Live data from Hacker News

Matrix.org hacked

web.archive.org

51–60 of 277 posts

Re: Matrix.org hacked

#51

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

Yeah, but there are several reasons

1 - you want to add more filtering/processing before the grep

2 - grep's command line options are confusing (+ globbing + whatever), easier to just use it to grep stdin

3 - It works. Sure 'grep pattern file' works, but here that is inconsequential. I'm not in an 80s machine to worry if I'm opening one more process or pipe than needed, especially in simple cases like this

Re: Matrix.org hacked

#52
post #20

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

Reason why you would do that (and I often do) is that you have further piping options so it becomes standard work flow and muscle memory. What I usually do is cat the file to inspect it, hit Control+C, then up arrow for previous command, then further pipe and head/tail/grep the file. Starting a grep command is fine if you know that's all you're going to be doing.

You can use Bash (and I assumed it works in zsh too) variables to save you there. eg

    grep something !$
`!$` will be replaced with the last parameter of the previous command. Crude example

    cat /etc/hosts
    grep 12.34.56.78 $! # will be executed as grep 12.34.56.78 /etc/hosts
I find this extremely useful for when I'm cat'ing a file to get a sense of it's output then wanting to do something more meaningful with it in the next command.

That all said, I have absent-mindedly done my fair share of stuff like this too:

    !! | less
    # eg will run as `cat /etc/hosts | less`
    # if `cat /etc/hosts` was the previous command run
so I certainly wouldn't look down on people who have "abused" cat due to muscle memory.

Re: Matrix.org hacked

#53
Project lead for Matrix.org here - you can see our initial statement on this at http://matrix.org/blog/2019/04/11/security-incident/.

It will be updated shortly to reflect the DNS defacement linked here (which was because we failed to rotate a leaked cloudflare API token; we aimed to rotate the master API token but rotated a personal one instead). To our knowledge the rebuilt production infrastructure itself is secure.

We've revoked the compromised GPG keys, and are obviously going to do everything we can to improve our production security to avoid a recurrence in future.

We can only apologise to everyone caught in the crossfire of this incident.

Re: Matrix.org hacked

#54
post #44
post #18

Earlier quoted context omitted.

There is plenty of other issues with matrix and the reference clients on top of something as simple as mandatory leaking of your presence in a chatroom. I've run a matrix homeserver for almost 3 weeks and it as an utter pain to maintain, despite not a single version upgrade and I was plagued with issues that no chat platform would have if the protocol was remotely sane. edit: That is on top of the numerous security i…

While you bring up valid concerns about the Matrix team's security hygiene, the point of an open standard is that anyone can (try to) spot flaws in it, and anyone can (try to) create their own implementation. I myself am waiting for a healthy ecosystem of servers and clients to spring up before starting to rely on Matrix for anything non-ephemeral - even if it takes years. Perhaps I'll even try my hand at writing a c…

I can't wait years. I need to pick up a definitive platform right now to push as an alternative to proprietary ones. It would suck to migrate all my friends to something just to ask them to move again to something else a couple years later.

Re: Matrix.org hacked

#55
TL;DR: Looks like there was a server with an unpatched Jenkins instance running, which allowed RCE. [0]

Someone (presumably a developer) was connected to that compromised server via SSH, and had forwarded their SSH agent to it. [1]

Apparently that person had root access to the production servers, allowing the attacker to login via the forwarded agent. Yikes.

[0]: https://matrix.org/blog/2019/04/11/security-incident/

[1]: https://github.com/matrix-org/matrix.org/issues/358

Re: Matrix.org hacked

#56

Earlier quoted context omitted.

This is gold... > I noticed in your blog post that you were talking about doing a postmortem and steps you need to take. As someone who is intimately familiar with your entire infrastructure, I thought I could help you out. > There I was, just going about my business, looking for ways I could get higher levels of access and explore your network more, when I stumbled across GPG keys that were used for signing your deb…

Why would they do this? It's pure negligence. I don't even sign anything important and still worry about my keys.

