Weekly brief, 2026 week 43

This issue collects five stories, three of them follow-ups to earlier articles, covering 1 to 22 October.

Progress on Session Protocol v2

Session, a messaging app you can register for without a phone number, described the progress of its new Protocol v2 in a blog post on 13 October. Forward secrecy for one-to-one messages (past messages stay unreadable even if keys leak) and post-quantum encryption (encryption designed to resist attacks by future quantum computers) have been implemented in the shared library libsession, and the post-quantum part will use a hybrid design that combines a post-quantum algorithm with the current one. As of 23 October, the apps had shipped only forward-compatibility handling: a message in the v2 format shows up as a placeholder asking the user to update, and the apps cannot yet send v2 messages.

According to the same post, device groups (joining, removal and membership management) are still in development, and the migration plan for existing accounts is still being designed. An account can only switch to v2 once all its linked devices support it, and the switch may then need to be confirmed manually. Session's fundraising post of 8 October states that v2 does not yet have a release date.

In another post on 19 October, Session wrote that Session Router 1.1, the onion routing layer future versions of Session will use to connect to the node network, has added forward secrecy and a post-quantum key exchange. Node operators can choose whether to upgrade for now, and Session recommends that they do. According to the v2 post, Session Router will later become the main transport layer for v2.

Development of Thunderbird for iOS

Thunderbird, the open-source email software, set out the design direction for its iPhone version on its official blog on 1 October, writing that the goal is a first version ready for community testing within the next few months. As of 23 October, the app was not on the App Store, and the GitHub repository's description says the project is in early development and not yet usable. On 23 October, the public TestFlight page (Apple's platform for distributing beta apps) showed the beta as full.

According to the team's replies in the post's comments, iCloud mail accounts can sign in over IMAP with the account password. As of 18 October, sign-in for Google and Microsoft accounts was still an open work item on GitHub. As of 23 October, we found no mention of OpenPGP (the standard for end-to-end encrypted email) support in either the repository or the post. The code is released under the MPL-2.0 licence.

CryptPad 2026.10.0

The autumn release that CryptPad, an end-to-end encrypted collaboration suite, previewed in its summer status report (covered in an earlier article) was published on GitHub on 21 October as 2026.10.0. According to the release notes, this version rewrites CryptPad's server, and the office document editors have moved from OnlyOffice to the compatible Euro Office. Self-hosting administrators should read the upgrade notes before upgrading, because the upgrade involves changes to the reverse proxy configuration and the configuration file is now split in two.

As of 23 October, the official blog had no announcement of this release. The summer status report mentioned that cryptpad.fr would drop French-language customer support, and as of the same day we still could not find a date for it.

PipePipe 5.5.0

PipePipe, the open-source YouTube client covered in an earlier article, released 5.5.0 on GitHub on 21 October. The release notes list multi-select on list pages, regular expression support in keyword filters, and filtering comments by keyword, username or like count. The third-party repository IzzyOnDroid updated to 5.5.0 the same day, while F-Droid's package page still showed 5.4.0 as of 23 October.

Civil rights suit against Florida state troopers

An earlier article covered a civil rights suit in the US District Court for the Middle District of Florida. The plaintiff had been arrested over a hit-and-run and was later not prosecuted, and the case involves license plate reader records. She sued two state troopers, and on 3 August the court stayed the case so that the parties could go to mediation.

The docket on CourtListener (a free database of US court dockets) lists a mediation report on 21 September and an order on 22 October. We could not find the contents of either entry in free public sources, and as of 23 October we had found no news reports of a mediation outcome or of the case resuming.