HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
matrix-org
matrix-spec-proposals
Python2015–2026
matrix-org / matrix-spec-proposals

matrix-spec-proposals

Proposals for changes to the matrix specification

57Distinct people
182Mentions
4Explicit recommenders
1.3KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Proposals for changes to the matrix specification

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

Yup. One of the biggest learnings of E2EE in Matrix is that the complexity is 95% user experience. However, in Element X, we've been determined to get it right - although there…

Arathorn used a recommendation phrase. 4 indexed comments match. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 4:00:59 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year182 dated mentions

Observed mentions: 2015-02-05 16:06:38 UTC to 2026-09-14 14:52:42 UTC.

010203040502015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 29 mentions; 0 submissions, 29 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 27 mentions; 0 submissions, 27 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 49 mentions; 2 submissions, 47 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 28 mentions; 1 submissions, 27 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 14 mentions; 0 submissions, 14 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 10 mentions; 0 submissions, 10 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 11 mentions; 0 submissions, 11 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC202
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC404
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC303
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC202
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC29029
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC27027
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC49247
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC28127
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC14014
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC10010
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC11011
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC303

From the project README

An excerpt from the repository, fetched Nov 12, 2026.

Read the project’s introduction
Matrix Specification Proposals This repository contains proposals for changes to the Matrix Protocol, aka "Matrix Spec Changes" (MSCs). The proposals directory contains MSCs which have been accepted. See below for instructions for creating new proposals. See also https://spec.matrix.org/proposals/ for more information on the MSC process, in particular https://spec.matrix.org/proposals/#process. The source of the Matrix specification itself is maintained at https://github.com/matrix-org/matrix-spec. The Matrix Spec Process An MSC is meant to be a technical document that unambiguously describes a change to the Matrix Spec, while also justifying why the change should be made. The document is used both to judge whether the change should be made as described and by developers to actually implement the changes. This is why it's important for an MSC to be fully fleshed out in technical detail, as once merged it's immediately part of the formal spec (even though it still needs to be transcribed into the actual spec itself). What changes need to follow this process? In most cases a change to the Matrix protocol will require an MSC. Changes that would not require an MSC are typically small and uncontentious, or are simply clarifications to the spec. Fixing typos in the spec do not require an MSC. In most cases, removing ambiguities do not either. The exception may be if implementations in the ecosystem have differing views on clarifying the ambiguity. In that case, an MSC is typically the best place to reach consensus. Ultimately, the Spec Core Team have the final say on this, but generally if the change would require updates to a non-insignificant portion of the Matrix implementation ecosystem or would be met with contention, an MSC is the best route to take. You can also ask in the Matrix Spec or Office of the Spec Core Team Matrix rooms for clarification. Summary of the process The MSC process consists of three basic steps: Write up the proposal in a markdown document. (There's a proposal template, but don't feel bound by it.) Submit it as a Pull Request to this repo, marking it as a draft until it's ready for wider review. Seek review from the community. Once people are generally happy with it, ask the Spec Core Team to look at it in the Office of the SCT Matrix room. When the SCT are happy with the proposal, and after a successful voting process, your pull request is merged and the MSC is now officially accepted as part of the Matrix Spec and can be used 🎉 For simple changes this is really all you need to know. For larger or more controversial changes, getting an MSC merged can take more time and effort, but the overall process remains the same. Below is various guidance to try and help make the experience smoother. Guidance on the process 1. Writing the proposal Come up with an idea. The idea can be for anything, but the solution (MSC) needs to benefit the Matrix ecosystem rather than yourself (or your company) specifically. Sometimes this means that the solution needs to be more generic than the specific itch that you are trying to scratch. Remember that an MSC is a formal technical document which will be used by others in the wider community to judge if the proposal should be accepted and to actually implement the changes in clients and servers. This means that for an MSC to be accepted it should include justifications and describe the technical changes unambiguously, including specifying what happens in any and all edge cases. There's a proposal template under docs/0000-proposal.md, but you don't necessarily need to use it. Covering the same major points is fine. Note: At this stage, you won't have an MSC number, so feel free to use 0000, XXXX, or whatever other placeholder you feel comfortable with. Some tips for MSC writing: Please wrap your lines to 120 characters maximum. This allows readers to review your markdown without needing to horizontally scroll back and forth. Many markdown text editors have this feature. If you are referencing an existing endpoint in the spec, or another MSC, it is very helpful to add a link to them so the reader does not need to search themselves. Examples: "This MSC proposals an alternative to MSC3030." "A new field will be added to the response body of /_matrix/client/v3/sync". Note: it is best to link to the latest stable version of the spec (e.g. /v1.3, not /latest) - failing that, /unstable if the change is not yet in a released spec version. GitHub supports rendering fancy diagrams from text with very little effort using Mermaid. See this guide for more information. Take a look at the MSC Checklist. When it comes time for the Spec Core Team to review your MSC for acceptance, they'll use the items on this checklist as a guide. 2. Submitting a Pull Request Open a Pull Request to add your proposal document to the proposals directory. Note that this will require a GitHub account. Mark your Pull Request as a draft for now. The MSC number is the number of the pull request that is automatically assigned by GitHub. Go back through and edit the document accordingly. Don't forget the file name itself! Edit the pull request title to fit the format "MSC1234: Your proposal title". Once your proposal is correctly formatted and ready for review from the wider ecosystem, take your Pull Request out of draft status. The Spec Core Team will notice this and apply various labels/status tracking to your MSC, which will announce it to the wider world. 3. Seeking review Seek review from the Matrix community. Generally this will happen naturally, but if you feel that your proposal is lacking review then ask for people's opinion in the Matrix Spec room on Matrix. Reviews can take many forms, and do not need to be done solely by members of the Spec Core Team. Getting other people who are familiar with the area of Matrix you are proposing changes to is a great first step; especially those who may be implementing these changes in clients and/or homeservers. While
Read the full README on GitHub

