Synapse: Disclosing CVE-2020-26890

23.11.2020 14:59 — Security Dan Callahan

Today we are disclosing CVE-2020-26890 / GHSA-4mp3-385r-v63f, a denial of service vulnerability affecting Synapse versions prior to 1.20.0. We strongly encourage all Synapse admins to upgrade as soon as possible. If you have not upgraded in a while, please refer to the upgrade notes, especially the latter portion of that document which covers any backwards incompatible changes which you may need to take into consideration.

As a best practice, we encourage Synapse admins to upgrade regularly, and either subscribe on GitHub or join for low-traffic notifications of new releases.

We extend our thanks to Denis Kasak for reporting this issue, earning a second entry in the Matrix Security Hall of Fame.

This Week in Matrix 2020-11-20

20.11.2020 00:00 — This Week in Matrix Ben Parsons

Matrix Live 🎙

Something different this week as we welcomed the community to submit their own demos!

  1. Oleg presents his Matrix home-automation setup, which uses Opsdroid, home-assistant and the reminder maubot.
  2. Nico gives presents a selection of small-ish new features in Nheko
  3. Timo gives a tour of the current state of the Conduit homeserver
  4. MTRNord (Marcel) presents the time-tracking bot used by Famedly
  5. Sorunome presents bootstrapping (creating cross-signing keys and online keybackup) in Fluffychat.
  6. Bala from Noteworthy presents Deploy a Matrix home server in 2 minutes with Noteworthy (set to royalty free music!)

Dept of Status of Matrix 🌡️

Bundeswehr deployment and app goes live

Matthew reported:

The Matrix deployment for the Bundeswehr (German Armed Forces) has gone live - details (in German) at and and further coverage at

Oleg (same fellow from the video - wow!) added:

Heise (German news portal) also quoted the news:

David Mehren linked to Element's own coverage:

Dept of Spec 📜

New spec platform

wbamberg said:


anoa reported:

Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at

MSC Status

Merged MSCs:

  • No MSCs were merged this week.

MSCs in Final Comment Period:

New MSCs:

Personally I would find that last one quite helpful!

Spec Core Team

In terms of Spec Core Team MSC focus for this week, we're sticking with the same three MSCs: MSC2844 (global versioning), MSC1544 (QR code verification) and MSC2790 (modal widgets). MSC2844 in particular I personally found quite interesting.


Dept of Servers 🏢

Dendrite / gomatrixserverlib

Dendrite is a next-generation homeserver written in Go

Neil Alexander said:

We started out this week by releasing Dendrite 0.3.0 and then ended the week with a bug-fix Dendrite 0.3.1 release.

I'd like to say thank you especially to our community contributors who have been adding new features and filling gaps!

Changes this week include:

  • Memory optimisation by reference passing, significantly reducing the number of allocations and duplications in memory

  • A concurrency bug has been fixed in the federation API that could cause Dendrite to crash

  • A hook API has been added for experimental MSCs, with an early implementation of MSC2836

  • Forgetting rooms is now supported (thanks to S7evinK)

  • The last seen timestamp and IP address are now updated automatically when calling /sync

  • The last seen timestamp and IP address are now reported in /_matrix/client/r0/devices (thanks to alexkursell)

  • An optional configuration option sync_api.real_ip_header has been added for specifying which HTTP header contains the real client IP address (for if Dendrite is running behind a reverse HTTP proxy)

  • Partial implementation of /_matrix/client/r0/admin/whois (thanks to DavidSpenler)

  • The error when registering a username with invalid characters has been corrected (thanks to bodqhrohro)

  • The -version command line flag has been added (thanks to S7evinK)

  • Backfilling should now work properly on rooms with world-readable history visibility (thanks to MayeulC)

  • Some more client event fields have been marked as omit-when-empty (thanks to S7evinK)

  • The script has been updated to work properly on all POSIX platforms (thanks to felix)

Spec compliance is unchanged, although some Synapse-specific tests have been removed and some new tests have been added:

  • Client-server APIs: 58%, same as last week

  • Server-server APIs: 83%, same as last week

As always, feel free to join us in for general Dendrite chat or for development discussion.


callahad offered:

We released Synapse 1.23.0 on Wednesday! Read all about it on the Matrix Blog. Otherwise, we'd like to highlight a few developments over the past week:

  • We're discussing a policy for ending support for old versions of Python and PostgreSQL. If you have opinions, please let us know on GitHub.

  • Our initial implementation of MSC2403: Add "knock" feature is undergoing review, and will likely land soon.

  • We've been looking at ways to improve the efficiency of state resolution, and Erik has managed to devise some algorithmic improvements that yield an order of magnitude speedup for a handful of pathologic cases. We hope to have a better idea of how this might work for real world workloads soon.

Lastly, we'd like to take this opportunity to remind you to please regularly upgrade your Synapse. Especially if you're not yet on 1.20.0, as we'll be disclosing a denial of service issue which affects older versions on Monday.


Tulir said:

mewmew wanted to use my fork of Synapse, so I made the changes there configurable (instead of hardcoding to my user ID) and even added a readme to list the features. It might also be useful for other people who want custom room IDs and other fun stuff.

The fork is available at

Homeserver Deployment 📥️


Ananace offered:

And just to be on time, I just pushed an updated tag and new version of my K8s container image and chart for Synapse 1.23.0


Dendrite is a next-generation homeserver written in Go

TR_SLimey offered:

I've updated the Dendrite ARM docker images to v0.3.0. They can be found at &

and later

I have once again updated the Docker ARM Dendrite images for version 0.3.1.

Dept of Bridges 🌉


mx-puppet-discord is a (double)puppeting and relay bridge for discord, based on mx-puppet-bridge

sorunome told us:

Support for receiving EDUs from matrix (typing, read indicators and presence) has been added. Protocol implementations can start using the new events, if they want to. Version 0.1.0 has been released along with this. You have to enable the de.sorunome.msc2409.push_ephemeral flag in your registration file


Added support for bridging typing and presence matrix->discord


Eric Eastwood offered:

The native Gitter <-> Matrix bridge is in production! 🚀🚀 We're only testing it out in a single room but feel free to come by and send a message 😀 <->

We also have edits from the Gitter side flowing to Matrix and soon to support edits from Matrix. You can track our full progress from the GitLab epic for the native Gitter <-> Matrix bridge.



Coma Grayce told us:

Hey, our team of colorful ponies proud to introduce you a new Matrix bridge to chats. It's powered by mx-puppet-bridge and so far supports almost all of core features people want to see, like replies, message edits and file attachments.

Project home:

Video introduction:

Dept of Clients 📱


Nheko is a desktop client using Qt, Boost.Asio and C++17. It supports E2EE (with the notable exception being device verification for now) and intends to be full featured and nice to look at

Nico ( announced:

  • Profiles should now open again on older versions of Qt.

  • I've been slowly rewriting the message are to be qml, to make it easier to do fancy styling. As a result emojis in the emoji-completer are now colorful and the avatars in the username completer now match the avatars used in the timeline. It also open up a few other improvements, like finally sending mentions as links instead of plain text.

  • We have now CI running on our self hosted gitlab instance. We will probably switch of the travis CI, once this is more battle tested. Repositories are now also automatically mirrored between gitlab and github.

  • Fixed a bug, where we tried to read the internal world group on your server instead of keeping that to ourself.


Nico ( offered:

I released 0.0.3 a few days ago bundling a few smaller improvements like redactions, copying messages and the ability to click on more links as well as some visual cleanups. Nothing radical, but also nothing breaking (I hope).



Neil said:

Delight (Rich vdH, Michael (t3chguy), Valere, Steve, Nique, Nad)

  • Improving usability

    • Last week

      • Observed user tests of people trying to use Element for the first time for personal and professional use cases
    • This week:

      • Began work on fixing several of the issues observed, like:

        • adding an invite people button to new rooms, so users can more easily add people;
        • changing copy to help people understand what DMs are
  • Spaces

    • Communities are coming back with a bang! Last week we said we renamed them to Spaces, and this week, we’ve started designing what MSC1772 would look like for users on Element, to start user testing next week.
  • Social login

    • To make authentication easier, we’ve started initial implementations of SSO in Element, exploring how homeservers & Matrix clients can support multiple SSO providers. Most of the work so far is captured in MSC2858.

VoIP (Dave, Brendan, Ismail, Francois, Simon, Nad)

  • Web

    • PR up for new look in-call UI, now looking at line 1 / 2 support
  • Mobile

    • Work ongoing to update both platforms to v1 VoIP
  • Design

    • Some tweaks as implementation is ongoing

Web Platform (Ryan)

  • Element Web 1.7.14-rc.1 is now available at, including:

    • Several tweaks and improvements to the room list filter

    • Improved registration based on user feedback

    • Improved invite / create DM flow

iOS Platform (Manu, Gil)

  • Last week:

    • The release has been blocked because a bug has been found in the end to end encryption module. It has been fixed but we want to fix damages it created on one time keys before releasing the new app version.

    • The new background sync service mechanism PR has been updated

    • We started to integrate tuist to stop to be annoyed with merge conflicts on the Xcode project file

  • This week:

    • Release!
    • Merge the background sync service mechanism PR and make more people test it

Android Platform (Benoit, Onuray)

  • Last week:

    • We’ve just merged a lot of PRs, to improve room creation form and fix some bugs.
    • SDK side, Dominaezzz is converting some of the Service API methods to coroutines, for a cleaner code. See for instance . 9 out of about 45 services have been migrated so far. We have about a 45 services in the SDK (!)
  • This week:

    • Release including a new way to invite friends to Matrix and to Element.


Bruno reported:

Released 0.1.30 with image uploads. There is also a new preference in the settings to scale sent images down.

Dept of SDKs and Frameworks 🧰


Ruma is a Rust project to create a comprehensive set of APIs for Matrix. Previously there was a Ruma homeserver project.

jplatte said:

Since our last update four weeks ago,

  • iinuwa created issues for all of the identity service api endpoints (w/ suggested module names!) 🎉

  • I updated lots of enumerated types to allow unspecced values, for future compatibility & robustness

  • Devin R made sure a custom Content-Type in responses overwrites the default rather than creating a duplicate header. #339

  • gnieto fixed a bunch of bugs in ruma-federation-api

  • Alejandro Domínguez added support for deserializing string power levels (requires the unstable-synapse-quirks feature because these events are invalid according to the spec but Synapse used to (?) accept them)

Ruby SDK

Ananace reported:

Just released version 2.2.0 of the Matrix Ruby SDK with the help of the community, with this release support for JRuby is improved - though still not perfect, in the higher-level abstraction direct messaging rooms are now exposed for all users - as well as all that the current user has, and the lower-level abstraction sees the addition of the CS API method to get an event context.

