Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

41–50 of 277 posts

Re: Matrix.org hacked

#41

Post by anoncake »

meruru wrote: post #23
SpaceInvader wrote: post #15

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

I do it because it's easier than remembering grep's argument order.

More importantly, it is easier to remember how every tool expects the file argument. cat | foo always works.

Re: Matrix.org hacked

#43

Post by kzcqt »

growt wrote: post #40

I'm probably really out of the loop, but what is matrix.org? Looks like an open source slack clone? Why do they have >5 million user accounts? Is that everybody who uses that chat tool?

Matrix is what happened when somebody looked at XMPP and yelled "NIH".

Re: Matrix.org hacked

#44

Post by pferde »

zaarn wrote: post #18
meruru wrote: post #9

Earlier quoted context omitted.

Disabling read receipts is a client feature. Yes, the currently most mature client doesn't have that feature, but nothing in Matrix precludes it.

There is plenty of other issues with matrix and the reference clients on top of something as simple as mandatory leaking of your presence in a chatroom. I've run a matrix homeserver for almost 3 weeks and it as an utter pain to maintain, despite not a single version upgrade and I was plagued with issues that no chat platform would have if the protocol was remotely sane. edit: That is on top of the numerous security i…

While you bring up valid concerns about the Matrix team's security hygiene, the point of an open standard is that anyone can (try to) spot flaws in it, and anyone can (try to) create their own implementation.

I myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix for anything non-ephemeral - even if it takes years. Perhaps I'll even try my hand at writing a client, if I ever run out of things to do. In the meantime, I will dick around with a throwaway matrix.org account to play with it, and to watch progress happen.

Re: Matrix.org hacked

#45

Post by KitDuncan »

growt wrote: post #40

I'm probably really out of the loop, but what is matrix.org? Looks like an open source slack clone? Why do they have >5 million user accounts? Is that everybody who uses that chat tool?

Matrix is a federated chat protocol. Matrix.org is just one server instance.

Re: Matrix.org hacked

#46

Post by anoncake »

johnchristopher wrote: post #10
GrumpyNl wrote: post #4

Everything gets hacked, period. They have to remove this from there slogan, "An open standard for decentralised secure communication."

Really ? That's a bold claim. Can this string be hacked ? $6$WqQvgIwr$/BA/19FRJZf.z4buUwX5Sbls07ovv/lVZJ3V2En7VgTR4Skdpz98hFNuq3VX4nIaiSDKObO9jKbkPb5tdt7zY1

"Everything" clearly means "Every x for which 'x can get hacked'" is not a type error.

Re: Matrix.org hacked

#47

Post by networked »

SpaceInvader wrote: post #15

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

There are several benefits to it. "cat filename" is a natural starting point for building pipelines interactively one step at a time. It puts the first input on the left side of the command that consumes it. (The alternative of "cmd1 [<]filename | cmd2 ..." does not quite read left-to-right, and some shells do not support "<filename cmd1 | cmd2 ..."; for example, fish doesn't.) When you are done with preliminary testing and want to run the pipeline on a larger amount of data "cat" is quicker to replace with "pv" (and vice versa). You do incur a performance cost with both "cat" and "pv". The command consuming the input also can't seek on it with "cat", but it doesn't matter if you are processing the input one record at a time. If you like the ergonomic benefits, use "cat" until you are optimizing for performance.

Re: Matrix.org hacked

#48

Post by hutzlibu »

zaarn wrote: post #6

Doesn't surprise me that much, Matrix doesn't seem to be too concerned with security, more with security theatre (considering you can still not easily disable read receipts in your client, a major privacy leak IMO, among other issues).

Maybe you should disclose, that you have a personal dispute with the founder of Matrix.

Re: Matrix.org hacked

#49

Post by frou_dh »

meruru wrote: post #23
SpaceInvader wrote: post #15

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

I do it because it's easier than remembering grep's argument order.

Try this then, to hook up the file to grep's stdin directly.

Re: Matrix.org hacked

#50

Post by meruru »

chme wrote: post #34
johnchristopher wrote: post #10

Earlier quoted context omitted.

Really ? That's a bold claim. Can this string be hacked ? $6$WqQvgIwr$/BA/19FRJZf.z4buUwX5Sbls07ovv/lVZJ3V2En7VgTR4Skdpz98hFNuq3VX4nIaiSDKObO9jKbkPb5tdt7zY1

I guess the point is that you cannot protect anything from the future if you don't just destroy it completely.

On that note, the matrix.org server currently doesn't delete messages from rooms that have become empty. It probably would be a good idea to do so.
Post reply on HN