Earlier quoted context omitted.
There are some weird people in those issue threads..
What did they say? The comments have been deleted.
[deleted]
Matrix.org hacked
91–100 of 277 posts
Re: Matrix.org hacked
#92I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…
On the first issue opened by the hacker: > Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented. I use agent forwarding daily and had no idea it contained well known security holes. If that's the case, why is the feature available by default?
> I use agent forwarding daily
That's why. It's useful, but you have to be mindful of the security risks involved in using it.
Re: Matrix.org hacked
#93Earlier quoted context omitted.
On the first issue opened by the hacker: > Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented. I use agent forwarding daily and had no idea it contained well known security holes. If that's the case, why is the feature available by default?
SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.
Is there a secure alternative that achieves the same outcome?
Re: Matrix.org hacked
#94The interesting thing for me here is that none of the other homeservers were affected. Despite the weak security on the largest servers, the ecosystem stays alive. Antifragility at its finest.
If I paid monthly for a server and then spent time configuring it, now I would be able to talk to people who pay monthly for their servers and spent time configuring them.
Re: Matrix.org hacked
#95Earlier quoted context omitted.
The hacker is now doing a post-mortem in the GitHub issues of the project: https://github.com/matrix-org/matrix.org/issues
I have just checked quickly the comments and post-mortem, and I start wondering - it seems that the attack itself would be not really possible if Matrix would not be open source (as this would restrict access to the sensitive data)? Is that right?
This is not right at all, the hack was due to an outdated Jenkins instance and could have happened regardless of what other software was running on the infrastructure.
Re: Matrix.org hacked
#96Earlier quoted context omitted.
Unfortunately not on Macs :( That's one of the features I miss the most when using terminals on a Mac.
Works fine here (Terminal.app + bash 5.0.3 from homebrew). Also, isn't that special variable $_ and not $! ?
> Works fine here. Terminal.app + bash 5.0.3 from homebrew.?
Doesn't work for me. Maybe I've broken something on my build? Or maybe you've redefined your keys to emulate the [alt] key?
> Also, isn't that special variable $_ and not $! ?
Sorry I meant `!$` not `$!` (updated my post accordingly).
Yes, $_ does the same thing too.
Re: Matrix.org hacked
#97The interesting thing for me here is that none of the other homeservers were affected. Despite the weak security on the largest servers, the ecosystem stays alive. Antifragility at its finest.
If I paid monthly for a server and then spent time configuring it, now I would be able to talk to people who pay monthly for their servers and spent time configuring them.
Alternatively, if you paid monthly to any hosting provider, you could be talking with customers of any other hosting providers.
And if there were any other hosting providers that came doing such shoddy things in their production systems, they would be wiped out of the ecosystem, but the ecosystem would still be alive.
Just like email, or phone lines... antifragile.
Re: Matrix.org hacked
#98Earlier quoted context omitted.
SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.
Is there a secure alternative that achieves the same outcome?
`ProxyJump`
Re: Matrix.org hacked
#99Earlier quoted context omitted.
On the first issue opened by the hacker: > Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented. I use agent forwarding daily and had no idea it contained well known security holes. If that's the case, why is the feature available by default?
SSH agent forwarding makes your ssh-agent available to (possibly some subset of) hosts you SSH into. This is its purpose. Unfortunately, it also makes your ssh-agent available to (possibly some subset of) hosts you SSH into.
I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.
Re: Matrix.org hacked
#100I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…
There are some weird people in those issue threads..
checking in as an internet weird person here, any time you have a platform that synthesizes anonymity with collaboration/social interaction, weirdos like us are gonna pop out like clockwork because we find a safe haven for our, uh, weird stuff. a place to not be judged or whatever. i think the sjw type terminology for it is a safe space. and of course due to the human element being so easily corruptible, many people do also tend to use such things for illicit purposes.
hey anybody else remember the days of T-Philez?