And just to reiterate; if you're using the gem - or have questions/comments about it. please do drop into the discussion room at

Dept of Bots 🤖

You can see demos of both bots in this section by watching Matrix Live \o/

home-assistant-bot v2.0.0 released

Oleg told us:

Opsdroid bot for triggering home-assistant automations.


  • ⚠️ Possible breaking change: change behavior how messages are matched

    • Before: messages were matched only if a message starts with !

    • In this version: the whole message is matched. This means in v2.0.0 this will work Hey, please !turnon light1

      • You can override this by using ^ in the config for. For example: regex: "^!turnon"
    • This allows one bot trigger another. See this TWIM video for details. 😉

  • Add howto for setting up wakeup-light with home-assistant

  • Update Opsdroid to v0.19.0

  • Update opsdroid-homeassistant to 0.1.8

  • Add debug config parameter to display messages in the chat, that the bot is getting but, maybe, is not processing/matching


Famedly Timetracking bot

MTRNord announced:

As seen in the video I am working at famedly on a bot to track our work hours.

Until this happens the video gives you a sneakpeak on the functions of that bot.

Current (implemented) functions

  • Tracking of time using !in and !out commands with forced usage of a description as well as ISO 8601 timestamps.

  • Verification if a time is logical based on the known data

  • Saving the times tracked inside of postgresql

  • Tracking durations using a !record command

  • Responding to only allowed users. (Including ignoring invites if a user is not allowed to use the bot.)

  • Using !delete to remove entries from the database as needed

Planned functions

  • Handling of timezones based on users

  • !stats command which prints you the tracked durations based on a predefined or custom range of time

  • CSV Export based on a defined range

  • !break command. Putting a break in between a record or a in/out combination.

  • Better handling of multiple !in commands

  • Improved responses

  • Reminders to call !out and to take breaks

Fell free to join us at . As soon as the repo gets opened up to public we will announce it in TWIM. Feel free to give suggestions or wishes in our room :)

Get it at:

Dept of Ping 🏓

Here we reveal, rank, and applaud the homeservers with the lowest ping, as measured by pingbot, a maubot that you can host on your own server. Join to experience the fun live, and to find out how to add YOUR server to the game.

RankHostnameMedian MS

That's all I know 🏁

See you next week, and be sure to stop by with your updates!

Synapse 1.23.0 released

18.11.2020 00:00 — Releases Dan Callahan

Reminder: On Monday, we will be announcing a denial of service vulnerability which affects Synapse versions prior to 1.20.0. If you have not upgraded recently, please do so.

Synapse 1.23.0 now available!

For Synapse admins, this release support generating structured logs via the standard logging configuration (#8607, #8685). This may require changing your synapse configuration; see the upgrade notes for more information.

We've also added many new Admin APIs, contributed by @dklimpel:

  • Add API to get information about uploaded media (#8647)
  • Add API for local user media statistics (#8700)
  • Make it possible to delete files that were not used for a defined time (#8519)
  • Split API for reported events into detail and list endpoints. This is a breaking change to #8217 which was introduced in Synapse v1.21.0. Those who already use this API should check their scripts (#8539)
  • Allow server admins to list users' notification pushers (#8610, #8689)

Lastly, Synapse 1.23.0 addresses some significant bugs, including regressions in the SQLite-to-PostgreSQL database porting script (#8729, #8730, #8755) and an issue which could prevent Synapse from recovering after losing its connection to its database (#8726). Synapse will also reject ACL modifications from clients which would otherwise cause a server to ban itself from a room (#8708).

Installation instructions are available on GitHub, as is the v1.23.0 release tag.

Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including @chagai95 and @dklimpel.

The full changelog for 1.23.0 is as follows:

Synapse 1.23.0 (2020-11-18)

This release changes the way structured logging is configured. See the upgrade notes for details.

Note: We are aware of a trivially exploitable denial of service vulnerability in versions of Synapse prior to 1.20.0. Complete details will be disclosed on Monday, November 23rd. If you have not upgraded recently, please do so.


  • Fix a dependency versioning bug in the Dockerfile that prevented Synapse from starting. (#8767)

Synapse 1.23.0rc1 (2020-11-13)


  • Add a push rule that highlights when a jitsi conference is created in a room. (#8286)
  • Add an admin api to delete a single file or files that were not used for a defined time from server. Contributed by @dklimpel. (#8519)
  • Split admin API for reported events (GET /_synapse/admin/v1/event_reports) into detail and list endpoints. This is a breaking change to #8217 which was introduced in Synapse v1.21.0. Those who already use this API should check their scripts. Contributed by @dklimpel. (#8539)
  • Support generating structured logs via the standard logging configuration. (#8607, #8685)
  • Add an admin API to allow server admins to list users' pushers. Contributed by @dklimpel. (#8610, #8689)
  • Add an admin API GET /_synapse/admin/v1/users/<user_id>/media to get information about uploaded media. Contributed by @dklimpel. (#8647)
  • Add an admin API for local user media statistics. Contributed by @dklimpel. (#8700)
  • Add displayname to Shared-Secret Registration for admins. (#8722)


  • Fix fetching of E2E cross signing keys over federation when only one of the master key and device signing key is cached already. (#8455)
  • Fix a bug where Synapse would blindly forward bad responses from federation to clients when retrieving profile information. (#8580)
  • Fix a bug where the account validity endpoint would silently fail if the user ID did not have an expiration time. It now returns a 400 error. (#8620)
  • Fix email notifications for invites without local state. (#8627)
  • Fix handling of invalid group IDs to return a 400 rather than log an exception and return a 500. (#8628)
  • Fix handling of User-Agent headers that are invalid UTF-8, which caused user agents of users to not get correctly recorded. (#8632)
  • Fix a bug in the joined_rooms admin API if the user has never joined any rooms. The bug was introduced, along with the API, in v1.21.0. (#8643)
  • Fix exception during handling multiple concurrent requests for remote media when using multiple media repositories. (#8682)
  • Fix bug that prevented Synapse from recovering after losing connection to the database. (#8726)
  • Fix bug where the /_synapse/admin/v1/send_server_notice API could send notices to non-notice rooms. (#8728)
  • Fix PostgreSQL port script fails when DB has no backfilled events. Broke in v1.21.0. (#8729)
  • Fix PostgreSQL port script to correctly handle foreign key constraints. Broke in v1.21.0. (#8730)
  • Fix PostgreSQL port script so that it can be run again after a failure. Broke in v1.21.0. (#8755)

Improved Documentation

  • Instructions for Azure AD in the OpenID Connect documentation. Contributed by peterk. (#8582)
  • Improve the sample configuration for single sign-on providers. (#8635)
  • Fix the filepath of Dex's example config and the link to Dex's Getting Started guide in the OpenID Connect docs. (#8657)
  • Note support for Python 3.9. (#8665)
  • Minor updates to docs on running tests. (#8666)
  • Interlink prometheus/grafana documentation. (#8667)
  • Notes on SSO logins and media_repository worker. (#8701)
  • Document experimental support for running multiple event persisters. (#8706)
  • Add information regarding the various sources of, and expected contributions to, Synapse's documentation to (#8714)
  • Migrate documentation docs/admin_api/event_reports to markdown. (#8742)
  • Add some helpful hints to the README for new Synapse developers. Contributed by @chagai95. (#8746)

Internal Changes

  • Optimise /createRoom with multiple invited users. (#8559)
  • Implement and use an @lru_cache decorator. (#8595)
  • Don't instantiate Requester directly. (#8614)
  • Type hints for RegistrationStore. (#8615)
  • Change schema to support access tokens belonging to one user but granting access to another. (#8616)
  • Remove unused OPTIONS handlers. (#8621)
  • Run mypy as part of the script. (#8633)
  • Correct Synapse's PyPI package name in the OpenID Connect installation instructions. (#8634)
  • Catch exceptions during initialization of password_providers. Contributed by Nicolai Søborg. (#8636)
  • Fix typos and spelling errors in the code. (#8639)
  • Reduce number of OpenTracing spans started. (#8640, #8668, #8670)
  • Add field total to device list in admin API. (#8644)
  • Add more type hints to the application services code. (#8655, #8693)
  • Tell Black to format code for Python 3.5. (#8664)
  • Don't pull event from DB when handling replication traffic. (#8669)
  • Abstract some invite-related code in preparation for landing knocking. (#8671, #8688)
  • Clarify representation of events in logfiles. (#8679)
  • Don't require hiredis package to be installed to run unit tests. (#8680)
  • Fix typing info on cache call signature to accept on_invalidate. (#8684)
  • Fail tests if they do not await coroutines. (#8690)
  • Improve start time by adding an index to e2e_cross_signing_keys.stream_id. (#8694)
  • Re-organize the structured logging code to separate the TCP transport handling from the JSON formatting. (#8697)
  • Use Python 3.8 in Docker images by default. (#8698)
  • Remove the "draft" status of the Room Details Admin API. (#8702)
  • Improve the error returned when a non-string displayname or avatar_url is used when updating a user's profile. (#8705)
  • Block attempts by clients to send server ACLs, or redactions of server ACLs, that would result in the local server being blocked from the room. (#8708)
  • Add metrics the allow the local sysadmin to track 3PID /requestToken requests. (#8712)
  • Consolidate duplicated lists of purged tables that are checked in tests. (#8713)
  • Add some mdui:UIInfo element examples for saml2_config in the homeserver config. (#8718)
  • Improve the error message returned when a remote server incorrectly sets the Content-Type header in response to a JSON request. (#8719)
  • Speed up repeated state resolutions on the same room by caching event ID to auth event ID lookups. (#8752)

Dendrite 0.3.0 released

16.11.2020 17:44 — Releases Matthew Hodgson

Hi all,

Heads up that we just cut another beta release of Dendrite - now at 0.3.0!

This is a really fun release given almost all the changes are contributed from the wider community - so huge thanks to S7evinK, MayeulC and felix!

The main new feature is full Read Receipt support thanks to S7evinK, which makes an enormous perceptual improvement when using Dendrite - so especial thanks are due there :)

So, if you're interested in helping us test, please spin up a copy from and let us know how it goes - and if you're already running one, now is an excellent time to upgrade!

