221–230 of 277 posts
I think it boils down to the fact that infrastructure for projects (no matter the size) is usually a second class citizen at best. Either no one is eager to care for it, or the people who are actually focused on developing the software run it because they need to, or worst case - no contributor is trusted enough to handle infrastructure work, with access being given even more sparsely than commit rights to the whole…
https://github.com/matrix-org/matrix.org/issues?utf8=%E2%9C%...
Earlier quoted context omitted.
I would like for matrix protocol and implementation to be better prepared for such cases. While I didn't loose access to the encrypted messages, since I used the 'Encrypted Messages Recovery' function of Riot.im, I guess a lot of people have. Maybe allow to store more information on the client side?
I do not really like the fact that this feature can only backup keys server-side, so I did not enable it. I do however have a keys backup dating back some time, that will hopefully restore some of my encrypted messages. But basically, I understand that every encrypted message was at risk of being lost, so it's not that big of a deal.
People have different threat models. When chatting with my family, it's more important that we have a permanent history of our messages rather than the worry of them getting leaked. But if you're a whistleblower you have a different set of requirements.
[1]: https://github.com/uhoreg/matrix-doc/blob/e2e_backup/proposa...
Looks like all issues created by the "hacker" have been removed? https://github.com/matrix-org/matrix.org/issues?utf8=%E2%9C%...
Earlier quoted context omitted.
Unless I'm missing the joke, this is a bug bounty with extra steps.
My idea was to not require any explanations, so that blackhat could grab that wallet too. It's just about being able to say "this server is $1k secure". I think it's fantastic that we have a technology to do that. You still need some trust that private keys to given wallet are on the server, but apart from that, when you know there's $10,000 dollars on the server for anybody who can access it, it says something about…
Looks like all issues created by the "hacker" have been removed? https://github.com/matrix-org/matrix.org/issues?utf8=%E2%9C%...
Seems like the user itself has been deleted, which might cause Github to remove all content created by that user.
TL;DR: Looks like there was a server with an unpatched Jenkins instance running, which allowed RCE. [0] Someone (presumably a developer) was connected to that compromised server via SSH, and had forwarded their SSH agent to it. [1] Apparently that person had root access to the production servers, allowing the attacker to login via the forwarded agent. Yikes. [0]: https://matrix.org/blog/2019/04/11/security-incident/…
Earlier quoted context omitted.
`ProxyJump`
Hadn’t seem that before. Article here explains is briefly https://www.madboa.com/blog/2017/11/02/ssh-proxyjump/
Here is a much better explanation (from [0]):
> ProxyJump was added in OpenSSH 7.3 but is nothing more than a shorthand for using ProxyCommand, as in: "ProxyCommand ssh proxy-host -W %h:%p"
so the same thing that top poster was talking about.
[0] https://superuser.com/questions/1253960/replace-proxyjump-in...
The hacker seems nice: “Anyways, that's all for now. I hope this series of issues has given you some good ideas for how to prevent this level of compromise in the future. Security doesn't work retroactively, but I believe in you and I think you'll come back from this even stronger than before. Or at least, I hope so -- My own information is in this user table.” https://github.com/matrix-org/matrix.org/issues/365