> The Graphene guy posted it on Twitter, and by doing so you claimed he "slagged [you] off"[0].
I forget the precise contents of their deleted tweets, and I'd be first to admit that for better or worse I try to be authentic when typing here or elsewhere, rather than faking being calm & anodyne. Based on the feedback here & elsewhere, that's probably a mistake. In this instance, having Graphene screaming about how awful Matrix is and enumerating ways to cause moderation problems was not helpful during a moderation incident, especially where we had been scrambling to help them.
> This is the part I don't understand. If you're working on it in private, you acknowledge it may be a security risk (plus your use of the word "attack")
Correct. Any bug in the state resolution algorithm could potentially eventually turn out to have security implications.
> but you've also de-prioritized it because it's not a security risk?
We haven't explicitly de-prioritised, but other things have come along at higher priority. The reason we haven't bumped its priority higher is because it happens rarely, and the chances of security impact look to be relatively low.