https://tobiasfella.de/icon.jpg Zola 2023-07-04T00:00:00+00:00 https://tobiasfella.de/atom.xml 2023-07-04T00:00:00+00:00 2023-07-04T00:00:00+00:00 Tobias Fella https://tobiasfella.de/blog/libquotient-08/ <p>I'm excited to announce the release of version 0.8 of libQuotient, the Qt library for building software using <a href="https://matrix.org">Matrix</a>.</p> <h2 id="this-release-brings-to-you">This release brings to you</h2> <ul> <li>Generated documentation, browsable at <a href="https://quotient-im.github.io/libQuotient/">quotient-im.github.io/libQuotient/</a></li> <li>Coinstallability of Qt5 and Qt6 builds</li> <li>Various stability improvements</li> <li>Updated Matrix APIs</li> </ul> <h2 id="more-information-tarballs">More Information &amp; Tarballs</h2> <p>Available at <a href="https://github.com/quotient-im/libQuotient/releases">the release page on GitHub</a> :)</p> <h2 id="but-wait-there-s-more">But wait, there's more!</h2> <p>End of next week, <a href="https://akademy.kde.org/2023/">Akademy</a>, KDE's annual conference is starting in Thessaloniki, Greece and online. Alexey, Carl, and I will be there talking about our work on and with Matrix and ActivityPub. The talk will be live-streamed, so don't miss it!</p> <p><img src="https://tobiasfella.de/blog/libquotient-08/Akademy2023.png" alt="Going to Akademy" /></p> <h2 id="getting-involved">Getting involved</h2> <p>There's always more things to do in libQuotient. Come talk to us in <a href="https://matrix.to/#/#quotient:matrix.org">#quotient:matrix.org</a>.</p> 2022-11-18T00:00:00+00:00 2022-11-18T00:00:00+00:00 Tobias Fella https://tobiasfella.de/blog/neochat-e2ee/ <p>Ever since work on NeoChat has started in 2020, the most requested feature has been support for end-to-end (E2EE) encrypted rooms. Unfortunately, while libQuotient, the library NeoChat uses for dealing with the Matrix protocol, had some pre-existing support for E2EE, it was not in a functional state at that time and was thus not enabled by default.</p> <p><img src="https://tobiasfella.de/blog/neochat-e2ee/encrypted-messages.png" alt="" /></p> <h2 id="history">History</h2> <p>Early in 2021, Carl and I were made aware of <a href="https://nlnet.nl/">NLnet</a>, a dutch foundation that sponsors many open source projects, and decided to apply for some funding there to expedite the development process. Fortunately, the application process at NLnet is very light-weight, so there isn't a lot of risk involved in applying for funding. A while after sending our application, NLnet got back to us with the good news that they would indeed be funding E2EE work for NeoChat and libQuotient.</p> <p>The actual development work started with creating Qt-Style bindings for libOlm, the library that provides implementations of the cryptographic functions required for implementing end-to-end encryption in matrix. Most of this work was done by Carl and is now merged into libQuotient.</p> <p>Building on this foundation, we implemented support for reading and sending encrypted messages into libQuotient. This includes support for all of the different types like texts, images, files, audio and others. By integrating this into libQuotient, this is almost completely transparent to the actual application, meaning that for the most part, app developers building on top of libQuotient do not need to do extra work for supporting E2EE. There are some parts, like loading images and notifications, that will need slight adaptions from how they were implemented before supporting E2EE. If you, as an app developer, have questions about those, come talk to us in <a href="https://matrix.to/#/#quotient:matrix.org">#quotient:matrix.org</a>.</p> <p>The last part of end-to-end encryption that has been implemented so far is device verification. Device verification allows users to verify that their devices are actually who they claim they are and are not subject to, for example, a man-in-the-middle attack.</p> <h2 id="what-works-right-now">What works right now</h2> <p>For this to work, you need to use a dev-branch build of libQuotient with the correct build flags and a build of NeoChat from the master branch. (You will not find the correct versions of libQuotient or NeoChat in your package manager yet; if you do, please tell the packagers not to ship them yet 😃).</p> <p>NeoChat can show <strong>new</strong> messages in all of your encrypted rooms and send useful notifications for them. It can also send all types of messages in those rooms, including through the Quick-Reply feature KNotifications offers on some platforms.</p> <p>You can also verify your other devices by comparing emojis. This can be started either from a different client or from NeoChat's device settings page. <img src="https://tobiasfella.de/blog/neochat-e2ee/session-verification.png" alt="" /></p> <p>There is one known bug that sometimes causes the first message sent from a megolm session (this typically means the first message sent from a specific device) to not be decryptable. This is purely a UI bug and restarting NeoChat should fix it. This is actually a bug in Qt that will hopefully be fixed upstream soon.</p> <h2 id="coming-soon">Coming soon</h2> <p>The immediate next step is releasing version 0.7 of libQuotient, which will contain all of the previously mentioned features. We're currently in a phase of several beta releases for this, which means that the final release will be coming very soon. At that point, distros will be able to start shipping E2EE-enabled versions of libQuotient and NeoChat. (At this point i should probably mention that this is still not the most mature work and will thus not be enabled by default 😃)</p> <h2 id="next-steps">Next steps</h2> <p>The next features we will implement are:</p> <ul> <li>Cross-signing, which allows users to verify the identity of other users in a simple way.</li> <li>Recovery from undecryptable messages, building on the previous device verification work</li> <li>Secure Secret Storage and Sharing (SSSS), which is a method of securely storing encryption keys server-side, which allows us to load existing messages on a new device.</li> <li>By this time, the matrix community will have probably come up with more amazing things to implement 😃</li> </ul> <h2 id="special-thanks">Special Thanks</h2> <ul> <li>NLnet, for funding this work (Sorry for taking so long!)</li> <li>Alexey Rusakov, maintainer of libQuotient, for spending a lot of his time reviewing my merge requests and a lot of the rest of his time working on libQuotient in general</li> <li>Carl Schwan, for reviewing all of my merge requests and working on NeoChat in general</li> <li>James &amp; Jan, for reporting a lot of bugs, fixing a lot of bugs and adding many new features &amp; improvements</li> <li>Everybody else who uses &amp; tests NeoChat, reports bugs, fixes bugs, implements features, ...</li> </ul> <h2 id="lessons-learned">Lessons learned</h2> <ul> <li>Implementing end-to-end encryption is hard</li> <li>It is also a lot of fun :)</li> <li>Applying for an NLnet grant is easy, you should do it</li> </ul> <h2 id="getting-involved">Getting involved</h2> <p>There's always more things to do in NeoChat. Come talk to us in <a href="https://matrix.to/#/#neochat:kde.org">#neochat:kde.org</a> and have a look at <a href="https://community.kde.org/Get_Involved">community.kde.org/Get_Involved</a>.</p>