Full changelog (including 0.2.1, which we forgot to blog about) follows:

Dendrite 0.3.0 (2020-11-16)


  • Read receipts (both inbound and outbound) are now supported (contributed by S7evinK)
  • Forgetting rooms is now supported (contributed by S7evinK)
  • The -version command line flag has been added (contributed by S7evinK)


  • User accounts that contain the = character can now be registered
  • Backfilling should now work properly on rooms with world-readable history visibility (contributed by MayeulC)
  • The gjson dependency has been updated for correct JSON integer ranges
  • Some more client event fields have been marked as omit-when-empty (contributed by S7evinK)
  • The script has been updated to work properly on all POSIX platforms (contributed by felix)

Dendrite 0.2.1 (2020-10-22)


  • Forward extremities are now calculated using only references from other extremities, rather than including outliers, which should fix cases where state can become corrupted (#1556)
  • Old state events will no longer be processed by the sync API as new, which should fix some cases where clients incorrectly believe they have joined or left rooms (#1548)
  • More SQLite database locking issues have been resolved in the latest events updater (#1554)
  • Internal HTTP API calls are now made using H2C (HTTP/2) in polylith mode, mitigating some potential head-of-line blocking issues (#1541)
  • Roomserver output events no longer incorrectly flag state rewrites (#1557)
  • Notification levels are now parsed correctly in power level events (gomatrixserverlib#228, contributed by Pestdoktor)
  • Invalid UTF-8 is now correctly rejected when making federation requests (gomatrixserverlib#229, contributed by Pestdoktor)

This Week in Matrix 2020-11-13

13.11.2020 00:00 — This Week in Matrix Ben Parsons

Matrix Live 🎙

This marks the start of Season 6 of Matrix Live (S06E01), a decision M+A apparently made on the fly just now. Incrementing a mostly-arbitrary counter... Imagine wielding that kind of raw power!

Dept of Status of Matrix 🌡️

IETF three-way bridge

Matthew reported:

The IETF have been continuing to experiment with new chat systems, and exists as a three-way bridge to discuss the initiative spanning Matrix, XMPP & Zulip. Really fun to see open chat converging like this :)

Dept of Science 🧪

Analysis of the Matrix Event Graph Replicated Data Type

Florian announced:

Fresh off the arXiv presses comes our

“Analysis of the Matrix Event Graph Replicated Data Type” preprint! This time, it is a deep dive into the data structure properties of the event graph:

What type of consistency guarantees does it provide, how many of the other homeservers you share a room with can be faulty or malicious without violating those guarantees (short answer: all of them!),

and how is it possible that a frayed-out event graph ever laces back to just a few current events, while there is a probability larger than zero for growth to arbitrarily high limits?

To shed light on those questions, we had a great cooperation between my Decentralized Systems and Network Services Research Group and Prof. Dr. Norbert Henze from the Institute of Stochastics.

While we are still in search of the right venue for peer-reviewed publication, we went for a preprint this time to share our results with the scientific and the Matrix community in a timely manner.


In this figure, k is the number of participating servers, U_n is the current width of the event graph.

For example, with a current width of U_n = 1000 events and k = 200 servers, we can expect that the width goes below E(U_{n+1}) < 600 events in just one step.*

Dept of Spec 📜


anoa reported:

Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at

MSC Status

Merged MSCs:

MSCs in Final Comment Period:

  • No MSCs are in FCP.

New MSCs:

Spec Core Team

In terms of Spec Core Team MSC focus for this week, MSC2744 has entered FCP. As such we're switching it out for MSC2844, which aims to define a global versioning system for all spec documents. Note that MSC2844 does not currently have FCP proposed. Its purpose for being in the focus this time around is for asking the team whether ideas proposed are plausible.

Thus this week's focus is MSC1544 (QR Code verification), MSC2790 (modal widgets) and MSC2844 (global versioning).

We've also started making use of a Github board to track the state of an MSC through the currently somewhat ambiguous process of putting up an MSC that is ready for review to starting FCP. You can find the board here: SCT Backlog.

Some explanation of the columns:

  • Awaiting SCT Input - These are MSCs that are deemed reviewable by the MSC author, and require review by a subsection of the Spec Core Team (usually one or two people) that are most familiar with the scope of Matrix that the MSC is relevant to.

  • Ready for FCP ticks - At least one individual from the Spec Core Team has signed off on the MSC. It is not time for others to give a cursory review - mainly sanity checking from the perspective of the part of Matrix that they work on. Note that fundamental flaws may still be found in this stage, requiring the MSC to be reworked.

  • In FCP - The MSC is in Final Comment Period, where everyone has a last chance to get their ideas in. This happens after most of the Spec Core Team have given their ticks from the previous column.

  • Done - These MSCs no longer need immediate attention by some portion of the Spec Core Team.

These definitions are all flexible as we continue to see what works for the limited resources we have available for review.

Do not be alarmed if a particular MSC is not on this board, we're placing things on here as deemed necessary, and more will certainly be added in time.


New spec platform

wbamberg reported:

Working on the new spec platform: this week we've been simplifying the toolchain that builds and renders the spec, to make spec authoring easier and faster.

Dept of Servers 🏢


callahad offered:

Note: We are aware of a trivially exploitable denial of service vulnerability in versions of Synapse prior to 1.20.0. Complete details will be disclosed on Monday, November 23rd. If you have not upgraded recently, please do so.

Happy RC day! The first release candidate of Synapse 1.23 is now available. For Synapse admins, we've added numerous new APIs thanks to contributions by @dklimpel, and we now support generating structured logs in a standard manner. The structured and drains logging options are now deprecated in Synapse's configuration.

Synapse 1.23.0rc1 also includes several significant bugfixes, especially around regressions in the SQLite-to-PostgreSQL database porting script, as well a fix to an issue that would prevent Synapse from recovering after losing its connection to the database. Synapse will also now reject modifications to access control lists which would otherwise result in a server blocking itself from a room. This is a particularly interesting case of unintended consequences in protocol design, and we hope to write more about it soon.

Next week should see the full release of 1.23, followed by a first implementation of MSC2403: Add "knock" feature landing in the development branch for 1.24. Look for more information in next week's edition of TWiM!


Dendrite is a next-generation homeserver written in Go

kegan said:

Neil is still working on P2P routing schemes and I am still working on Cerulean, but that doesn't mean nothing has happened this week! We've been busy reviewing PRs and have landed a big one this week:

  • Read receipts are now implemented (thanks @S7evinK!).

  • Usernames with = can now be created, in accordance with the spec.

Spec compliance has improved as a result:

  • Client-server APIs: 58%, up from 57% last week.

  • Server-server APIs: 83%, up from 81% last week.

Synapse Deployment 📥️


Pierre offered:

YunoHost is an operating system aiming for the simplest administration of a server, and therefore democratize self-hosting.

Synapse integration had been updated to 1.21.2 (1.22.1 available in branch testing)

Element Web integration had been updated to 1.7.12 (1.7.13 available in branch testing)

Dept of Clients 📱


Bruno said:

Hello all. Hydrogen gained emotes (/me) this week, together with file uploads and downloads! Also, encryption keys are setup while typing instead of after sending, so you should see less momentary "the sender hasn't sent the keys yet". Also a good number of bugs were solved. Next up: image uploads!

As expected, /me commands brought a chorus of:

now that you support commands, you must add the single most important command in any decent Matrix client

- tulir

Bruno got the idea pretty quickly:

/rainbow perhaps?


Nad announced:

Hello TWIM! From this week on we're changing how we're reporting updates on the Element clients. Each week, we'll include a section for cross-platform feature work the Element team is working on, and some sections for platform specific work too.

Spaces (previously known as Communities)

Communities are back! They've been renamed to Spaces, and on the Element team we've been busy exploring user experience and critical thinking for MSC1772, to allow users to organise rooms into useful groups.

Social Login

In an effort to reduce friction in authentication, we've been R&Ding how to allow homeservers & Matrix clients to support multiple SSO providers.. Most of the work so far is captured in MSC2858 and we're starting initial implementations in Element web next week.

VoIP: Voice & Video Calls

We've started foundational research, design and engineering to improve both the usability and stability of native matrix VoIP in Element. We've also started to look at how we can improve the continuity of the user experience between native Matrix calls and our current implementation of Jitsi.


We've been focusing on improving post-registration actions all round to make Element provide better prompts for first actions, and empty states for views on all platforms, with a multitude of fixes having landed on Element Web, iOS & Android in the last week. We've also started paid user testing to better understand specific pain points in the first time user experience, which we're looking to improve significantly in the coming weeks.

Web platform

v1.7.13 is now live! Which includes a bunch of fixes & improvements on VoIP.

Android platform

v1.0.10 is now available on the Play Store. We're also doing ongoing work to catch up with feature parity to Element Web, and Dominaezzz is migrating SDK APIs to suspend functions: no more MatrixCallback!

iOS platform

v1.1.0 is soon to be live on TestFlight for beta testers, and we'll soon be turning our attention to fixing end-to-end encryption regressions.


Nheko is a desktop client using Qt, Boost.Asio and C++17. It supports E2EE (with the notable exception being device verification for now) and intends to be full featured and nice to look at

Nico ( reported:

  • You can now see yourself too during a video call.

  • You can change the ringtone, as the default can be a bit annoying.

  • Avatars should now not look as pixelated in some weird edge cases.

  • You can now add text after a /shrug command.

That's all, thank you trilene and MayeulC for the contributions!

Dept of SDKs and Frameworks 🧰

matrix_app_service.ex (Elixir SDK)

pierre told us:

We've (finally) released a first version of matrix_app_service.ex, an Elixir library for the application service API (hex, GitLab)

uhoreg (known Elixir fan, asked):

that's cool. Do you have any projects that are using it?


I don't want to "sell" it before there's some kind of poc, but with a few friends we're trying to build a bridge for ActivityPub. we're using the library of the same name by the people behind CommonsPub, of which a lot of code comes from Pleroma, so the application service appears as an ActivityPub server. it's still the beginning, and I'm just starting to think about which information a bridge needs to keep (I guess sometime I'll ask Half-Shot a big list of questions 😁)

Today might be our highest-ever Pierre-ratio in TWIM!


Benedict announced:

A new release integrates an embedded h2 database into matrix-spring-boot-bot, which makes it a lot easier to write bots with persistency. You only need a few lines of code to write simple bots (e. g. a ping bot). I also changed a lot under the hood (e. g. using type-safe Matrix-Id-classes instead of Strings).


