Earlier quoted context omitted.
OpenSSH does have confirmation: use the '-c' switch to ssh-add. https://man.openbsd.org/ssh-add
Waaaaaaat?! That could definitely be better known.
TIL :|
Matrix.org hacked
161–170 of 277 posts
Re: Matrix.org hacked
#162I've been slightly annoyed with matrix ever since they boasted at FOSDEM with the fact that they backdoored their encryption so that the French government could Virus scan sent files. :/
Re: Matrix.org hacked
#163Earlier quoted context omitted.
Grammar and spelling blind spots don't compromise the security of thousands of people. I think if you're going to make such glaring mistakes, you should be able to take a bit of guff for it.
> Grammar and spelling blind spots don't compromise the security of thousands of people Neither does useless use of cat. Or am I missing something that I couldn't read because of a deleted comment?
No you're not, my mistake. Due to the parent comment being flagged, I incorrectly the response as a reply to different comment.
Re: Matrix.org hacked
#164Earlier quoted context omitted.
> The matrix.org homeserver has been rebuilt and is running securely; We should have more bounties. Let users donate and put wallets on servers. Attacker will be able to take these funds. It's a reasonable measure of an infrastructure security.
To avoid perverse incentives, you should also build in some reward for the developers/operators. As in: If the server gets hacked, the money goes to the whitehat. If the server does not get hacked for $TIMEFRAME, the money goes to the people responsible for its security.
Seems perverse to me as well. Might be a better idea to just fund Matrix enough to be able to have at least someone full time on it. With $3 752 per month on Patreon right now I cannot imagine it's a lot after infrastructure costs and taxes. Certainly not enough to let Arathorn or someone go out of his way to get expensive security training.
Re: Matrix.org hacked
#165Earlier quoted context omitted.
While you bring up valid concerns about the Matrix team's security hygiene, the point of an open standard is that anyone can (try to) spot flaws in it, and anyone can (try to) create their own implementation. I myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix for anything non-ephemeral - even if it takes years. Perhaps I'll even try my hand at writing a c…
> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period. It's not so much a technical question as it is the attitude of "hey we're implementing our own chat proto…
> It doesn't help either that scarce development resources are needlessly fragmented between XMPP and matrix.
In my experience, there's virtually no overlap between the two groups, and therefore no fragmentation. And for good reason: XMPP is a nightmare to implement, so there's a significant group of developers that just won't touch it, but that might be interested in working on Matrix.
And yes, part of the blame for that lies in the usage of XML. While XML can be useful to represent complex data or documents, it's unsuitable as an over-the-wire format because it doesn't have a directly mappable representation in most languages, due to the combination of attributes and child nodes.
This problem doesn't exist for JSON, because pretty much every language directly supports arrays, objects/maps and primitives. This makes a JSON-based protocol much more pleasant to work with, as there is less data-wrangling complexity involved.
Re: Matrix.org hacked
#166I like the fact matrixnotorg decided to alert Matrix to Elasticsearch's existence.
But Matrix probably should first figure out how to fix the whole 'all server management ports are open to the internet' problem detailed here: https://github.com/matrix-org/matrix.org/issues/360
The last thing we need is another Elasticsearch instance listening on a public IP accessible to the world.
Re: Matrix.org hacked
#167I'm probably really out of the loop, but what is matrix.org? Looks like an open source slack clone? Why do they have >5 million user accounts? Is that everybody who uses that chat tool?
Matrix is what happened when somebody looked at XMPP and yelled "NIH".
Matrix is what happened when somebody looked at XMPP and yelled "wow, this aged poorly and has some major usability issues".
Re: Matrix.org hacked
#168I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…
On the first issue opened by the hacker: > Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented. I use agent forwarding daily and had no idea it contained well known security holes. If that's the case, why is the feature available by default?
I think an issue here is we've been told for a long time "always restrict access to the environment through a bastion host" without much implementation detail discussed after that. Agent forwarding tends to show up as the most efficient way to implement this.
Re: Matrix.org hacked
#169It's "usless use of cat". He/she should have gone:
`grep arathorn users.txt | head -1`
Instead of:
`cat users.txt | grep arathorn | head -n1`
Hackers these days.
Re: Matrix.org hacked
#170As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D
I do cat x | grep y, because that way you separate out the primary data being passed around and the secondary instructions for how to process it. Preferring functional programming, this is my bread and butter. It´s superior readability and simplicity is something that gets engraved on the inside of your mind after you do a pipe a few hundred times per day every day. This is not about being terse, terseness is almost…
I'm fond of this bashism: `<myfile command | command | etc`