Matrix.org hacked • Hacker News Board

Re: Matrix.org hacked

#61

Post by shpx » Fri, Apr 12, 2019, 9:09 AM UTC

laumars wrote: post #52

jyap wrote: post #20

Earlier quoted context omitted.

Reason why you would do that (and I often do) is that you have further piping options so it becomes standard work flow and muscle memory. What I usually do is cat the file to inspect it, hit Control+C, then up arrow for previous command, then further pipe and head/tail/grep the file. Starting a grep command is fine if you know that's all you're going to be doing.

You can use Bash (and I assumed it works in zsh too) variables to save you there. eg grep something !$ `!$` will be replaced with the last parameter of the previous command. Crude example cat /etc/hosts grep 12.34.56.78 $! # will be executed as grep 12.34.56.78 /etc/hosts I find this extremely useful for when I'm cat'ing a file to get a sense of it's output then wanting to do something more meaningful with it in the…

You can also hit Alt-. to insert the last argument of the previous command.

Re: Matrix.org hacked

#62

Post by meruru » Fri, Apr 12, 2019, 9:10 AM UTC

frou_dh wrote: post #49

meruru wrote: post #23

Earlier quoted context omitted.

I do it because it's easier than remembering grep's argument order.

Try this then, to hook up the file to grep's stdin directly.

Neat!

Re: Matrix.org hacked

#63

Post by atsjie » Fri, Apr 12, 2019, 9:11 AM UTC

m_b wrote: post #11

m_b wrote: post #2

For a bit of context: Matrix.org infrastructure has been hacked a second time in 24h, after restoring everything they went down again, story developing here: https://twitter.com/matrixdotorg/status/1116304867683905537

The hacker is now doing a post-mortem in the GitHub issues of the project: https://github.com/matrix-org/matrix.org/issues

> Escalation could have been avoided if developers only had the access they absolutely required and did not have root access to all of the servers. I would like to take a moment to thank whichever developer forwarded their agent to Flywheel.

I'd feel so small if I were this developer right now :-|

A couple of his issues appear to have to do with the use of SSH. An Ops-guy whom I worked with had setup a bastion host with ip whitelisting that automatically shut down after 1 hour. He didn't like it as his credo was "if you're using SSH when using a cloud provider you're probably doing something wrong"; meaning to say you should automate and be able to recreate any infra at all times with logs accessible without the need for SSH. I never forgot that.

Re: Matrix.org hacked

#64

Post by est31 » Fri, Apr 12, 2019, 9:12 AM UTC

growt wrote: post #40

I'm probably really out of the loop, but what is matrix.org? Looks like an open source slack clone? Why do they have >5 million user accounts? Is that everybody who uses that chat tool?

I recommend this video for you: https://www.youtube.com/watch?v=C2eE7rCUKlE

It describes not just Matrix in the French state (like in the title), it also covers the Matrix 1.0 release and what they want to do with the project (e.g. they eventually want to shut down matrix.org once the ecosystem is mature).

Re: Matrix.org hacked

#65

Post by nukeop » Fri, Apr 12, 2019, 9:13 AM UTC

The Github issues created by the hacker just got wiped clean, I guess they want to censor any negative opinions users may have about the quality and security of their service.

Re: Matrix.org hacked

#66

Post by snvzz » Fri, Apr 12, 2019, 9:13 AM UTC

4chan is circulating this picture. It shows the defaced website frontpage.

https://i.4cdn.org/g/1555048975736.png

I have a hard time with the idea that they run the webserver and the matrix server on the same computer. (Regarding users.txt)

It seems they do urgently need to hire capable infrastructure people.

Re: Matrix.org hacked

#67

Post by laumars » Fri, Apr 12, 2019, 9:15 AM UTC

shpx wrote: post #61

laumars wrote: post #52

Earlier quoted context omitted.

You can use Bash (and I assumed it works in zsh too) variables to save you there. eg grep something !$ `!$` will be replaced with the last parameter of the previous command. Crude example cat /etc/hosts grep 12.34.56.78 $! # will be executed as grep 12.34.56.78 /etc/hosts I find this extremely useful for when I'm cat'ing a file to get a sense of it's output then wanting to do something more meaningful with it in the…

You can also hit Alt-. to insert the last argument of the previous command.

Unfortunately not on Macs :(

That's one of the features I miss the most when using terminals on a Mac.

Re: Matrix.org hacked

#68

Post by nukeop » Fri, Apr 12, 2019, 9:16 AM UTC

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

It ruins the trust completely if something presenting itself as a way to communicate safely and securely is itself ridden with so many security problems. I know I won't be using matrix for anything sensitive anymore.

Re: Matrix.org hacked

#69

Post by tannhaeuser » Fri, Apr 12, 2019, 9:17 AM UTC

pferde wrote: post #44

zaarn wrote: post #18

Earlier quoted context omitted.

There is plenty of other issues with matrix and the reference clients on top of something as simple as mandatory leaking of your presence in a chatroom. I've run a matrix homeserver for almost 3 weeks and it as an utter pain to maintain, despite not a single version upgrade and I was plagued with issues that no chat platform would have if the protocol was remotely sane. edit: That is on top of the numerous security i…

While you bring up valid concerns about the Matrix team's security hygiene, the point of an open standard is that anyone can (try to) spot flaws in it, and anyone can (try to) create their own implementation. I myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix for anything non-ephemeral - even if it takes years. Perhaps I'll even try my hand at writing a c…

> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix

Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period.

It's not so much a technical question as it is the attitude of "hey we're implementing our own chat protocol cause XML sucks". Totally not getting the point why users and developers would want to use standard protocols - to save their efforts becoming obsolete, taken over by a single entity, or both. It doesn't help either that scarce development resources are needlessly fragmented between XMPP and matrix.

That said, if the matrix protocol can actually manage to attract users and multiple implementations some years down the road (about 30-40 years after IRC), more power to them.

Re: Matrix.org hacked

#70

Post by rglullis » Fri, Apr 12, 2019, 9:21 AM UTC

The interesting thing for me here is that none of the other homeservers were affected. Despite the weak security on the largest servers, the ecosystem stays alive.

Antifragility at its finest.