The matrix-sms-bridge now uses the h2 database from matrix-spring-boot-bot instead of neo4j, which makes it a lot more stable and fixes some bugs. We are using it in production with hundreds of target telephone numbers without problems. I also added an optional feature to use room aliases (e. g. #sms_4901234567:homeserver) to prevent multiple rooms with one target telephone number (which is still possible).

In a few weeks you can use this bridge with an old Android-Smartphone, which acts as an sms gateway with rest api.

Dept of Ops 🛠


This Ansible playbook is meant to easily let you run your own Matrix homeserver.

Slavi announced:

Thanks to Scott Crossen's work, matrix-docker-ansible-deploy can now manage Dynamic DNS using ddclient.

To learn more, follow our Dynamic DNS docs page.

Dept of Bots 🤖

New Matrix chat bot, Mozilla-focus first

bnjbvr announced:

I've written a small blog post about a Matrix chat bot I've developed with matrix-js-bot-sdk, it was started to address Mozilla specific features first, but then I've added a few other generally useful features too! Hope you'll like it and find it useful! is the room for discussion (thanks Davo)

Dept of Built on Matrix 🏗️, new social network getting Matrix integration

ahq said:

Hello Matrix friends. I've been asked to share this here. I'm currently building a platform for building communities. I'm focused on deeper matrix integration with communities, private messaging built on top of matrix, and custom domain support. Feel free to check out The matrix community is at, but I haven't had the time to post much.

We have communities ( ->

We have galleries ( -> We have publications ( ->

We have user pages ( ->

The UI is a little confusing now because we have longform articles ( and short social media posts (

I pretty much want all resources to have custom domain support, and matrix rooms for all communities, and nested communities. In the near future, I hope to have matrix servers for custom domains too. And of course, the source will also be open if folks want to host.

Right now, users on gurlic get a matrix account, and communities/galleries/publications get a room too, but i'm hoping to take some time to look at much deeper integration. Dendrite and hydrogen are great to build on top off...

Dept of Ping 🏓

Here we reveal, rank, and applaud the homeservers with the lowest ping, as measured by pingbot, a maubot that you can host on your own server. Join to experience the fun live, and to find out how to add YOUR server to the game.

RankHostnameMedian MS

That's all I know 🏁

See you next week, and be sure to stop by with your updates!

This Week in Matrix 2020-11-06

06.11.2020 00:00 — This Week in Matrix Ben Parsons

Matrix Live 🎙 Demos Week

Demos week is fun! Reminds me of walk-around-the-office-interrupting-people week, which we don't have any longer. :(

Dept of Status of Matrix 🌡

Open Tech Will Save Us #8 will take place next Wednesday, join us! Calendar event coming soon.

  • Muhammad Radwan, on behalf of Tactical Tech, will present their work on The Glass Room Misinformation Edition. What happens when we increasingly rely on social media and the web for nearly all our information? What information do we see, and what do we miss? How do we know if a picture or a tweet is genuine or truthful? And what can we do if we can’t be sure?
  • Popi from CHATONS will present the work done by CHATONS ("Collective of Alternative, Transparent, Open, Neutral and United Hosters") CHATONS has been initiated by Framasoft, in the wake of the success of its campaign "De-google-ify Internet". A CHATONS member pledges to propose fully FLOSS-based online services, in an ethical and united spirit.
  • Hubert|Uhoreg Chathi will present on the state of encryption in Matrix, and more broadly Why the PGP model is insufficient, what properties we want from encryption (e.g. why we want perfect forward secrecy), how the newer protocols (OTR, double-ratchet, megolm) give us some of the properties we want, and then what's coming in the future (MLS, and what that gives us)

Dept of Spec 📜

anoa said:

Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at

MSC Status

Merged MSCs:

  • No MSCs were merged this week.

MSCs in Final Comment Period:

New MSCs:

Spec Core Team

In terms of Spec Core Team MSC focus for this week, we're switching out MSC2765 (widget avatars) for MSC1544 (QR code verification), and keeping

MSC2774 (widget URL template param), and MSC2790 (modal widgets).


Dept of Servers 🏢


callahad offered:

Happy November from the Synapse team! As mentioned last week, we pushed a small v1.22.1 release last Friday which fixed two regressions:

  • Fix a bug where an appservice may not be forwarded events for a room it was recently invited to. Broke in v1.22.0. (#8676)

  • Fix Object of type frozendict is not JSON serializable exceptions when using third-party event rules. Broke in v1.22.0. (#8678)

If you haven't upgraded your Synapse in a while, please do.

A major focus of Synapse is being able to meet the performance and reliability needs of massive homeservers like If you're curious about how Synapse's architecture has evolved over the years to meet these scaling challenges, check our our blog post from Tuesday: How we fixed Synapse's scalability!

Lastly, we anticipate releasing 1.23.0 in the next fortnight; keep your eyes peeled for release candidates and let us know if you have any feedback. For a preview of what's coming, check out GitHub for the new commits that have landed on the develop branch since our last release.

PLUS Matthew said:

Synapse now horizontally scales across multiple python processes, as of 1.22: you can configure it so that events are no longer sent through the main proc, eliminating the single biggest bottleneck for large scale Synapse deployments. Read all about it at

Dendrite / gomatrixserverlib

Dendrite is a next-generation homeserver written in Go

Neil Alexander told us:

Things have been quiet for Dendrite over the last week as I have been working on Pinecone/P2P and Kegan has been working on threading.

That said, a couple of minor changes have been merged:

  • Forgetting rooms is now supported (thanks S7evinK!)

  • The gjson dependency has been updated for correct integer safe ranges

Spec compliance is the same as last week:

  • Client-server APIs: 57%

  • Server-server APIs: 81%

As always, feel free to join us in for general Dendrite chat or for development discussion.

Synapse Deployment 📥️


Pierre announced:

YunoHost is an operating system aiming for the simplest administration of a server, and therefore democratize self-hosting.

Synapse integration had been updated to 1.21.2 (1.22.1 available in branch testing)

Element Web integration had been updated to 1.7.9 (1.7.12 available in branch testing)

Dept of Bridges 🌉


Eric Eastwood told us:

Exciting visual progress this week with actual bridging between Gitter and Matrix utilizing the virtualUser feature,

we've been iterating on the past couple weeks. Check out the image with all of the user avatars and display name goodness to make both chats on Element and Gitter feel one in the same!

You can also check out the live demo in Matrix Live!


Dept of Clients 📱


Bruno reported:

As mentioned in the sync on Monday, I was mostly distracted from Hydrogen this week. (sorry Bruno -BP) I did release the picture lightbox on Monday, and yesterday managed to close 4 bugs. There's also a community PR for better usability and accessibility in the login screen (keep those coming!) and after some work to make encryption more robust, I hope to do a release with all those goodies tonight.

Check out the demos vid for more Hydrogen!


Alexandre Franke said:

Since a couple of weeks ago, we have merged a couple of branches that do a couple of things:

And here’s another nudge, calling for reviewers for that mega merge request for us to switch to matrix-rust-sdk.

Element for Android 1.0.10

benoit said:

Element for Android 1.0.10 has been released to the beta channel of the PlayStore. We will push it to prod if there is no major problem with it. Full release notes:

#1921 being fixed! ❤️


Manu offered:

This week, we came back to the background sync work to quickly display a notified message in the app. In parallel, we created a profiling tool at the SDK level to track performance like this one.

Element Web/Desktop

Neil enunciated:

We are working through some low hanging fruit around post registration, blank screen interaction prompts and toast tweaks. We are also experimenting with SSO for Meaning that Element will give the user the option of either username/password or SSO. Finally, we are continuing our VoIP efforts and nailing down the designs, checkout Matrix Live for all the details. Next week we'll carry on with post registration UX, VoIP improvements.

Dept of SDKs and Frameworks 🧰

Matrix SDK for Elixir

cognitive_tea reported:

Hi all! I think this is the right place to share this 🤞. I've been working on a Matrix SDK for Elixir over the last few months as a side project, it's very early days and it's currently just a bare-bones wrapper for the Client-Server API. I've also written the Elixir/Erlang bindings for Olm (currently missing group sessions) which should be added to the SDK soon. The repo can be found here: and the Elixir bindings for Olm are linked in the readme.

It is the right place! Thanks cognitive_tea :D

Asked if there were big plans for use of the project

Not as yet, though a few people have reached out to me already and are building on top of it. I started it as a way to get going with Matrix dev and as a fun side project. That being said, I think providing the tools to Matrix-enable Elixir apps might lead to some interesting things. If anyone has any precise ideas on how they would want to integrate their Elixir apps with Matrix, I'd be super happy to have a chat 👍️ Less precise ideas are also welcome, of course 🙂

Dept of Bots 🤖


Cos announced:

Hemppa the bot is a generic bot for writing modules as easily as possible in Python. Thanks to issues with Freenode IRC bridge Hemppa got a new module for basic relaybot bridging of any Matrix rooms. Relaybots are stupid, but sometimes there's no working alternative.

Dept of Events and Talks 🗣️

Arch Conf 2020

Brendan Abolivier reported:

I did a talk at Arch Conf 2020 last month, on a generic introduction of Matrix and how to install a Matrix homeserver on Arch Linux. The recording has just been uploaded; it can be found on CCC's media site as well as YouTube 🙂


Matrix in the News 📰

Oleg's talk, the article

emorrp1 told us:

New Matrix coverage in LWN via an Open Source Summit Europe talk

See last week for the talk!

Final Thoughts 💭

TeeCee reported:

I stumbled upon this:

I love that the comments, even on Reddit, are mostly positive. A really nice report.

Dept of Ping 🏓

Here we reveal, rank, and applaud the homeservers with the lowest ping, as measured by pingbot, a maubot that you can host on your own server. Join to experience the fun live, and to find out how to add YOUR server to the game.

RankHostnameMedian MS

That's all I know 🏁

See you next week, and be sure to stop by with your updates!

How we fixed Synapse's scalability!

03.11.2020 00:00 — Releases Matthew Hodgson

Hi all,

We had a major break-through in Synapse 1.22 which we want to talk about in more detail: Synapse now scales horizontally across multiple python processes.

Horizontal scaling means that you can support more users and traffic by adding in more python processes (spread over more machines, if necessary) without there being a single bottleneck which all the traffic is passing through - as opposed to vertical scaling where you make things go faster overall by making the bottleneck go faster.