What Hacker News says

28 sources
> larger orgs currently building on Matrix would feel victim of a rug-pull or a bait & switch Fair. The bait and switch could be avoided by grandfathering in current orgs. A more hands-off, related idea is that you could come up with an unenforced, suggested payment. Essentially consider what an ideal economically sustainable licensing system would look like, and publish that as a suggested donation. > We've always aimed to avoid Matrix being pay-to-play (e.g. eschewing tokenisation schemes). I agree with eschewing pay-to-play or plopping some half-assed crypto grift on top (or what some would call a "tokenization scheme"). I would dispute characterizing my suggestion as pay-to-play, as payment wouldn't be required to use the system. It should be totally up to the user how much to set their bounty at, including zero if they're willing to
Read the rest
accept the greater amount of spam (or wish to use some other spam filtering method). The idea here isn't for anybody to make any money off of getting messages (the money would just be returned if the receiver accepted the message as non-spam), it's just to make large scale spammers lose money. > Instead, the angle we've taken has been to let users publish and subscribe to reputation feeds (a bit like email DNSBLs, but more transparent and less of a shakedown) in order to empower users to block stuff they don't want to see. That makes sense as a feature generally, although I think its solving for a different sort of problem. The blocklist seems like it would work best for allowing users to cultivate a particular culture (i.e. subscribe to a blocklist for those who use excessive profanity, or talk about certain undesired topics, etc.). But a "Nigerian prince" style spammer can make new accounts and blast out messages faster than you can identify and add them to a blocklist. However if it on-average costs that spammer $2 per message that they're unlikely to get back, it suddenly becomes prohibitively expensive to engage in that type of behavior. > But perhaps one could combine the two ideas: you could have a personal rep list which users pay to be on, and you get the payment if they turn out to be spammers - similar to systems like https://www.bbc.com/worklife/article/20181023-people-pay-20-.... Hmm, that's an interesting modification. I'll need to chew more on the incentives. I would say the approach in that article is closer to my original suggestion, except instead of the money actually going to charity it would just go back to the sender once the author replied to their message. > Much like email, i'm not sure these semantics should be baked into the protocol itself. (But the infrastructure to support it could be - thus MSC2313: https://github.com/matrix-org/matrix-spec-proposals/blob/msc...) When I look at that proposal, it seems to me like it's "baked into the protocol itself" insofar as its proposing how to use existing room primitives (namely state events) to implement the concept.
In This Year in Matrix
> Have you guys considered changing the licensing to require larger organizations to contribute financially to the protocol? Yes, but the concern is that this would chill Matrix network growth - e.g. larger orgs currently building on Matrix would feel victim of a rug-pull or a bait & switch. Whereas Matrix's success depends on it spreading as far and wide as possible... while somehow preventing a tragedy of the commons. We haven't ruled this out, though, if other attempts at funding fail. > There's an idea out in the ether of solving spam by allowing users to set a bounty to send them a message, which is returned to the sender if the user accepts the message as non-spam. This is an interesting one. We've always aimed to avoid Matrix being pay-to-play (e.g. eschewing tokenisation schemes). Instead, the angle we've taken has been to let u
Read the rest
sers publish and subscribe to reputation feeds (a bit like email DNSBLs, but more transparent and less of a shakedown) in order to empower users to block stuff they don't want to see. But perhaps one could combine the two ideas: you could have a personal rep list which users pay to be on, and you get the payment if they turn out to be spammers - similar to systems like https://www.bbc.com/worklife/article/20181023-people-pay-20-.... Much like email, i'm not sure these semantics should be baked into the protocol itself. (But the infrastructure to support it could be - thus MSC2313: https://github.com/matrix-org/matrix-spec-proposals/blob/msc...)
In This Year in Matrix
