3 ms·
Every individual Matrix room is a multi-master, non-ACID database which uses its own data as security- and privacy-related configuration. Given how hard this is
by vertex-four 6y ago
Every individual Matrix room is a multi-master, non-ACID database which uses its own data as security- and privacy-related configuration. Given how hard this is to get right, I'd really, really like to see Jepsen tests and a security audit done on more than the crypto aspect of Matrix.
- Arathorn 6y agoThere's a massive academic paper dedicated to Matrix's theoretical correctness (and the correctness of the Synapse implementation) going to be published in a few weeks. Wish it was already out, because it's spectacular :) That said, nobody's done any Jepsen tests yet as far as we know, but we'd really welcome them!
- vertex-four 6y agoGetting a Jepsen test done involves paying Aphyr for it, which I imagine you could do with this lovely new investment. Information here: https://jepsen.io/analyses https://jepsen.io/analyses
- Arathorn 6y agoThe first thing we earmarked the new investment for is doing a proper audit on the full stack - not just libolm (the e2ee ratchet implementation), but ideally an end-to-end audit of a typical best practice setup (e.g. E2EE-enabled registration/login/msg flows for Riot Web <-> Synapse <-> Riot Web), so we can then stamp a LTS label on it. We'll want to finish sorting teething problems on the new E2EE stuff though, as well as the scaling mess on Synapse first. Sounds like Jepsen could certainly be part of that; we'll ping Aphyr when the time is right.
- cvwright 6y agoThat is great news! Please post a link to a preprint when you can.
- Well_hello 6y agolooking forward to that