After many years of having to vertically scale Synapse (by trying to make the main process go faster) we’re now finally at the point where you can configure Synapse so that messages no longer flow through the main process - eliminating the bottleneck entirely. What’s more, the homeserver has now been successfully running in this config and enjoying the massive scalability improvements for the last 2 weeks! Huge kudos goes to Erik and the wider Synapse team for pulling this off.

Some readers might wonder how this ties in with Dendrite entering beta, given one of Dendrite’s design goals is full horizontal scalability. The answer is that we’re very much using Dendrite for experimentation and next-gen stuff at the moment (currently focused more on scaling downwards for P2P rather than scaling upwards for megaservers) - while Synapse is the stable and long-term supported option.

So, that’s the context - now over to Erik with more than you could possibly ever want to know about how we actually did it...


Synapse started life off back in 2014 as a single monolithic python process, and for quite a while we made it scale by adding more and more in-memory caches to speed things up by avoiding hitting the database (at the expense of RAM). It looked like this:

Eventually the caches stopped helping and we needed more than one thread of execution in order to spread CPU across multiple cores. Python’s Global Interpreter Lock (GIL) means that Python can mainly only use one CPU core at a time, so starting more threads doesn’t help with scalability - you have to run multiple processes.

Now, the vast majority of the work that Synapse does is related to “streams”. These are append only sequences of rows, such as the events stream, typing stream, receipts stream, etc. When a new event arrives (for example) we write it to the events stream, and then notify anything waiting that there has been an update. The /sync endpoint, for instance, will wait for updates to streams and send them down to long-polling Matrix clients.

Streams support being added to concurrently, so have a concept of the “persisted up-to position”. This is the point where all rows before that point have finished persisting. Readers only read up to the current “persisted up-to position”, so that they don’t skip updates that haven’t finished persisting at that point. (E.g. if two events A and B get assigned positions 5 and 6, but B finishes persisting first, then the persisted up to position will remain at 4 until A finishes persisting and then it jumps to 6).

To split any meaningful amount of work into separate processes, we need to add a mechanism where processes can be told that updates to streams have happened (otherwise they’d have to repeatedly poll the DB, which would be deeply inefficient). The architecture ended up being one where we had the “main” process that streams updates via a custom replication protocol (initially long-polling HTTP; later custom TCP) to any number of “worker” processes. This meant that we could move sync stream handling (and other read apis) off the main process and onto workers, but also that all database writes had to go through the single main process (as it was a star topology, the main process could talk to all workers but workers could only talk to the main process and not each other).


As an aside: cache invalidations also had to be streamed down the replication connections, which has the side effect that we could only cache things that would only be invalidated on the main process.

We continued to move more and more read APIs out onto separate workers. We also added workers in front of the main process that would e.g. handle the creation of the new events, authenticating, etc, and then call out to the main process with the event for it to persist the event.

Moving writes off the main process

Eventually we ran out of stuff to move out of the main process that didn’t involve writing to the DB. To write stuff from other processes we needed a way for the workers to stream updates to each other. The easiest and most obvious way was to just use Redis and its pub/sub support.


This almost allowed us to move writing of a particular stream to a different worker, except writing to streams generally also meant invalidating caches which in itself requires writing to a stream. We needed a way of writing to the cache invalidation stream from multiple workers at once.

Sharding the cache invalidation thankfully turned out to be easy, as workers would simply call the cache invalidation function whenever they get an invalidation notice over replication. In particular, the ordering of invalidations from different workers doesn’t matter and so there isn’t a need to calculate a single “persisted up-to position”. Sharding then just becomes a case of adding the name of the worker that is writing the update to the replication stream, and then workers reading from it can basically treat the cache stream the same as if they were multiple streams, one per worker.

This then unlocks the ability to move writing of streams off the main process and onto different workers - and so we added the “event persister” worker for offloading the main event stream off the main process:


Sharding the events stream

Eventually the worker responsible for doing nothing but persisting events started maxing out CPU. This meant that we had to look at sharding the events stream, i.e. writing to it from multiple workers.

This is more complicated than sharding the cache invalidation stream as the ordering of the events does matter; we send them down sync streams, in order, with a token that indicates where the sync stream is up to in the events stream. This means that workers need to be able to calculate a “persisted up-to position” when getting updates from different workers.

The easiest way of doing that is to simply set the persisted up-to position as the minimum position received over federation from all active writers. This works, except events would only be processed after all other writers have subsequently written events (to advance the persisted position past the point at which the event was written), which can add a lot of latency depending on how often events are written.

A refinement is to note that if you have a persisted up-to position of 10, then receive updates at sequential positions 11, 12, 13 and 14, you know that everything between 10 and 14 has finished persisting (as you received updates about them), and so can set the persisted up-to position to 14. Annoyingly, it’s not required that positions are sequential without gaps (due to various technical considerations), and so in the worst case this still has the same problems as the naïve solution.

To avoid these problems we change the persisted up-to position to be a vector clock of positions; tracking a vector of positions - one per writer. This still allows answering the query of “get all events after token X” (as events are written with the position and the name of the writer). The persisted up-to position is then calculated by just tracking the last position seen to arrive over replication from each writer.

This allows writing events from multiple workers, while ensuring that other workers can correctly keep track of a “persisted up-to position”. Then it's just a matter of inspecting the code to ensure that it does not assume that it is the only writer to the stream. In the case of writing to the events stream, we note that the function persisting events assumes it's the only writer for a given room, so when sharding we have to ensure that there are no concurrent writes to the same room. This is most easily done by sharding based on room ID, and ensuring that the mapping of room ID to worker does not change (without coordination).

The only thing left is to then encode the vector clock position into the sync tokens. We want to ensure that these tokens are not too long, as they get included as query string parameters (e.g. the since= parameter of /sync). By assigning persistent unique integer IDs to workers the vector clock can be persisted as a sequence of pairs of integers, which is relatively few bytes so long as we don’t have too many workers writing to the events stream. We can further reduce the size of the tokens by calculating an integer “persisted up-to position” as we did before, encoding that and only including positions for workers that are larger than the integer persisted upto position. (The idea here is that most of the time only a small number of workers will be ahead of the calculated persisted up-to position, and so we only need to encode those).

And this is what we have today:


The major limitation of the current situation is that you can’t dynamically add/remove workers which persist events, as the sharding by room ID is calculated at startup, and so changing it requires restarting the whole system. This could be replaced by any system that allowed coordination over which persister is allowed to write to a room at any given point. However this is likely tricky to get right in practice, but would allow dynamic auto scaling of deployments, or automatically recovering from a worker that gets wedged/dies.

Finally, it’s worth noting that sharding event persisters isn’t the only performance work that’s been going on - switching everything over to python 3 and async twisted has helped, along with lots of smaller optimisations on the hot paths, and further rebalancing workers (e.g. moving background jobs off the master process to dedicated workers). We’ve also benefited a lot from the maintainability of rolling out mypy typing throughout the codebase. And next up, we’ll be going back to speeding up the codebase as a whole - starting with algorithmic state resolution improvements! 🎉


So, how does it stack up?

Here’s the send time heatmap on showing the step change on Oct 16th when we rolled out the second event persister (full disclosure: this also coincides with moving background processes off the main Synapse process to a background worker). As you can see, we go from messages being spread over a huge range of durations (up to several seconds) to the sweet spot being 50ms or less - a spectacular improvement!


Meanwhile, here’s the actual CPU utilisation as we split the traffic from a single event persister (yellow) to two persisters (one yellow, one blue), showing the sharding beautifully horizontally balancing CPU between the two active/active worker processes:


We’ve yet to loadtest to see just how fast we can go now (before we start hitting bottlenecks on the postgres cluster), but it sure feels good to have all our CPU headroom back on again, ready for the next wave of users to arrive.


So there you have it: folks running massive homeservers (50K+ concurrent users) like (and cough various high profile public sector deployments) are no longer held hostage by the bottleneck of the main synapse process and should feel free to experiment with setting up event persister workers to handle high traffic loads. Otherwise, if you can spread your users over smaller servers, that’s also a good bet (assuming they don’t have massively overlapping room membership, like we see on

The current worker documentation is up-to-date, although does assume you are already very familiar with how to administer Synapse. It’s also very much subject to change, as we keep adding new workers and improving the architecture. However, now is a pretty good time to get involved if you’re interested in large-scale Matrix deployments.

-- The Synapse Team

This Week in Matrix 2020-10-30

30.10.2020 00:00 — This Week in Matrix Ben Parsons

Matrix Live 🎙

sometimes you'll come across us at FOSDEM and we'll say "oh it's the future", and we're trying to make this an actual thing

- Half-Shot on getting from sci-fi to reality

Dept of Spec 📜


anoa told us:

Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at

MSC Status

Closed MSCs:

Merged MSCs:

MSCs in Final Comment Period:

  • No MSCs are in FCP.

New MSCs:

Also heads up, the nomenclature for Communities v2 (groups-as-rooms) is now Matrix Spaces! Check out MSC1772 for the details!

Spec Core Team

In terms of Spec Core Team MSC focus for this week, we're continuing with the widget theme: MSC2774 (widget URL template param), MSC2765 (widget avatars), and MSC2790 (modal widgets).


New spec platform

wbamberg told us:

Updates on the new spec platform: we can render HTTP APIs ( and events (

Dept of Built on Matrix 🏗️

Chupacabra Social

patrick told us:

From the creators of Noteworthy, introducing Chupacabra, a Matrix powered content sharing and discussion layer.

Video demo:


Join us in to learn more.

Dept of Servers 🏢


Conduit is a Matrix homeserver written in Rust

Timo announced:

Hello everyone, I have some amazing news to share with you! While Conduit is getting better at federating, Famedly ( has agreed to support me working on Conduit financially. With this news come some organizational changes:

Conduit development now happens at, please submit new issues and pull requests over there. I will update all links in the coming days.

Note: Famedly does not own the project and Conduit will stay free and open source forever!


matrix-media-repo is a highly customizable multi-domain media repository for Matrix

TravisR announced:

v1.2.1 of matrix-media-repo, a third-party media repo for large homeservers, is out now. It's primarily a maintenance update though also has support for audio files if for some reason you need that.



callahad said:

Synapse 1.22.0 is out! We announced its first release candidate last week, and after a small rc2 the final release was published last Tuesday. We anticipate a small 1.22.1 release later today with fixes for messages not always being sent to app services (#8673) and serialization errors with third-party event rules (#8678).

We continue to see improved client join Apdex scores for, indicating that our work in 1.22.0 to split background tasks into separate workers and allow for sharded event persisters successfully improved the user-visible performance of large homeservers.