Disappearing messages are due to land this coming year - https://github.com/matrix-org/matrix-spec-proposals/blob/mat... is the spec for it. For metadata protection, we're relying on P2P Matrix (https://arewep2pyet.com) - as if there are no servers (or if the servers are dumb store & forward servers like Signal's) then there's very little metadata. And yes, S&F servers could replicate sealed sender - or even rattle through a mixnet to provide proper traffic analysis resistance (so better than Signal :)
In This Year in Matrix
Gematik co-funded the most recent Matrix audit of vodozemac[1], and is poised to fund 3 more (of matrix-rust-sdk-crypto, matrix-rust-sdk and the whole stack end-to-end) to ensure the E2EE is where it needs to be. So I'd say that the German government definitely cares about E2EE for its civil servants, and we're very grateful for them funding security research. Meanwhile, BWI is helping fund the work needed to address clientside controlled room membership (https://github.com/matrix-org/matrix-spec-proposals/pull/391...) as highlighted in your paper, as well as TOFU... and they're also funding work to provide MLS as an option for E2EE in Matrix too[2]. Unsure why you're talking about the unexploitable IND-CCA break :) [1] https://matrix.org/blog/2022/05/16/independent-public-audit-... [2] https://www.golem.de/news/bwmessenger-vom-messenger
Read the rest
In BundesMessenger, a secure messenger for Germany’s public administration
We (the matrix team) addressed the implementation vulnerabilities discussed here back in September: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en.... The only pending work is switching to TOFU (trust on first use) and client-controlled room membership. Currently users get warned if a malicious device or user gets added to a room by a malicious server (assuming users in the room are verified). However, rather than warning, we could block it outright - but this is nontrivial as it means clients have to independently replicate the group membership semantics the server currently handles, which are complicated in a decentralised environment. https://github.com/matrix-org/matrix-spec-proposals/blob/fay... is the work ongoing to shift membership to be controlled clientside, and https://github.com/matrix-org/matrix-spec-proposals/b
Read the rest
lob/fay... is the work ongoing to shift to TOFU. Meanwhile, this work is blocked behind switching to matrix-rust-sdk-crypto across Element on Web, iOS and Android, so we only fix this in one (audited) place - and can also build on the newly audited vodozemac implementation of Matrix’s encryption: https://matrix.org/blog/2022/05/16/independent-public-audit-.... This work is going well though - I for one have been dogfooding ElementR (Element with rust-sdk-crypto) on iOS as my daily driver for the last week, and we should be releasing it shortly.
In Practically-Exploitable Cryptographic Vulnerabilities in Matrix
I’m sorry - how are we doing a terrible job fixing the issues? We are working solidly to switch Element over to the newly audited vodozemac crypto implementation (https://matrix.org/blog/2022/05/16/independent-public-audit-...), and then implementing both TOFU and client-controlled group membership. https://github.com/matrix-org/matrix-spec-proposals/blob/fay... We are not denying these issues - we just dare to disagree that they are as catastrophic as some suggest.
In End-to-end encrypted messages need more than libsignal
As others have pointed out… > They killed it. It's dead. …is ridiculous hyperbole. This is a debate around the “system warns you when something bad happens” versus “system stops something bad happening in the first place”. It’s like saying SSL is “killed dead” because browsers let you connect to sites with bad certs albeit with a big red warning. And much as this was addressed for SSL with HSTS etc, we’re working on the fix for Matrix. For what it’s worth, the current approach is https://github.com/matrix-org/matrix-spec-proposals/blob/fay... Screaming about Matrix being “killed dead” helps no-one, and risks completely sabotaging our efforts to improve open communication, just in order to score a rhetorical point.
In End-to-end encrypted messages need more than libsignal
No, it's just been a painful problem to solve. If you're interested, you can see the massive discussion around it at https://github.com/matrix-org/matrix-spec-proposals/pull/228.... The implementations have been around for a while, and as it happens we got to consensus on the spec discussion yesterday, and the PRs to enable it by default in Element Web and Synapse landed an hour ago: https://github.com/matrix-org/matrix-js-sdk/pull/2524 https://github.com/vector-im/element-web/pull/22242 https://github.com/matrix-org/synapse/pull/13273
In Element (Matrix) adds video/voice rooms

Showing the 15 most recent of 28 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.