The first thing we earmarked the new investment for is doing a proper audit on the full stack - not just libolm (the e2ee ratchet implementation), but ideally an end-to-end audit of a typical best practice setup (e.g. E2EE-enabled registration/login/msg flows for Riot Web <-> Synapse <-> Riot Web), so we can then stamp a LTS label on it. We'll want to finish sorting teething problems on the new E2EE stuff though, as well as the scaling mess on Synapse first.

Sounds like Jepsen could certainly be part of that; we'll ping Aphyr when the time is right.

Re:Automattic invests in Matrix by cvwright on Thursday May 21, 2020 @01:26PM (#23261567)
That is great news! Please post a link to a preprint when you can.
Re:Automattic invests in Matrix by Well_hello on Saturday May 23, 2020 @10:29AM (#23283210)
looking forward to that