In other news, we pushed a temporary hotfix to the homeserver earlier this week, instructing it to drop all cross-user m.key_share_request messages. This was necessary to mitigate a bug in a third-party library which caused some clients to flood the server with requests. We'll re-enable these messages once we resolve issue #8677. In the meantime, we strongly encourage FluffyChat users to upgrade to version 0.21.1.

We're hard at work on the next release of Synapse, and the development branch already includes many bugfixes, several new admin APIs, and support for structured logging—stay tuned!


Dendrite is a next-generation homeserver written in Go

kegan said:

There is no release this week, be sure to have v0.2.1 installed for a more stable experience! A few documentation changes have been made this week:

  • Docker sample configs are now correct.

  • The MaxMessageBytes for Kafka messages is now configurable - thanks @S7evinK!

  • A reverse-proxy sample now exists for Hiawatha - thanks @ErgoPoe!

Spec compliance remains unchanged:

  • Client-server APIs: 57%

  • Server-server APIs: 81%

Things have been quiet this week because Neil has been working on new P2P routing schemes and I have been working

on a Threading proposal which will be tried out in Dendrite in the coming days.

Synapse Deployment 📥️


Ananace announced:

Just pushed the Synapse 1.22.0 versions for my K8s-optimized image and Helm chart.

... 🕛 time 🕗 went 🕟 by 🕥 ...

Updated my Synapse chart and K8s-optimized image to 1.22.1 as well, and got the element-web chart updated to 1.7.12


Pierre reported:

YunoHost is an operating system aiming for the simplest administration of a server, and therefore democratize self-hosting.

Synapse integration had been updated to 1.20.1 (1.21.2 available in branch testing)

Element Web integration had been updated to 1.7.9 (1.7.10 available in branch testing)

Dept of Bridges 🌉

🌈🌉 Bifrost reaches 0.2.0

Half-Shot reported:

Hey folks, today I bring you a gift wrapped rainbow coated present, which could only mean Bifrost 0.2.0 is out!.

We've been making major progress trying to align bifrost with the many XMPP clients out there like Gajim and Swift, by improving it's compatibility with the various XEPs. I've also noticed a few users have started using it to bridge their Matrix and XMPP communities together which is super cool :)

Please read the latest changelogs over at and upgrade away!


Eric reported:

The merge request for the native Gitter bridge has just got underway and we're making progress towards sharing all Gitter messages in public rooms across to Matrix.

We'll continue to iterate on the Gitter virtualUser support as we go along.


Tulir said:

v0.9.0-rc1 was released last weekend. Changes since v0.8.x include:

  • Prometheus metric names are now prefixed with bridge_

  • Support for Telegram QR code login

  • Support for double puppeting for users on other servers

  • Options for automatic backfilling of missed messages and old messages when creating portals

  • Switched end-to-bridge encryption to use mautrix-python instead of the previous hacky matrix-nio solution

This week I fixed some bugs, so I'll probably make a rc2 in the near future.

Dept of Clients 📱

Fluffychat 0.21.1 is released!

FluffyChat is a cute cross-platform matrix client. It is available for Android, iOS, Web and Desktop.

sorunome announced:

It is already in fdroid, google play and ios should follow shortly. We highly encourage people to update, as it contains an important bugfix of sending out way too many key requests, which can cause bad server performance


  • New user viewer

  • Add code syntax highlighting in messages

  • Updated translations: Thanks to all helpers


  • Stories feature removed


  • Fixes sentry

  • Fixes Android download

  • Minor fixes




kitsune reported:

Hot on the heels of beta, Quaternion beta2 is released, fixing a couple of blunders, notably inability to build with external libQuotient. Keep testing, keep translating!


Bruno announced:

Hydrogen can now show images in encrypted rooms! I hope to also release a lightbox feature this afternoon to show a zoomed version of an image.


Manu announced:

This week, we have almost finished the authentication for widgets and jisti in particular. The project is now fully compatible with Xcode 12.

Element Android

benoit offered:

We are making progress on the performance side. Now sending an event is much faster than before. We also are optimizing the crypto code. All those improvements will be available in the next release (v1.0.10), maybe next week?

Besides that, we are implementing the remaining features, we are trying to have the same level of functionality (= parity) than Element Web. We know that we have a great number of bugs to fix on the existing feature, we are also trying to fight them.

As a reminder, the new Android Matrix SDK is available at and a nice sample application has been developed and is available at

You had me at "progress on the performance side"! I am looking forward to the new Element Android :D

Element Web

Neil reported:

This week we shipped Element 1.7.12 which contains some high priority fixes, specifically:

  • Fixes secret storage / cross-signing reset to avoid asking for the previous key you no longer have
  • Fixes widget pinning and Jitsi calls when custom themes are used

Aside from that we continue to work on the voice and video calling experience as well as improving the initial onboarding experience of the app.


Nheko is a desktop client using Qt, Boost.Asio and C++17. It supports E2EE (with the notable exception being device verification for now) and intends to be full featured and nice to look at

Nico ( offered:

This was an exciting week again. Trilene did the usual and just opened a PR, that implements the video part of call support. In my testing so far this seems to work amazingly well (ignore, that my webcam is crappy in the video, I only have so many devices...)! It's hard to overstate my satisfaction, if I am allowed to quote songs without getting a DMCA! If you want to try it out, you will need the qmlgl plugin at runtime (I had to patch some ebuilds on Gentoo to do so) and build Nheko from source. Support in our AppImage and Flatpak and for our Windows and MacOS builds will come at a later date. A big shoutout to trilene, who just works on VOIP in Nheko, without saying a word, and then drops a ready PR.

Another exciting new feature by lorendb, you can now specify --profile <profilename>, when you start Nheko, to create a separate profile. This allows you to open multiple instances and use multiple accounts at the same time (but it still uses separate instances of Nheko). This is pretty useful, if you have multiple accounts on different homeservers or are testing stuff for example. He also added a shortcut to delete the current content of the message area (Ctrl-U).

We also fixed a long standing bug, that crashed Nheko when pasting an image on mac OS, prevented copying text in some cases and build times should be about halfed again.

That's all I got today. I guess we should do a new release at some point?

I asked about trilene, who is a reliable Nheko contributor, Nico replied:

trilene seems to be a bit camera shy and prefer to work on code than take credit and talk about upcoming features. I'm surprised everytime, when a new PR is opened or trilene asks a weird question, that can only end up in an amazing contribution :3


Dept of SDKs and Frameworks 🧰

matrix-bot-sdk 0.5.8 out now

TravisR told us:

matrix-bot-sdk v0.5.8 is out now with experimental support for EDUs being sent to appservices (per MSC2409).

To enable it you'll need Synapse 1.22.0 (released this week) and v0.5.8 of the bot-sdk. Then, add "de.sorunome.msc2409.ephemeral": true to your appservice registration file (at the root level) and turn on the de.sorunome.msc2409.ephemeral flag in your IAppserviceRegistration supplied to the bot-sdk. If all goes according to plan, you'll be able to use appservice.on("ephemeral.event", (ev) => {}) to start processing EDUs.

Dept of Ops 🛠

Icinga End-to-End Check

Nik said:

I hacked together a maubot-based roundtrip test that leverages the echo bot's ping command reply and reports rtt to Icinga as a passive check result. Its practical use is scientifically questionnable, but it gives a hint on end-user experience. Find it here:

Dept of Services 🚀

Enabling encryption for bots on

TravisR offered:

Starting November 28th and 29th of this year, many bots on will be supporting end-to-end encryption. Though not all bots will be supporting it, this is an important milestone towards getting end-to-bridge encryption enabled on as a proof of being able to scale to the higher demand of encrypted rooms.

The eventual goal is to support encryption on all of’s bots and bridges, however we need to take small steps to get there 🙂. Note that in order to function, bots will decrypt all messages they see, but only respond to the ones they care about - this can still be uncomfortable for some rooms though, so feel free to kick them out.

For more detail on which bots are getting support and what all this entails/means, please see the dedicated blog post.

We teased this a little on Matrix Live last week (I think?), but so awesome to see this publicly announced.

Keymaker (Serverlist Project)

MTRNord reported:

Keymaker is a new WIP Project of some people (over at ) that aim to provide a mastodon alike Server List and we would love to get some more input from the Community for this project on whats wanted, whats needed and whats maybe not that good to base on the mastodon counterpart.

This means we are building:

  • A list of Servers where Owners can add their servers

  • We try to do Quality controls (No fully self add. Servers get reviewed.) using a Code of Conduct Ruleset

  • Verified Listings using well-known files on serverside (Also allowing Admins to modify server data themself)

  • Server Details like:

    • Ping and Availability Stats (thanks to tulir for providing a API)

    • Public Room Lists fetched from the Server

    • NSFW Ratings (A NSFW tag was too generic for us)

    • A Section to list Rules

    • Admin addresses for easy ways of reaching the Server admins

  • Allowing to select registration state ("Open", "Invite Only", "Closed")

The Code is fully written in Rust and using Postgres as a backend. Have a look at:

Join us at:

In a further post we plan to announce the launch of this Project as a Website. Server owners might get a ping before that to allow for setting up servers for this. This Project is not yet deployed to be used.

This is really cool. I suggested it might start to kickstart people hosting their own small, publicly open servers.

MTRNord replied:

As we also allow non public servers (registration -> closed) it may also be a nice way to find communities that federate and have a look if they have a interesting room to join in the public rooms list. :)

Dept of Bots 🤖


kapina-jaywink reported:

Bubo, the community helping bot-in-progress, gets releases and a new command: breakout. The command can be used to create a breakout room from the current room. Bubo will create the room, invite and make the requester an admin, and confirm in the original room. Anyone who reacts with an emoji to the confirmation will get an invite to the breakout room. Currently breakout rooms are non-public and non-encrypted by default.

Find Bubo v0.2.0 here.

Dept of Events and Talks 🗣️

Neil on being an eng manager

Neil announced:

Hey all, I do engineering managery stuff at Element, if you ever wondered what on earth that actually means, here is a video of me going on and on about it.

Sell it Neil! This is an insightful chat - if you're interested in the dilemmas and thoughts of an eng manager, be sure to check this out!

Dept of Ping 🏓

Here we reveal, rank, and applaud the homeservers with the lowest ping, as measured by pingbot, a maubot that you can host on your own server. Join to experience the fun live, and to find out how to add YOUR server to the game.

