Attachments and voice notes

In the Matrix workspace, files and voice notes are checked by your organisation before they are sent, and checked again by every reader's browser before anything is shown. You can send a file of any kind, a video included. This page explains what each step does, which files Scrydon can read, and what the labels on an attachment mean.

Send a file

Files wait in the message box until you send them. Select Attach a file (the + at the start of the message toolbar) and choose one or more files. Each file appears as a thumbnail directly above the message text: a picture shows itself, a video shows its first frame under a play symbol, and any other file shows an icon with its name and size. Nothing leaves your browser until you press Send. Choosing a file does not check it, upload it or send it, so you can still change your mind: select the x on a thumbnail (Remove and the file's name) to take it out.

You can add up to 10 files to one message. If you choose or drop more, the first ones are added and the composer says You can send up to 10 files at a time.

Press Send (or Enter) to send. Send is available when the message has text, when it has at least one file waiting, or both. Scrydon then checks the files one at a time, in the order they are shown; each thumbnail shows a spinner while its file is checked, and the composer shows Checking and sending your file…. Scrydon reads each file where it can and applies your organisation's policies to what it read. Only when every file has been cleared are they encrypted and sent to the conversation from your own device, so they appear as sent by you: first your text, then each file, in the order they were shown.

If any file is refused, nothing is sent. Not the text, and not the files that were cleared. The refused thumbnail says why, in the words of the table below, your text stays in the box, and the other files stay where they are. Remove the refused file, or fix the problem and send again. A file that was already cleared is not checked a second time. While files are being checked, the +, the Remove buttons and Send are unavailable.

You can also drop files anywhere on the open conversation, on the messages or on the composer. While they are held over it the conversation says Drop files to add them to your message; press Esc or move them away to cancel. Dropped files are added to the message box exactly like chosen ones and are checked, and refused, for the same reasons when you press Send. Dropping does nothing while the + is unavailable: while files are being sent, while a voice note is being recorded, or while the conversation cannot be written to.

You can also paste files into the message box, for example a screenshot, a copied picture or GIF, or a copied file (Ctrl+V, or Cmd+V on a Mac). A pasted file is added the way a dropped file is, and does nothing in the same situations. If the clipboard holds text as well, the text is still pasted into the box. A paste with only text is unchanged.

Leaving the conversation, or closing it, discards the files that were waiting: they were never uploaded, so there is nothing to clean up. A voice note is the one exception to waiting; see Voice notes.

Scrydon can read some kinds of file to check them:

A file that is not read is not a file that is blocked. Whether it can be sent depends on the conversation, as described next.

Files nothing can read

Some files cannot be read: videos, archives, SVG images, any kind Scrydon does not recognise, and files of a kind your organisation has no reader configured for (for example images, when there is no text recognition). Whether one of these can be sent depends on the conversation it is sent to:

These are the defaults. An administrator can change either one in Settings → Cortex → Settings; see File rules and limits.

When an unread file is allowed, it is sent as it is. Nothing read it, so no policy was applied to its contents, and every reader sees it labelled Not scanned. If Scrydon cannot tell which kind of conversation it is, for example because the server could not be asked, it applies the rule for a shared one.

Scrydon still looks at the file's own bytes to find out what kind of file it is. A file renamed to look like something else is refused, and its size is judged by the kind it really is, not by its name. A file whose type cannot be told from its bytes, such as a web page, a script or a ZIP-based format like an e-book, is sent under the kind its bytes show (text, or a ZIP archive), so a web page is never shown as a page.

Ogg and M4A files are checked for video before they are sent. One that is laid out as ordinary audio is transcribed like any other audio. One with a video track is treated as a video: it is not transcribed, so it is sent only as Not scanned, under the video size limit and the rule above. One laid out in any other way, such as an audiobook with chapters, or anything laid out to hide a video track, is not recognised as audio either. It is not transcribed, so it is sent only as Not scanned, or refused as not matching its type when its name or type says it is audio. Having a soundtrack, or being renamed to look like audio, does not make a file count as audio.

This check is not a defence against data deliberately hidden inside an audio file. Only what the file plays as sound is transcribed and checked against your policies; anything else a file carries, such as cover art embedded in its tags, is not read.

If a file is not sent, its thumbnail says why. It names the rule the file broke, never what was found in it:

Size limit

How large an attachment can be depends on what the file really is:

An administrator can change both limits in Settings → Cortex → Settings, to any whole number of MB from 1 to 64. 64 MB is the most Cortex can send and cannot be raised. MB here means 1,048,576 bytes (1024 × 1024), so 32 MB is exactly 32 × 1024 × 1024 bytes. The composer names the limit that applied when it refuses a file.

