HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
Nheko-Reborn
nheko
C++2019–2025
Nheko-Reborn / nheko

nheko

Desktop client for Matrix using Qt and C++20.

11Distinct people
16Mentions
0Explicit recommenders
2.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Desktop client for Matrix using Qt and C++20.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year16 dated mentions

Observed mentions: 2019-01-17 15:16:57 UTC to 2025-07-29 02:42:08 UTC.

012342019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC413
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC202
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC312
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC202
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC211
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

What Hacker News says

16 sources
Just be aware that Nheko has still uses the deprecated libolm (which has known security issues and is unmaintained) and the maintainers have said they are not interested in moving to the supported replacement library[1] for the past year. As a fellow Matrix user, I would be cautious about using E2EE with any third-party clients -- the history of issues for the past decade speaks for itself. [1]: https://github.com/Nheko-Reborn/nheko/issues/1786
In Why not Matrix (2023)
Unfortunately, they still use libolm[1] for e2ee which is deprecated[2] and has known security issues[3]. The maintainers appear to not be interested in switching to the newer Rust-based library. Matrix argue that the timing channel attacks are not possible over a network, but the history of timing channel attacks argues that this very few protocols are this fortunate (most people thought timing attacks against TLS were impossible too, until someone bothered to attack them). [1]: https://github.com/Nheko-Reborn/nheko/issues/1786 [2]: https://matrix.org/blog/2024/08/libolm-deprecation/ [3]: https://soatok.blog/2024/08/14/security-issues-in-matrixs-ol...
In Matrix v1.15
As a native programmer who meddles with the horrors of thread safety and & and &mut, and occasionally dabbles in high-level (JS/Dart) asynchronity, async functions fill me with much of the same fear and caution. await looks like merely a nonblocking function call, but means arbitrary code executes and can and will mutate arbitrary state under your feet. Shared state across coroutines is nearly as dangerous as shared state across threads, and (I conjecture) far more pervasive. In the code in question (https://web.archive.org/web/20220113153505/https://web.dev/f..., now changed in https://web.dev/file-system-access/#drag-and-drop-integratio...): elem.addEventListener('drop', async (e) => { // Prevent navigation. e.preventDefault(); // Process all of the items. for (const item of e.dataTransfer.items) { // Careful: `k
Read the rest
ind` will be 'file' for both file // _and_ directory entries. if (item.kind === 'file') { const entry = await item.getAsFileSystemHandle(); if (entry.kind === 'directory') { handleDirectoryEntry(entry); } else { handleFileEntry(entry); } } } }); I probably wouldn't have guessed that `e.dataTransfer.items` gets cleared at the first await (since I'm not a proficient web developer), but I would've been extremely wary of this code in general. Additionally (not tied to async-await but race conditions in general), is `item.getAsFileSystemHandle()` a TOCTTOU vulnerability where the type of an item can change between folders and files and symlinks etc., while this code is running? Rust's & vs. &mut system largely eliminates shared state hazards in both threading and asynchronity (&mut is exclusive/unaliased and can't be mutated by other threads or event loop jobs, and & is difficult and unidiomatic to mutate), though it doesn't solve async cancellation errors (https://carllerche.com/2021/06/17/six-ways-to-make-async-rus..., discussed at https://news.ycombinator.com/item?id=27542504), or filesystem TOCTTOU (https://blog.rust-lang.org/2022/01/20/cve-2022-21658.html as well as user code). Qt event loop reentrancy is fun(tm) as well. It looks like a blocking call, but spawns a nested event loop which can do anything (but rarely enough to lull you into a false sense of complacency), resulting in segfaults like https://github.com/Nheko-Reborn/nheko/issues/656 (workaround at https://github.com/Nheko-Reborn/nheko/commit/570d00b000bd558..., I didn't look into it). And Qt lacks "easy" await syntax and a framework based on calling red functions (though I didn't look into C++20 coroutines yet, perhaps https://www.qt.io/blog/asynchronous-apis-in-qt-6 or https://github.com/mhogomchungu/tasks or https://blog.blackquill.cc/asynchronous-qtquick-uis-and-thei...?).
In Using files with browsers, in reality
> So forcing everyone to think about ownership because maybe they are writing concurrent code (then again maybe they aren't) so that "congrats your memory management problems are solved" seems like a Pyrrhic victory--you've already blown their brain cells on the wrong problem. https://manishearth.github.io/blog/2015/05/17/the-problem-wi... argues that "[a]liasing with mutability in a sufficiently complex, single-threaded program is effectively the same thing as accessing data shared across multiple threads without a lock". This is especially true in Qt apps which launch nested event loops, which can do anything and mutate data behind your back, and C++ turns it into use-after-free UB and crashing (https://github.com/Nheko-Reborn/nheko/issues/656, https://github.com/Nheko-Reborn/nheko/commit/570d00b000bd558...). I find Rust code easier to