RankHostnameMedian MS

That's all I know 🏁

See you next week, and be sure to stop by with your updates!

Synapse 1.22.0 released

27.10.2020 17:01 — Releases Dan Callahan

Synapse 1.22.0 now available!

This release focused on improving Synapse's horizontal scalability, including:

  • Support for running background tasks in separate worker processes.
  • Fixes to sharded event persisters, which were experimentally introduced in 1.21.0.
  • Fixing a message duplication bug with worker-based deployments. (#8476)

Synapse 1.22.0 also has a few other notable changes:

  • Defaulting to version 6 rooms, per MSC2788.
  • Initial support for three new experimental MSCs:
    • MSC2732: Supporting olm fallback keys
    • MSC2697: Supporting device dehydration
    • MSC2409: Allowing appservices to receive ephemeral events like read receipts, presence, and typing indicators.
  • Multi-arch Docker images, covering arm64 and arm/v7 in addition to amd64.

Installation instructions are available on GitHub, as is the v1.22.0 release tag.

Lastly, Synapse is a Free and Open Source Software project, and we'd like to extend our thanks to everyone who contributed to this release, including @Akkowicz, @BBBSnowball, @maquis196, and @samuel-p.

The full changelog for 1.22.0 is as follows:

Synapse 1.22.0 (2020-10-27)

No significant changes.

Synapse 1.22.0rc2 (2020-10-26)


  • Fix bugs where ephemeral events were not sent to appservices. Broke in v1.22.0rc1. (#8648, #8656)
  • Fix user_daily_visits table to not have duplicate rows per user/device due to multiple user agents. Broke in v1.22.0rc1. (#8654)

Synapse 1.22.0rc1 (2020-10-22)


  • Add a configuration option for always using the "userinfo endpoint" for OpenID Connect. This fixes support for some identity providers, e.g. GitLab. Contributed by Benjamin Koch. (#7658)
  • Add ability for ThirdPartyEventRules modules to query and manipulate whether a room is in the public rooms directory. (#8292, #8467)
  • Add support for olm fallback keys (MSC2732). (#8312, #8501)
  • Add support for running background tasks in a separate worker process. (#8369, #8458, #8489, #8513, #8544, #8599)
  • Add support for device dehydration (MSC2697). (#8380)
  • Add support for MSC2409, which allows sending typing, read receipts, and presence events to appservices. (#8437, #8590)
  • Change default room version to "6", per MSC2788. (#8461)
  • Add the ability to send non-membership events into a room via the ModuleApi. (#8479)
  • Increase default upload size limit from 10M to 50M. Contributed by @Akkowicz. (#8502)
  • Add support for modifying event content in ThirdPartyRules modules. (#8535, #8564)


  • Fix a longstanding bug where invalid ignored users in account data could break clients. (#8454)
  • Fix a bug where backfilling a room with an event that was missing the redacts field would break. (#8457)
  • Don't attempt to respond to some requests if the client has already disconnected. (#8465)
  • Fix message duplication if something goes wrong after persisting the event. (#8476)
  • Fix incremental sync returning an incorrect prev_batch token in timeline section, which when used to paginate returned events that were included in the incremental sync. Broken since v0.16.0. (#8486)
  • Expose the uk.half-shot.msc2778.login.application_service to clients from the login API. This feature was added in v1.21.0, but was not exposed as a potential login flow. (#8504)
  • Fix error code for /profile/{userId}/displayname to be M_BAD_JSON. (#8517)
  • Fix a bug introduced in v1.7.0 that could cause Synapse to insert values from non-state events into the room_retention database table. (#8527)
  • Fix not sending events over federation when using sharded event writers. (#8536)
  • Fix a long standing bug where email notifications for encrypted messages were blank. (#8545)
  • Fix increase in the number of There was no active span... errors logged when using OpenTracing. (#8567)
  • Fix a bug that prevented errors encountered during execution of the synapse_port_db from being correctly printed. (#8585)
  • Fix appservice transactions to only include a maximum of 100 persistent and 100 ephemeral events. (#8606)

Updates to the Docker image

  • Added multi-arch support (arm64,arm/v7) for the docker images. Contributed by @maquis196. (#7921)
  • Add support for passing commandline args to the synapse process. Contributed by @samuel-p. (#8390)

Improved Documentation

  • Update the directions for using the manhole with coroutines. (#8462)
  • Improve readme by adding new badges. (#8493)
  • Added note about docker in regarding which ip address to bind to. Contributed by @Maquis196. (#8526)
  • Document the new behaviour of the allowed_lifetime_min and allowed_lifetime_max settings in the room retention configuration. (#8529)

Deprecations and Removals

  • Drop unused device_max_stream_id table. (#8589)

Internal Changes

  • Check for unreachable code with mypy. (#8432)
  • Add unit test for event persister sharding. (#8433)
  • Allow events to be sent to clients sooner when using sharded event persisters. (#8439, #8488, #8496, #8499)
  • Configure public_baseurl when using demo scripts. (#8443)
  • Add SQL logging on queries that happen during startup. (#8448)
  • Speed up unit tests when using PostgreSQL. (#8450)
  • Remove redundant database loads of stream_ordering for events we already have. (#8452)
  • Reduce inconsistencies between codepaths for membership and non-membership events. (#8463)
  • Combine SpamCheckerApi with the more generic ModuleApi. (#8464)
  • Additional testing for ThirdPartyEventRules. (#8468)
  • Add -d option to ./scripts-dev/ to lint files that have changed since the last git commit. (#8472)
  • Unblacklist some sytests. (#8474)
  • Include the log level in the phone home stats. (#8477)
  • Remove outdated sphinx documentation, scripts and configuration. (#8480)
  • Clarify error message when plugin config parsers raise an error. (#8492)
  • Remove the deprecated Handlers object. (#8494)
  • Fix a threadsafety bug in unit tests. (#8497)
  • Add user agent to user_daily_visits table. (#8503)
  • Add type hints to various parts of the code base. (#8407, #8505, #8507, #8547, #8562, #8609)
  • Remove unused code from the test framework. (#8514)
  • Apply some internal fixes to the HomeServer class to make its code more idiomatic and statically-verifiable. (#8515)
  • Factor out common code between RoomMemberHandler._locally_reject_invite and EventCreationHandler.create_event. (#8537)
  • Improve database performance by executing more queries without starting transactions. (#8542)
  • Rename Cache to DeferredCache, to better reflect its purpose. (#8548)
  • Move metric registration code down into LruCache. (#8561, #8591)
  • Replace DeferredCache with the lighter-weight LruCache where possible. (#8563)
  • Add virtualenv-generated folders to .gitignore. (#8566)
  • Add get_immediate method to DeferredCache. (#8568)
  • Fix mypy not properly checking across the codebase, additionally, fix a typing assertion error in handlers/ (#8569)
  • Fix synmark benchmark runner. (#8571)
  • Modify DeferredCache.get() to return Deferreds instead of ObservableDeferreds. (#8572)
  • Adjust a protocol-type definition to fit sqlite3 assertions. (#8577)
  • Support macOS on the synmark benchmark runner. (#8578)
  • Update mypy static type checker to 0.790. (#8583, #8600)
  • Re-organize the structured logging code to separate the TCP transport handling from the JSON formatting. (#8587)
  • Remove extraneous unittest logging decorators from unit tests. (#8592)
  • Minor optimisations in caching code. (#8593, #8594)

This Week in Matrix 2020-10-23

23.10.2020 00:00 — This Week in Matrix Ben Parsons

Matrix Live 🎙

Dept of Spec 📜

TravisR offered:

Hello everyone, normally anoa would be doing this update but today you get me (TravisR) instead. Luckily anoa has left me a script to run, so here's hoping I haven't completely messed up this week's update 😅

Here's your weekly spec update! The heart of Matrix is the specification - and this is modified by Matrix Spec Change (MSC) proposals. Learn more about how the process works at

MSC Status

Merged MSCs:

  • Nothing to report 😢

MSCs in Final Comment Period:

New MSCs:

Closed MSCs:

Spec Core Team

In terms of Spec Core Team MSC focus for this week, we're still focusing on the same MSCs from previous weeks to get widgets over the line. This includes MSC2774 to have widgets aware of their widget ID, MSC2765 so widgets can be pretty in clients like Element, and MSC2790 to support a form of user input with widgets.

Normally there would be a graph here of our MSC progress, however my machine refuses to accept that line graphs are a real thing today. As a replacement, here's a snowfall accumulation graph for Banff as reported by Environment Canada.

Dept of Servers 🏢


Tulir told us:

I made a simple room alias proxy: It can be used to create room aliases on custom domains without having to host an actual Matrix homeserver there. The proxy basically just responds to federation room alias queries using data from another homeserver (that data is fetched with the C-S API).


callahad reported: >

A new release candidate appears! Synapse 1.22.0rc1 was published yesterday and includes support for running background tasks in separate worker processes, as well as fixes to sharded event persisters which were first introduced in 1.21.0.

These changes significantly improved our client join Apdex score for by making join performance both faster and less variable.


Synapse 1.22.0rc1 also includes support for a few experimental MSCs:

  • MSC2732: Supporting olm fallback keys

  • MSC2697: Supporting device dehydration

  • MSC2409: Allowing appservices to receive ephemeral events like read receipts, presence, and typing indicators.

Lastly, the default room version is now version 6, per MSC2788.

In the coming weeks we'll focusing on improving Synapse's resilience in smaller to medium-sized deployments, primarily through improvements to state resolution. Stay tuned!

Thanks Dan!

Today's update comes courtesy of Dan Callahan (, who joined Element on Monday as an engineering manager supporting the Synapse team. Dan previously worked in Developer Relations at Mozilla, and he's excited to help Matrix realize its ambitious vision for private, secure, and standards-based communication for all.

Dendrite / gomatrixserverlib

Dendrite is a next-generation homeserver written in Go

Neil Alexander offered:

This week we released v0.2.0 on Tuesday, a reasonably big update containing various improvements over the initial beta release, and then followed it up with a bug-fix v0.2.1 release on Thursday.

Thanks to everyone who has been running Dendrite and reporting their findings, and also to contributors who have been submitting pull requests!

