Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

151–160 of 277 posts

Re: Matrix.org hacked

#151

Post by dvdgsng »

santamarias wrote: post #117
Arathorn wrote: post #53

Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/ . It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secu…

do you have plans to perform an external security audit?

didn't that just happen? ;)

Re: Matrix.org hacked

#152

Post by aidos »

DblPlusUngood wrote: post #116
aidos wrote: post #99

Earlier quoted context omitted.

I never quite understand why there’s not a confirm version. ForwardWithConfirmation or something. I’m active when I need forwarding - would be happy to simply be prompted before it’s allowed.

OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add

Waaaaaaat?! That could definitely be better known.

Re: Matrix.org hacked

#153

Post by nurettin »

hutzlibu wrote: post #127
nurettin wrote: post #121

Earlier quoted context omitted.

Maybe you should just leave this mentality of "if said thing disapproves of somoene's business, the person saying the thing must be opposed to someone in person." behind. Because with this mentality of yours means you have a personal dispute with me. Better disclose that before saying such things.

"means you have a personal dispute with me" I never talked to you, unless you are the same guy who "operates the single federated independent matrix server" and who does have a personal dispute with matrix. It seems you confused your socket accounts? https://news.ycombinator.com/item?id=19418111

No no, what I mean is, world doesn't run on personal vendettas, but rather, ideas. So if you want to be tribal, be tribal about the ideas.

Re: Matrix.org hacked

#154

Post by erikbye »

F30 wrote: post #32
m_b wrote: post #2

For a bit of context: Matrix.org infrastructure has been hacked a second time in 24h, after restoring everything they went down again, story developing here: https://twitter.com/matrixdotorg/status/1116304867683905537

I am highly skeptical when people taking about "rebuilding [the whole] infrastructure" in a few hours. Even more so when restoring all data from breached systems and before a thorough incident analysis. Show me the org which can just pull that off.

This is doable with proper IaC implementation, and if your org does not have RPO/RTO on lock they're doing it wrong.

Events like Matrix experienced now do not lead to panicked frenzy when this is in place.

Re: Matrix.org hacked

#155

Post by SpaceInvader »

jyap wrote: post #20
SpaceInvader wrote: post #15

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

Reason why you would do that (and I often do) is that you have further piping options so it becomes standard work flow and muscle memory. What I usually do is cat the file to inspect it, hit Control+C, then up arrow for previous command, then further pipe and head/tail/grep the file. Starting a grep command is fine if you know that's all you're going to be doing.

that is correct, but this case is obviously different :-)

Re: Matrix.org hacked

#156

Post by wink »

I think it boils down to the fact that infrastructure for projects (no matter the size) is usually a second class citizen at best.

Either no one is eager to care for it, or the people who are actually focused on developing the software run it because they need to, or worst case - no contributor is trusted enough to handle infrastructure work, with access being given even more sparsely than commit rights to the whole software. Which is fine by itself, but there are so many (big) projects where infra is kind of terrible because 3 out 100 people involved are doing all the work. Or don't.

Re: Matrix.org hacked

#157

Post by erikbye »

cjslep wrote: post #5

I believe this is meant to show that it is a targeted attack on the project lead: https://news.ycombinator.com/user?id=Arathorn Unfortunately I don't have any background context for possible reasons why "actual transparency" on the top line is the issue chosen by the attacker, but makes it seem ideologically driven.

As for motivation I don't know, but I would like to state that I have followed the Matrix project for some time and have found it, and the CEO, to be transparent.

Re: Matrix.org hacked

#158

Post by Arathorn »

Arathorn wrote: post #53

Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/ . It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secu…

https://matrix.org/blog/2019/04/11/security-incident/ has just been updated with details on the earlier defacement.

Re: Matrix.org hacked

#159

Post by Arathorn »

santamarias wrote: post #117
Arathorn wrote: post #53

Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/ . It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secu…

do you have plans to perform an external security audit?

yes.

Re: Matrix.org hacked

#160

Post by metafunctor »

syntonym wrote: post #138
metafunctor wrote: post #124

Earlier quoted context omitted.

I know. That's why I asked. Chained agent forwarding will serve your keys just the same, so ProxyJump is not "a secure alternative that achieves the same outcome".

Are you disagreeing with the "secure alternative" or the "same outcome"? I thought the difference between ProxyJump and agent forwarding is the following: Agent forwarding forwards the agent socket to the proxy server. Thus any ssh connection originating from the proxy server can reuse the agent, and with that has the same access to the agent as the originating host. ProxyJump routes the ssh connection through the pr…

I know exactly how agent forwarding and ProxyJump work, but I'm having a hard time understanding what you mean.

ProxyJump proxies your ssh connection, so connecting from A to B via proxy X the connections go A->X and X->B.

You can use AgentForwarding with ProxyJump, in which case agent connections go B->X->A.

I cannot see how ProxyJump would somehow be an alternative to AgentForwarding. You can use both independently.

Post reply on HN