Read the rest
reason about than C++, since I know that unrelated function calls will never modify the target of a &mut T, and can only change the target of a &T if T has interior mutability. Nonetheless the increased complexity of Rust is a definite downside for simple/CRUD application code. On the other hand, when a programmer does write concurrent code with shared mutability (in any language), in my experience, the only way they'll write correct and understandable code is if they've either learned Rust, or were tutored by someone at the skill level of a Solaris kernel architect. And learning Rust is infinitely more scalable. Rust taught me to make concurrency tractable in C++. In Rust, it's standard practice to designate each piece of data as single-threaded, shared but immutable, atomic, or protected by a mutex, and separate single-threaded data and shared data into separate structs. The average C++ programmer who hasn't studied Rust (eg. the developers behind FamiTracker, BambooTracker, RtAudio, and RSS Guard) will write wrong and incomprehensible threading code which mixes atomic fields, data-raced fields, and accessing fields while holding a mutex, sometimes only holding a mutex on the writer but not reader, sometimes switching back and forth between these modes ad-hoc. Sometimes it only races on integer/flag fields and works most of the time on x86 (FamiTracker, BambooTracker, RtAudio), and sometimes it crashes due to a data race on collections (https://github.com/martinrotter/rssguard/issues/362).
In A single line of code made a 24-core server slower than a laptop
Oh no problem at all -- I think it's a great counterpoint to closed ecosystems like Signal and Discord which are actively hostile to third party clients. If you don't like Electron, you're free to choose an alternative desktop client like Fractal (https://wiki.gnome.org/Apps/Fractal) or NeoChat (https://invent.kde.org/network/neochat) or Nheko (https://github.com/Nheko-Reborn/nheko). Or on the mobile side, FluffyChat (https://fluffychat.im/) and Nio (https://nio.chat/) are both solid alternatives. If you're coming from IRC, there's a WeeChat plugin (https://github.com/poljar/weechat-matrix) or a standalone terminal client called Gomuks (https://github.com/tulir/gomuks). It's still early days, but Element is genuinely committed to Matrix's success as an open protocol, and I find the community enthusiasm to be very encouraging.
In Update on beta testing payments in Signal
Apart from the official official clients: weechat-matrix: https://github.com/poljar/weechat-matrix/issues/188 (doesn't support cross-signing) weechat-matrix-rs: https://github.com/poljar/weechat-matrix-rs/tree/9c249f14038... (build failing, would be surprised if it supported cross-signing) Mirage: https://github.com/mirukana/mirage/issues/32 (no support for cross-signing) Nheko: https://github.com/Nheko-Reborn/nheko/issues/70 (automatically accepts keys as far as I understand) gomuks: https://github.com/tulir/gomuks/pull/154 (seems to be the only mention of encryption, I don't see verification of keys or cross-signing) Seaglass: https://github.com/neilalexander/seaglass/tree/dc97893343407... (seems to support e2e, but unfortunately macOS only) OCRCC Chatbox: https://github.com/nomadic-labs/ocrcc-chatbox (404, couldn't find it) FluffyChat
Read the rest
Flutter: https://gitlab.com/ChristianPauly/fluffychat-flutter/-/tree/... (might support cross-signing, first client that I could actually use) Daydream: https://github.com/daydream-mx/Daydream/issues/11 (sounds to me like there's still some way to go) Can you please not say that it's "completely untrue and disingenuous"? To me, working end-to-end encryption means that I can verify my own and other devices. Out of these, maybe Seaglass (macOS only) and FluffyChat Flutter support end-to-encryption in a way that I would use them. That's not "loads of Matrix implementations". Can you recommend a non-official client with end-to-end support including cross-signing and device verification?
In Matrix – An open network for secure, decentralized communication
There are a bunch of very promising native desktop Matrix clients in progress: https://github.com/Nheko-Reborn/nheko as a Qt telegram-like https://github.com/quotient-im/Quaternion as a Qt xchat-like https://github.com/manuroe/messagerie for instance is a SwiftUI client proof-of-concept that should work on macOS as well as iOS None are as polished as Riot functionalitywise, but we will get there eventually - even more so if people contribute.
In Synchronous Messaging at Mozilla: The Decision
Riot/iOS is already native, and works pretty well, so will likely evolve to behave more like RiotX as time goes on rather than getting rewritten. RiotX is trying to be something that starts off feeling like WhatsApp or Telegram, but can expand into IRC/Discord/Slack for powerusers. Who knows if it'll work. For native desktop apps, there are a bunch of other Matrix clients focused specifically on that domain - e.g. https://neilalexander.dev/seaglass and https://wiki.gnome.org/Apps/Fractal and https://github.com/Nheko-Reborn/nheko and https://github.com/QMatrixClient/Quaternion. Riot/iOS might expand into Riot/macOS though in future (although this is basically what Seaglass is already).
In A free XMPP server powered with green energy

Showing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.