Development Update - Stability Fixes and Network Improvements

The launch of Session Pro is temporarily on hold while discussions are underway with an allied privacy ecosystem that wants to support Session's long-term sustainability. In the meantime, development is progressing on external payment gateways, so that Session users have payment options beyond the Apple and Google app stores once Pro launches.

Through September, development focused on fixes for the next Session release, networking improvements and continued consolidation of core functionality into libsession.

The next Session release

The launch of Session Pro is temporarily on hold while discussions with an allied privacy ecosystem are underway. As these discussions may affect how Session Pro is offered and supported, the launch will resume once details are finalized. Session’s developers look forward to sharing more details with the community. 

While the recently submitted Session Pro Beta release was approved by both the Apple App Store and Google Play Store, this release will be removed. Instead, a new version of Session has been submitted, with push notification and networking stability fixes on iOS, fixes for path, group membership and group deletion issues on Android, and a range of smaller fixes and stability improvements across both platforms.

Fixes in the next release

Most of the fixes in the next release address message delivery, groups and app stability.

Messages are sent through onion request paths, which route each request through several Session Nodes so that no single node sees both where a request came from and where it is going. On Android, a path could previously be built through the same Session Node it was addressed to, and path rotation could fail to move away from a poorly performing first node. Both have been fixed. On iOS, libsession has been updated to version 1.9.4, which carries further networking fixes, and notifications shown through the fallback path now play a sound again. On all three clients, configuration messages are now renewed at most once an hour per swarm, reducing unnecessary network traffic.

On Android, a duplicate group invitation no longer demotes a member who has already joined. Leaving a group no longer retries indefinitely when its encryption keys are unavailable, and group update messages waiting to send are no longer lost when the app restarts. On all three clients, group entries deleted on one device are no longer restored when configuration from another device is merged in.

On iOS, crashes have been fixed when quitting the app, when sending messages, in the QR code scanner and in the full-screen media viewer. The app also no longer treats an account as new when its stored identity cannot be read. On Android, the app now recovers from certain database errors at startup rather than repeatedly crashing. On all three clients, messages that a given version of Session cannot process are now shown as a placeholder and retained rather than discarded. Voice messages on iOS can now run to five minutes.

Networking and Session Nodes

Libsession versions 1.9.2, 1.9.3 and 1.9.4 were released at the start of October. Along with the fixes above, they improve how clients recover when they contact the wrong swarm or when their list of known Session Nodes is out of date.

Changes were also made to the storage software that runs on Session Nodes. Messages are held on a swarm, the small group of Session Nodes responsible for a given account, and the changes include fixes to how members of a swarm keep messages in sync with one another. Traffic between Session Nodes is moving to QUIC, a modern network transport protocol, replacing the older messaging layer previously used between nodes. This reduces the bandwidth a node uses when joining a swarm or reconnecting after downtime, as messages are synced in smaller batches. It also speeds up delivery of small onion requests, which no longer queue behind large transfers such as file uploads.

The new storage server also contains numerous database performance and thread safety improvements and fixes that significantly reduce disk activity as well as modest reductions in CPU and memory usage, as well as fixed for multiple crashes. These changes will be included in Storage Server 2.12.0, an upcoming voluntary upgrade for Session Node operators.

A new (also voluntary) update of Session Router (1.1.0) will be released at the same time.  Since 1.0.2, Session Router has had a major round of security, reliability and efficiency work. New sessions are now protected with forward secrecy and post-quantum encryption, so recorded traffic stays safe even if keys are compromised later or quantum computers become practical. The underlying QUIC networking library has had a substantial upgrade, which cuts memory use per connection and more reliably finds the optimal packet size for each connection. Relays now share information about the rest of the network more reliably, and clients waste less effort on nodes they can't reach. The code has also been enhanced with various improvements for future embedding directly inside apps such as the future unified Session client more cleanly. Alongside all of this are many smaller fixes to DNS, stability and shutdown behaviour.

We also plan to make these upgrades mandatory in the near future with a mandatory service node upgrade; it is not yet scheduled, but look for more information on this soon.

Groundwork for the unified Session client

Earlier updates described consolidating Session's core functionality into libsession, a single shared library, so that features are written once rather than separately for iOS, Android and Desktop. That consolidation is now building toward a new unified client application.

During September this included a rework of attachment transfers, so that downloads stream to a local cache, saving a file is handled as part of its transfer and requests can be withdrawn when an attachment is deleted. Support was also added for compact image placeholders shown while an image loads, along with clearer rules for how the components of the shared core handle concurrent work.

Session Protocol v2

Session Protocol v2 introduces Perfect Forward Secrecy (PFS) and post-quantum cryptography to Session. Session has been selected for Octant's Epoch 13 Privacy Round, which distributes a 100 ETH matching pool using quadratic funding. Under quadratic funding, the pool is shared out based mainly on how many people donate to a project rather than the total amount raised, so the number of donors matters more than the size of each donation. Funds raised through the round will support Session Protocol v2, covering the rollout of PFS and post-quantum cryptography to iOS, Android and Desktop. They will also help to fund an independent cryptographic review of the design, with the findings published. Donations can be made during the round's allocation period, from October 14 to October 21.

External payment gateways

Community feedback has made clear that ways to pay for Session Pro outside the Apple and Google app stores are essential. External payment gateways are being prepared alongside in-app payments, so that both are ready to launch in close succession when Pro is released.