The limit applies to the file itself, and Scrydon counts the bytes it actually receives, so a file cannot get past the limit by misreporting its size or its type. A file is judged as a video only when its bytes are a video.

Members who use a different Matrix app upload straight to your homeserver, and Scrydon's check never sees those files. The limits and rules on this page do not apply to them: they are held only to the homeserver's own upload limit, which is 64 MB in a standard Scrydon installation. A file sent that way is still labelled Not admitted for Cortex readers (see below).

Voice notes

Select Record a voice note (the microphone) to start recording, and Stop and send to finish. The recording is sent as an attachment named Voice note.wav, and it goes through exactly the same check as a file you attach: Scrydon transcribes it and applies your policies to the transcript.

• Voice notes are recorded as 16 kHz mono WAV.
• A voice note can be at most about 17 minutes 28 seconds long, which is the most 16 kHz WAV audio that fits in the default 32 MB limit. When a recording reaches that length, Cortex stops and sends it automatically. If your administrator has set the largest file below 32 MB, a long recording can still be refused as too large.
• If you stop before any sound was captured, nothing is sent and the composer says Nothing was recorded, so nothing was sent.
• If the browser does not let Cortex use the microphone, the composer says The microphone could not be started. Check that this site may use it. Allow microphone access for the site in your browser and try again.

A voice note is not held in the message box: stopping the recording checks and sends it at once, and files already waiting in the message box stay there. You cannot add a file while a voice note is recording, and you cannot record while files are being sent.

Labels on an attachment you receive

Any member can write a message claiming that a file was checked. Cortex therefore does not take the message's word for it. Your browser downloads the file with your own credentials, decrypts it, and compares it with the record your organisation kept when it checked the file. A file counts as checked only when all three agree: a record exists for this conversation, it is the record of this exact file, and the file's contents are exactly the ones that were checked. If the record says otherwise, or there is no record, the file is Not admitted. If Cortex could not ask at all, for example because the connection dropped, it says so instead and lets you try again.

A file marked Not admitted is not hidden or blocked. You can still download it, but it is never previewed. Treat it as you would any file from outside your organisation.

One case is stricter. If a file's contents do not match the check its message names, Cortex does not offer the file at all. There is no preview and no download. A message that presents different contents as checked is treated as untrustworthy.

Previews

Images and audio are verified as soon as they appear in the conversation, so they can be previewed. Video is not: nothing is downloaded until you press Play video (see below). Other files are verified when you download them. FLAC audio is verified as soon as it appears too, but it is never previewed: download it to play it.

A file is previewed only when both of these are true:

1. It has no label or is Not scanned. Not admitted files are never previewed.

2. Its contents, which Cortex inspects directly rather than trusting the file name or the type the message claims, are one of these formats:

   Kind	Formats
   Images	PNG, JPEG, GIF, WebP
   Audio	MP3, WAV, Ogg, M4A
   Video	MP4, WebM, Ogg

SVG, HTML and PDF files are never previewed, because they can contain active content. The same applies to any format not in the table, including Matroska and QuickTime video: download the file to open it. Audio plays in an inline player, and voice notes play there too.

Playing a video

A video appears as a Play video button with its name and size. Nothing is downloaded until you press it, so a conversation with several large videos costs nothing until you choose one. The button is unavailable for a moment while Cortex looks up the record of the check.

Pressing the button downloads the video, decrypts it, compares it with the record your organisation kept, and then replaces the button with a player that starts playing. The same rule as for every other file applies: if the video does not match its record, it is labelled Not admitted and does not play. A video sent unread carries the Not scanned label once it has been checked.

Your browser decides whether a video may start by itself. If it does not, the player appears paused: press play. A video that is not MP4, WebM or Ogg inside, whatever it was sent as, has no player and is offered as a download.

Animated GIFs

You can send a GIF the same way as any other image: choose it, or drop it on the conversation, and press Send. Nothing is changed on the way. The GIF is checked, encrypted and sent as it is, with the same size limit and the same policies as every other file, and an animated GIF plays in the conversation. Scrydon does not fetch GIFs from an outside service, so nothing you type is sent to one.

If your operating system or browser is set to reduce motion (for example Reduce motion on macOS, or Show animations switched off on Windows), an animated GIF does not start by itself. Cortex shows its first frame with a Play animation button. Select it to start the animation, and Stop animation to return to the first frame. A GIF with a single frame has nothing to hold, so it is shown as it is. If Cortex cannot find the first frame of a GIF, it shows only the Play animation button until you select it.