Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Matrix.org hacked

web.archive.org

Post reply on HN
Print view View original

231–240 of 277 posts

Re: Matrix.org hacked

#231

Post by azhenley »

DuskStar wrote: post #230
azhenley wrote: post #31

The hacker seems nice: “Anyways, that's all for now. I hope this series of issues has given you some good ideas for how to prevent this level of compromise in the future. Security doesn't work retroactively, but I believe in you and I think you'll come back from this even stronger than before. Or at least, I hope so -- My own information is in this user table.” https://github.com/matrix-org/matrix.org/issues/365

That gives a 404 now. I'm not enormously happy with GitHub's willingness to completely hide bug reports like this...

I agree. IIRC, the ability to delete Issues is new. There used to be a "Beta" label beside the delete button and prior to that I don't think it was possible (or at least not as easily?).

Looks like it wasn't cached by Google either.

Re: Matrix.org hacked

#232

Post by notyourday »

ATsch wrote: post #192
notyourday wrote: post #188

Earlier quoted context omitted.

I stand by the assertion that it indicates the Matrix people are clueless. If this is a design constraint, then the security model needs to accommodate that the user keys are the pot of gold, which means that there needs to be a service provided by a dedicated server which is inaccessible in the course of normal operation via any means other than a well defined braindead simple protocol : : providing the message mani…

I think you misunderstand why the keys were deleted. The keys get deleted on the client when you log out. This is sensible, because if you log out on a device, you probably don't want to keep the keys around in your browser storage. When the users session is destructed on the server, existing clients get a 403 error and told that their session is logged out. When that happens, they go through the normal logout routin…

If user sessions are that important, then there's no way Matrix should be killing them and instead that behavior has to become a design and operations constraint.

Imagine if this was facebook. Or whatsapp. Or signal and this was the result. They would be crucified ( justifiably ). But for some reason we are giving Matrix a pass.

Re: Matrix.org hacked

#233

Post by cyansmoker »

dininski wrote: post #37

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

I agreed with your comment, until I followed the github link and found that all issues had been removed.

Re: Matrix.org hacked

#234

Post by user9182031 »

erikbye wrote: post #135
azhenley wrote: post #31

The hacker seems nice: “Anyways, that's all for now. I hope this series of issues has given you some good ideas for how to prevent this level of compromise in the future. Security doesn't work retroactively, but I believe in you and I think you'll come back from this even stronger than before. Or at least, I hope so -- My own information is in this user table.” https://github.com/matrix-org/matrix.org/issues/365

"Or at least, I hope so -- My own information is in this user table... jk, I use EFNet."

I enjoyed the shout out for EFnet.

Re: Matrix.org hacked

#235

Post by justaj »

lelf wrote: post #39
nothrabannosir wrote: post #22

Earlier quoted context omitted.

This is gold... > I noticed in your blog post that you were talking about doing a postmortem and steps you need to take. As someone who is intimately familiar with your entire infrastructure, I thought I could help you out. > There I was, just going about my business, looking for ways I could get higher levels of access and explore your network more, when I stumbled across GPG keys that were used for signing your deb…

Another gem: RRREEEEEEEE> I noticed you missed a doctype in your html page. In order for web browsers to know what type of html to render you should include a doctype. Thanks! matrixnotorg> @RRREEEEEEEE Thank you, I will consider that for the next release Edit: it got deleted But see also: https://github.com/matrixnotorg/matrixnotorg.github.io/pull/...

Wait, did Github delete matrixnotorg's profile or did matrixnotorg?

If Github deleted that profile, I don't really see that as being very hacker-friendly.

Re: Matrix.org hacked

#236

Post by pferde »

zaarn wrote: post #146
meruru wrote: post #54

Earlier quoted context omitted.

I can't wait years. I need to pick up a definitive platform right now to push as an alternative to proprietary ones. It would suck to migrate all my friends to something just to ask them to move again to something else a couple years later.

I would agree with that. We need something that works now, not when someone finally manages to reign in the Matrix protocol.As it stands I cannot send a friend an invite to Matrix and expect them to like it one bit (which turns out, is what reality looks like).

"I need...", "We need..."

The world doesn't really care about what you need. It simply doesn't work like that. If you have a need, do something about it and help out.

Re: Matrix.org hacked

#237

Post by pferde »

joepie91_ wrote: post #165
tannhaeuser wrote: post #69

Earlier quoted context omitted.

> myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix Good luck with that. Right now there's only the centralized matrix.org server, or actually there isn't because it's down. If you want open standards and multiple servers (or your own) use XMPP period. It's not so much a technical question as it is the attitude of "hey we're implementing our own chat proto…

> It doesn't help either that scarce development resources are needlessly fragmented between XMPP and matrix. In my experience, there's virtually no overlap between the two groups, and therefore no fragmentation. And for good reason: XMPP is a nightmare to implement, so there's a significant group of developers that just won't touch it, but that might be interested in working on Matrix. And yes, part of the blame for…

You know, I never understood why people consider JSON better than XML. Yes, any particular use of XML can be overengineered (namespaces, I'm looking at you), but as long as you control the format or scheme or however you want to call it, it's exactly the same thing as JSON, but encoded differently. In the end, it's all just keys and values or lists of values, arranged in a tree-like hierarchy.

And frankly, I would rather be looking at a well-designed XML format than at a well designed JSON format, with its braces and brackets and commas.

Re: Matrix.org hacked

#238

Post by aeternus »

justaj wrote: post #235
lelf wrote: post #39

Earlier quoted context omitted.

Another gem: RRREEEEEEEE> I noticed you missed a doctype in your html page. In order for web browsers to know what type of html to render you should include a doctype. Thanks! matrixnotorg> @RRREEEEEEEE Thank you, I will consider that for the next release Edit: it got deleted But see also: https://github.com/matrixnotorg/matrixnotorg.github.io/pull/...

Wait, did Github delete matrixnotorg's profile or did matrixnotorg? If Github deleted that profile, I don't really see that as being very hacker-friendly.

Although 'hacker' is often used as a positive term on HN, breaking into a company's production server is clearly illegal activity and should not be condoned. If Github deleted the account, they are simply acting in accordance to published TOS & policy.

Re: Matrix.org hacked

#239

Post by Arathorn »

Oblongoid wrote: post #162

I've been slightly annoyed with matrix ever since they boasted at FOSDEM with the fact that they backdoored their encryption so that the French government could Virus scan sent files. :/

we didn't backdoor the encryption. instead, we specced how clients could securely pass attachment keys to an AV server, if they need to. but in practice none of them (other than the french app) do.

the whole point was to spell out that we haven't backdoored the encryption, and instead been transparent about how content filtering could be done in the most responsible manner, if it's really needed.

Re: Matrix.org hacked

#240

Post by kqr »

xyproto wrote: post #169

It's "usless use of cat". He/she should have gone: `grep arathorn users.txt | head -1` Instead of: `cat users.txt | grep arathorn | head -n1` Hackers these days.

I still dont get that logic. What if it turns out i want to stick a prerprocessing step before grep? With a "useless" use of cat, thats easy. Without it, i need to do some rearranging. Not convinced.
Post reply on HN