Earlier quoted context omitted.
hilarious...
I can only think of the despair I would be in if I was in Aragorn's shoes
Arathorn (Aragorn is son of Arathorn).
Matrix.org hacked
241–250 of 277 posts
Re: Matrix.org hacked
#242Earlier quoted context omitted.
Wait, did Github delete matrixnotorg's profile or did matrixnotorg? If Github deleted that profile, I don't really see that as being very hacker-friendly.
Although 'hacker' is often used as a positive term on HN, breaking into a company's production server is clearly illegal activity and should not be condoned. If Github deleted the account, they are simply acting in accordance to published TOS & policy.
If the attacker placed sensitive information on Github, that would indeed warrant a deletion of the account. However from what I saw from the archives, the attacker merely published details about Matrix.org's infrastructure and its vulnerabilities. Is that something that's against Github's ToS?
Re: Matrix.org hacked
#243Earlier quoted context omitted.
> It doesn't help either that scarce development resources are needlessly fragmented between XMPP and matrix. In my experience, there's virtually no overlap between the two groups, and therefore no fragmentation. And for good reason: XMPP is a nightmare to implement, so there's a significant group of developers that just won't touch it, but that might be interested in working on Matrix. And yes, part of the blame for…
You know, I never understood why people consider JSON better than XML. Yes, any particular use of XML can be overengineered (namespaces, I'm looking at you), but as long as you control the format or scheme or however you want to call it, it's exactly the same thing as JSON, but encoded differently. In the end, it's all just keys and values or lists of values, arranged in a tree-like hierarchy. And frankly, I would ra…
I don't like XML namespaces either (and neither is the original authors of the namespace spec very proud of it [1]). They're greeting you with verbose and rather ugly pseudo-URLs (another bad and confusing concept IMO) and xmlns:xyz boilerplate on page one when you're interested in quickly gleaning XML data.
But arguably, chat log data is actually an appropriate use cases for namespaces, given that you would want a text format that can evolve over time in a heterogenous client and server ecosystem, yet provide a baseline functionality supported by all clients. It's also very helpful if you want to keep chats for archival rather than treating chat as an ephemeral medium. OTOH people have said the excessive use of namespaces and other XML modularization features, and too many XEPs/RFC specs is turning them away from developing XMPP software.
There are valid use cases for JSON though such as ad-hoc data protocols where you own both the server and (JavaScript) client and maintain those in the same repo, and when dealing with simple app data that doesn't benefit from using markup constructs.
[1]: https://www.tbray.org/ongoing/When/201x/2010/01/17/Extensibl...
Re: Matrix.org hacked
#244Re: Matrix.org hacked
#245Earlier quoted context omitted.
Works fine here (Terminal.app + bash 5.0.3 from homebrew). Also, isn't that special variable $_ and not $! ?
> Works fine here. Terminal.app + bash 5.0.3 from homebrew.? Doesn't work for me. Maybe I've broken something on my build? Or maybe you've redefined your keys to emulate the [alt] key? > Also, isn't that special variable $_ and not $! ? Sorry I meant `!$` not `$!` (updated my post accordingly). Yes, $_ does the same thing too.
[deleted]
Re: Matrix.org hacked
#246Re: Matrix.org hacked
#247Earlier quoted context omitted.
> That would mean that if someone, somehow, managed to push a tag that was pushed upstream to GitHub You have to define what the signature means. IMHO it is fine for it to mean "this software was built on our build server from a well-defined state of the source code, which is only changable by our employees and contractors, and for which we have the full change log". So I deploy the code signing key to build servers,…
The problem is when a malicious package is produced, either because a flaw was introduced in the code, or because a dev machine was compromised, or _when the CI machine sad compromised_; the malicious package will be signed as if it were legit. One middle point between automated and manual signing is, as usual, key rotation: have the signing keys expire in a short duration of time (say 2 weeks) and manually push them…
What does a key rotation solve? Either your build server is compromised or it's not.
Re: Matrix.org hacked
#248Earlier quoted context omitted.
Why would they do this? It's pure negligence. I don't even sign anything important and still worry about my keys.
I have been asked twice or more why I insisted on not using a Continuous Integration environment for publishing some software releases that are installed by third-parties. My team was automating the infrastructure to build internal software and naturally they wanted to be able to simplify things. The idea that was proposed to me was the following: once I push a new version tag to GitHub, the deployment CI server is g…
Unless you audit the entire codebase prior to a manual build, from a machine you know hasnt been compromised with a key you know hasnt leaked, how is a manual build different to CI/CD securitywise?
Re: Matrix.org hacked
#249Earlier quoted context omitted.
> The matrix.org homeserver has been rebuilt and is running securely; We should have more bounties. Let users donate and put wallets on servers. Attacker will be able to take these funds. It's a reasonable measure of an infrastructure security.
To avoid perverse incentives, you should also build in some reward for the developers/operators. As in: If the server gets hacked, the money goes to the whitehat. If the server does not get hacked for $TIMEFRAME, the money goes to the people responsible for its security.
Seems like asking for trouble. Basically you're putting a thousand dollars cash in your house, then telling the world I have a thousand dollars cash in my house, if you find a way to break in and take it, it's yours, I won't make a fuss because you're doing me a favor by exposing a vulnerability.
Just please don't take the other valuables and ... oh yeah, please don't mess with any of my family members and maybe please let's try to keep it at no more than one hundred people trying at the same time b/c otherwise things might get out of hand.
Re: Matrix.org hacked
#250Earlier quoted context omitted.
Disabling read receipts is a client feature. Yes, the currently most mature client doesn't have that feature, but nothing in Matrix precludes it.
There is plenty of other issues with matrix and the reference clients on top of something as simple as mandatory leaking of your presence in a chatroom. I've run a matrix homeserver for almost 3 weeks and it as an utter pain to maintain, despite not a single version upgrade and I was plagued with issues that no chat platform would have if the protocol was remotely sane. edit: That is on top of the numerous security i…
"utter pain to maintain"
How so? I've hosted a synapse server for a year and I have never had a problem with it even after major upgrades.