I have been asked twice or more why I insisted on not using a Continuous Integration environment for publishing some software releases that are installed by third-parties.

My team was automating the infrastructure to build internal software and naturally they wanted to be able to simplify things.

The idea that was proposed to me was the following: once I push a new version tag to GitHub, the deployment CI server is going to build and release it as an unstable version.

Some important detail here: I use the same key to sign packages regardless if they are released as unstable or stable. That would mean that if someone, somehow, managed to push a tag that was pushed upstream to GitHub, hypothetically they would be able to eventually gain access to consumers machines (basically, developers) when the consumers update it after getting a notification telling them a new version is available. No way I'd allow this to happen, but I would not be surprised if most people just took this as an acceptable risk.

Re: Matrix.org hacked

#57

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

As someone who doesn't care, my eyes bleed every time someone tries to make others feel small for no reason using improper grammar:

"As na linux/unix sysadmin": typo ('na') aside it is 'As a linux/unix sysadmin'

"...my eyes are bleeding everytime I see" I think you meant 'my eyes bleed', otherwise it means that, coincidentally, you eyes were already bleeding every time you happen to see someone use cat in that way.

"everytime" is wrong, the correct form is "every time"

My point isn't to insult you, it is to show you that everyone has blind spots and we shouldn't give each other such a hard time.

Re: Matrix.org hacked

#58

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

I do cat x | grep y, because that way you separate out the primary data being passed around and the secondary instructions for how to process it. Preferring functional programming, this is my bread and butter. It´s superior readability and simplicity is something that gets engraved on the inside of your mind after you do a pipe a few hundred times per day every day. This is not about being terse, terseness is almost never a factor.

  (->
  ¨log.txt¨
  read-to-string 
  ´(prepend ¨\n¨)
  ´(prepend ¨piping¨)
  lines-to-strings
  first
  ´(= ¨piping´)
  )
To think of writing (read-to-string ¨log.txt¨) in the above pipe is wrong. Might as well load on more functions on the input line:

  (->
  (prepend ¨piping¨ (prepend ¨\n¨ (read-to-string ¨log.txt¨)))
  lines-to-strings
  first
  ´(= ¨piping´)
  )
The simple principle that emerges is that the first line is for input, not for applying functions. You might guess that someone who does this even in a pipe as simple as cat x | grep y has this muscle memory too, but someone who criticizes it, certainly doesn´t. Maybe that´s not a bad thing, but you do feel a large divide between each other.

Re: Matrix.org hacked

#59

I can see a lot of people trashing on Matrix.org or the "hacker" themselves (the hacker opened a series of issues, detailing how he managed to get in - https://github.com/matrix-org/matrix.org/issues/created_by/m... ). However everyone seems to be missing the point - matrix seems like a pretty cool and open project. And someone taking over their infrastructure in such an open way is also great for the community. Even…

There are some weird people in those issue threads..

Re: Matrix.org hacked

#60

As na linux/unix sysadmin with 15+ years of experience my eyes are bleeding everytime I see cat | grep instead of just grep ;D

Yeah, but there are several reasons 1 - you want to add more filtering/processing before the grep 2 - grep's command line options are confusing (+ globbing + whatever), easier to just use it to grep stdin 3 - It works. Sure 'grep pattern file' works, but here that is inconsequential. I'm not in an 80s machine to worry if I'm opening one more process or pipe than needed, especially in simple cases like this

I have no issue with people who want to prefix grep (nor any other command for that matter) with cat. However I do completely disagree with your 2nd point. It's literally just:

    grep  [flags]  search_pattern  [filename]
In GNU grep (eg Linux) it's even easier because your flags can appear wherever in the command you want (even at the end). Though I'd recommend sticking to the habit of having them after the executable name for readability and portability with non-GNU coreutils.

It's really not that hard. There's plenty worse CLI tools to use which we're now stuck with because of historic reasons.

Post reply on HN