The discussion revolves around the potential implementation of Messaging Layer Security (RFC 9420), a recently finalized IETF protocol for scalable end-to-end encrypted messaging, into Discourse chat. Thomas_Rother introduced the idea after attending 37C3, noting its adoption by Webex and likely future use in platforms like Matrix or Signal. sam acknowledged the value but expressed skepticism about feasibility this year, citing resource constraints. jimkleiber asked for cost/time estimates, prompting sam to guess roughly 6 months of engineering to build and 4 months annually to maintain — likely a 1–2 person effort, referencing the “mythical man month” concept sam to caution against overstaffing. jimkleiber sought clarification on what “months of engineering” meant, and Thomas_Rother noted potential funding opportunities via NLnet’s Commons Fund. The thread reflects cautious optimism, tempered by practical constraints around development scope, team size, and sustainability.
I just returned from the 37C3 congress in Hamburg. One of the talks was about the recently published Messaging Layer Security protocol (RFC 9420), it was finalized by IETF in July 2023.
The protocol is already deployed through webex and will most likely be implemented by other commercial and non commercial services (such as Matrix or Signal chat). It may be worth considering for DIscourse chat too.
One second, who’s idea was this???
RFC is at: https://www.rfc-editor.org/rfc/rfc9420.txt
Related chat discussion is at: End-to-end Encryption for Chat
To be honest, I don’t see us having time to implement end-to-end encryption for chat this year.
As someone who would love this feature and also understands it might take a lot of time and money to not only build it but maintain it…and also someone who has no idea how much time and money…but is curious because maybe there could be ways to achieve such goals…
Does anyone have any estimate on how much time/money it might require to build and maintain Discourse chat encryption?
A lot, if I had to guess a number … building is say 6 months of engineering. Maintaining is another 4 months of engineering per year.
But it is very hard to estimate here, I am just going by my gut.
I appreciate that, and maybe a dumb follow-up question, when you say 6 and 4 months of engineering, what do you mean by “months of engineering”?
Is that one person doing 160 hours of work? Many people at 160 hours?
There is a mythical man month at play, this is probably a 1-2 person job, any more would just start slowing this down.
@sam There even could be some funding for such efforts:
