Roadmap

What is not done, in roughly the order it matters. Listed here rather than left for someone to discover in the source. Items move to features when they ship, not when they are started.

Cutting off one person without a stable name for them

Blocking a single sender used to mean changing the key everyone uses and handing the new one to every contact you still wanted to hear from — so in practice nobody ever did it. On Android, out now, each contact gets their own book of one-use tickets, and cutting one person off is tearing up their book. Nobody else notices, and the server sees a different ticket every time rather than one name it can follow you by.

What is left is the part the specification calls for and this does not do. A server that keeps a note of when each ticket was handed in could group a book together, and that is one sender; and tearing a book up tells it those tickets belonged together. Closing both needs a piece of mathematics — §21 names it — that proves you are allowed to write to somebody without revealing which permission you hold. We would want somebody who has built that before to read ours before it went near a real conversation, because the failure mode is that it quietly accepts everything.

External audit

No third-party audit has been done. This is the one item on this list that cannot be closed by writing code — it needs a firm and a budget, which is what donations are for.

What has been done is the preparation: a scope document setting out the trust boundaries, the assets in order of consequence, what is deliberately out of scope, and five falsifiable claims we would like attacked. Auditors spend their first hours working out what a system is; that part is now given away rather than paid for twice.