matrix-doc VS matrix-rust-sdk

There is a "read the QR code visible on the other user's device" method for verifying (technical stuff).

This is a great example of why key-sharing exists today... and why it shouldn't. In theory, you should be able to pick up and old client and decrypt new messages and history on it absolutely fine. However, in practice, Matrix's E2EE publishes 100 one-time keys (OTKs) on your server to let other devices establish secure 1:1 channels with you if you're offline - and if you go offline and that pool of OTKs exhausts, then new sessions won't get set up and you won't receive keys for new messages... giving the misbehaviour you're seeing.

Now, you're right that key-sharing is a useful way to fudge around that failure mode.

But an even better way to fix it would be to find a way to stop the OTK pool exhausting - and that's precisely what MSC2732 is: https://github.com/uhoreg/matrix-doc/blob/fallback_keys/prop.... This provides a last-ditch key which can be used to set up 1:1 sessions even if you run out of OTKs, which is marginally inferior to using a different OTK every time, but in practice really isn't a disaster (see the MSC for details).

However, fallback keys are relatively new and aren't implemented on all clients yet (matrix-js-sdk has them, but matrix-ios-sdk is implementing this coincidentally this week)... and so until they land, we still need keyshare requests to paper over this limitation.

But in future, hopefully it will be almost unheard-of to need a keyshare request, and we can change them to be an entirely manual or out-of-hand mechanism of some kind, and avoid classes of bugs like the vuln in question here in future.

Yep, a good example is the element X rewrite

They use Jetpack on Android

https://github.com/vector-im/element-x-android

And SwiftUI on iOS

https://github.com/vector-im/element-x-ios

But both use the same underlying Matrix Rust SDK

https://github.com/matrix-org/matrix-rust-sdk

So they share the core part of the app between platforms, but everything user facing is native

The one place eyebal is already being used is matrix-rust-sdk, mostly for bits of the API that act as a model for specific UI parts in apps built on top of it. A part of those APIs is also using observable vectors from eyeball-im, which I didn't mention initially because it's not as well-documented and polished.

Hello everyone, I am finally making it to all of the great talks about Matrix from FOSDEM 23, and one thing that seemed like an obvious thing that could be built on some of the new projects works (matrix-rich-text-editor, matrix-rust-sdk) is a collaborative (multi-user, live edits) document tool built ontop of rust. That said, I haven't seen any project doing this yet. Does anyone know of one?

Another important piece of the ecosystem for which Rust was used is the SDK. This new SDK was used to write the newest mobile client - Element X. The current Element client will also see its cryptography implementation being changed from Javascript to Rust, this was also made possible by the new Rust based SDK.

Let's say I'll switch as soon as they start using Sanakirja. They're partially right in their analysis of Sanakirja, but their comments are more about the lack of expressiveness of the unsafe keyword in Rust than about Sanakirja itself. I'm preparing a blog post about my dream version of unsafe.

>Well I care, that does not mean that you have to care.

The point I'm making is that the protocol being implement-able by yourself or grabbing a lib from someone else is moot, since you will 9 times out of 10 use a library.

>Again, look at the lack of client diversity for Matrix and tell me that you do not think that there is at least some correlation in terms of the complexity of the protocol.

The problem is not client diversity for Matrix - there's plenty of them. The problem is that Matrix is more than displaying a log on a screen, and most of the clients are frankly abysmal and could use a trained UI/UX owner.

>last I checked it meant using either Python or Go

The Rust SDK has worked well for me, although I can't state how close it is to Python or Go's libs. That said, I know I'm certainly not the only one using it.

The Rust lib could be wrapped into other languages (e.g, Ruby) if there's not a good SDK for that language. I don't really consider this to be an issue, especially considering the Rust SDK is maintained by the Matrix org themselves.

https://github.com/matrix-org/matrix-rust-sdk

>Add to this that the more mandatory features you have and keep adding

Don't maintain your own bespoke library and you won't have to. :)

>But I am not going to behave as if images, reactions, code blocks, threads, end-to-end encryption, voice calls, video calls, etc. do not come at a cost.

They do come at a cost, but that's the price of admission for what people expect from modern chat systems. I'd rather live in 2022 than 2004, and I grew up on IRC.

I'm not entirely sure what I plan to use Rust with at the moment, however my first project so far has been to write a Matrix bot using the matrix-rust-sdk library :)

Just for everyone else reading, the modern Matrix Rust stack referred to here is the matrix-rust-sdk: https://github.com/matrix-org/matrix-rust-sdk

The current way we're approaching this is to split the reference E2EE implementation into its own rust crate (https://github.com/matrix-org/matrix-rust-sdk/tree/master/ma...) which can be used with any SDK (e.g. we're almost finished embedding it into the Kotlin matrix-android-sdk2 client)

Separately, there's also the overall matrix-rust-sdk https://github.com/matrix-org/matrix-rust-sdk for clients to use as a "full fat" Matrix client SDK - as used by Fractal Next (https://gitlab.gnome.org/GNOME/fractal/-/tree/fractal-next) etc. We might end up using this in Element too in future (especially in Element iOS, where a Swift UI + matrix-rust-sdk backend could be quite a cute next generation architecture).

So while the first generation reference Matrix SDKs (matrix-js-sdk, matrix-ios-sdk and matrix-android-sdk) were completely independent implementations, each with their own bugs and increased audit surface, we're hoping that matrix-rust-sdk will simplify this a lot in future.