Changes this week include:

  • Dendrite no longer builds separate binaries for each polylith component, but instead has one multi-personality binary

  • Our Docker images have been simplified into two images: dendrite-monolith and dendrite-polylith

  • Internal HTTP API calls are now made using H2C (HTTP/2) in polylith mode, which resolves some head-of-line issues with the connection pool

  • Forward extremities have been refactored, which should fix some cases where room state can end up corrupted

  • A couple of bugs when handling state rewrites have been fixed

  • The sync API no longer sends old state events to clients as if they were new

  • SQLite locking bugs around the latest events updater have been resolved

  • Notification levels are now parsed correctly in power level events (thanks to Pestdoktor)

  • Invalid UTF-8 is now correctly rejected when making federation requests (thanks to Pestdoktor)

Spec compliance for v0.2.1:

  • Client-server APIs: 57%, up from 56% last week

  • Server-server APIs: 81%, up from 80% last week

As always, please feel free to join us in for general Dendrite chat, and if you are interested in contributing!


Timo stepped in to tell us:

This was another productive week:

  • Improved thumbnailing algorithm (higher quality, less stored data, correct)
  • Allow unjoined users to read state of world readable rooms (this makes work with conduit)
  • Docs for cross compiling conduit
  • Fixed stuck / double-join over federation
  • Fixed random timeline reload bug
  • Welcome message in admin room
  • More frequent flushing

Some WIP things:

  • Provide Conduit binaries for most platforms to make setting up or updating a Conduit instance even easier
  • More reliable sending over federation
  • Bring all features of our Ruma fork upstream

Thanks to everyone who supports me on Liberapay or Bitcoin!

Homeserver Deployment 📥️

Dendrite docker images

Dendrite is a next-generation homeserver written in Go

TR_SLimey offered:

I built some unofficial Dendrite docker images for Linux/ARM64, for those trying to run Dendrite on a Raspberry Pi, RockPro64 or others. They can be found here: &

balaa reported:

Cool, we run Synapse on Pi0, Pi2 and Pi4 -- works reasonably well on each of them, i'm excited to try Dendrite

Synapse running on a Pi zero..?

Dept of Bridges 🌉


Eric Eastwood announced:

The initial iteration of virtualUsers is in shape to merge(check out the flair 🔥) and will probably deploy in a release next week. We've split the rest of the virtualUser work into follow-up issues we can iterate on. We're working on adding room ban and spam detection support for virtualUsers to stop any bad actors. Then want to start on the actual Application Service bridge (Gitter <-> Matrix).


If you're curious about more of the details, you can track the greater GitLab epic.

🌈🌉 Bifrost* 0.2.0 is (nearly) out

Half-Shot offered:

I couldn't really wait to talk about before we actually hit 0.2.0 so here is a sneak peek at what's happening. We've spent a ton of time working on ironing out the bugs and making the bridge more XMPP complaint. The major headlines are:

  • Support Matrix -> XMPP edits

  • Set XMPP user displayname in the room based on their nickname (thanks uhoreg for mucking in there)

  • Improve performance of Matrix -> XMPP gateway messages and joining

  • Improve support for multiple devices for XMPP users connected to the gateway

  • maaaany bugfixes

You can read about (and run!) the latest release over at

Incidentally, if you've not yet, then try joining some rooms such as #twim#[email protected] from XMPP and see it live!

*rainbum, as Mathijs prefers

Dept of Clients 📱


Bruno said:

Hydrogen gained a settings panel this week with a better session backup UX and your end-to-end device information, which should make the manual verification easier. Messages with multiple lines are also rendered as such now, which makes a big difference in usability. The app also works offline again after session backup broke that. Apart from that, several smaller fixes also landed.


Also, image decryption is well on it's way with a prototype working. 🎉


Alexandre Franke reported:

The massive MR to switch to matrix-rust-sdk is still being reviewed and help is still welcome. We have been working on other stuff as well. Actually, since our last news piece for the release of 4.4, quite a lot happened (around 60 commits) that we haven’t reported here yet:

  • Users can now go to the room settings to toggle notifications for each room individually.

  • Rounded corners around everything to match the latest upstream design tweaks (in Adwaita, the official GNOME theme).

  • Many maintenance changes: several dependencies have been updated, cleanups in various places, tightened flatpak permissions for better sandboxing…

And that’s not all! Good progress has been made towards rendering formatted_body. Hopefully that should be merged soon.


Element Web

Ryan offered:

We released Element 1.7.10 on Tuesday with some high priority fixes:

  • Several bugs fixed for both all widgets as well as a few specific to Jitsi call widgets

  • Widgets are now working again in Safari 13.1 (regressed by 1.7.9)

Quite soon after that on Wednesday, Element Web 1.7.11-rc.1 made it's way to staging:

  • Improved state management for voice / video calls

  • Revamped pinned widget UI to support resizing and more flexibility


sorunome told us:

Fluffychat 0.20.0 is out! It should be available in fdroid, google play and on iOS soon!


  • Added translations: Arabic

  • Add ability to enable / disable emotes globally

  • Add ability to manage emote packs with different state keys

  • Add swipe to reply - Thanks @inexcode

  • Initial support for compiling to desktop

  • Initial snap metadata - Thanks @RAOF_47

  • Add latex parsing as per MSC2191 - $tex$ for inline and $$ for blocks


  • Re-scale images in a separate isolate to prevent the UI from freezing

  • URLs without https:// now linkify

  • Parse all URIs, not just URLs

  • emails will linkify now

  • Make sure login to dendrite is working properly


  • Fix amoled / theme settings not always saving properly

  • Show device name in account information correctly

  • Fix tapping on aliases / room pills not always working

  • Link clicking in web not always working

  • Return message input field to previous state after editing message - Thanks @inexcode


MTRNord added:

perfect for university start. Finally I can write the thesis in the University matrix ;P

Element Android

benoit offered:

Element Android v1.0.9 is now available on the PlayStore. For the next release (1.0.10), we will optimize the performance (again!). We already have made some progress when sending a message to a room. We are now working on the crypto module and also we will probably upgrade the Realm database library, which seems more stable now. Besides that, we are still implementing the remaining features with the objective of getting a good feature parity with the other Element Matrix clients.


Manu reported:

This week, we have been working to upgrade libs and tools to be compatible with Xcode 12.

We are making good progress to revive a kind of background sync so that a message appears quicker in the timeline when you tap on its notification. Authentication for widgets is still in progress.


Nheko is a desktop client using Qt, Boost.Asio and C++17. It supports E2EE (with the notable exception being device verification for now) and intends to be full featured and nice to look at

Nico ( said:

  • Nheko now shows the filename of an image on hover. (Contributed by kamath_manu)

  • Nheko now shows the fontname in the font selection rendered using that font. This makes it easier to know, how the font will look, once you select it. (Contributed by lorendb)

  • Fixed a crash when closing Nheko. While this didn't really cause issues, since you were closing it anyway, it's just bad form to crash instead of exit properly.

  • Removed the membercache. Nheko used to load all members on startup and store them in memory. This made startup slower. Removing it sped up the start by a nice chunk and freed about 30MB of RAM on my system. One step closer to using reasonable amounts of RAM!

  • Fixed excessive clipping when rendering the timeline. This prevented all batching of text messages. Now it only clips the replied to message, which makes scrolling much smoother again!

Finally, some controversial change, which is currently in master but may be reverted at some point: Nheko now automatically forwards keys to verified devices, when they request the keys, without prompting you. While that can be toggled off in the settings, it currently defaults to on. This weakens backward secrecy of e2ee a bit, but it makes it possible to recover from e2ee issues much more easily. Currently I'd argue, that it is an acceptable tradeoff. It is very hard to verify room membership of users at any point in time but the current one and room membership is not verified end to end in any way, so you need to trust the server to provide you with the correct memberlist or you just send keys to verified users. While Nheko still sends keys to all members of a room, when creating the session, it only forwards your own keys to trusted users without prompting you. Currently I think this is an acceptable tradeoff, as opening a popup with "user x wants to have session y shared in room z" is unlikely to be understood by anyone properly either. I'd be glad to hear your opinions though!

That's it for this week, but next week will be interesting too. Lorendb has been hacking on profile support, allowing you to run multiple login sessions of Nheko in separate windows and some other UI features.

Dept of SDKs and Frameworks 🧰


iinuwa reported:

In the past couple of weeks we implemented the last endpoint for the Federation

API. We are working on smoothing out some rough edges in the ruma-federation-api crate, like a few that @Timo addressed this past week, so it will be a little while

before it's completely finished.

We've also created a milestone to track implementation of Identity Service API,

the last Matrix API we have to complete.

Finally, we've created a new Matrix room focused on Ruma development,, focusing the original room on Ruma usage.


kitsune told us:

Quotient 0.6.2 has been released, with a couple of minor bugfixes. This release is used as a foundation of Quaternion beta that's also getting out today - with support of (proper Matrix subset of) HTML, rich text user links (like pills, only lighter), initial Markdown support (if you build with fresh enough Qt), reactions (thanks to Karel Kosek @krkk), navigation to earlier events (thanks to Roland Pallai @rpallai) and quite a few other improvements. To make this release Quaternion had to gain its own basic HTML parser and Matrix-to-Qt-to-Matrix converter, which is likely to end up being a separate micro-library, in the hope that it will be useful for other Matrix projects building on Qt (even non-Quotient ones). A separate call to translators - quite a few strings got updated, so please head to Quaternion project at Lokalise and push the numbers at least to 80%!

Dept of Events and Talks 🗣️

Three talks this week!

Matrix talk at Open Source Summit EU (virtual)

Oleg announced:

If you are visiting the OSS EU next week - come to the Matrix talk. 😉

Or join us at !

dette er på utenlandsk

dandellion reported:

In august I held an introduction to and demo of matrix talk during a conference hosted by my local makerspace.

This week the talk was uploaded! (Norwegian)

AstriCon Plan (9) on building Omnichannel contact centers with Matrix (and other tech)

Matthew said:

Jose Franco gave a great talk at AstriCon Plan (9) on building Omnichannel contact centers with Matrix, Asterisk, Kamailio and friends. You can see the video at and the talk details at

Dept of Interesting Projects 🛰️

Noteworthy (matrix powered distributed overlay networks via WireGuard)

balaa told us:

hey TWIM peeps! we’ve updated the README for our project Noteworthy (matrix powered distributed overlay networks via WireGuard) - join us over in with questions / comments!

Dept of Ping 🏓

Here we reveal, rank, and applaud the homeservers with the lowest ping, as measured by pingbot, a maubot that you can host on your own server. Join to experience the fun live, and to find out how to add YOUR server to the game.

RankHostnameMedian MS

That's all I know 🏁

See you next week, and be sure to stop by with your updates!