Conversation

Charlotte lotteheartplural/Cinny cinny_heart_plural thetadelta ursaminor treblesand

<- is still sitting on a 0day it hasn’t researched written up or reported

1
2
3

@charlotte Linux kernel, potential low severity / USB denial of service, too scared it turns out to be a false alarm and too lazy to finally write a proof of concept

1
0
0

@ity matrix, low severity, not sure how to describe it without revealing too much but it makes two users disagree about the contents of the message

1
0
0

ity [unit X-69] - VIOLENT FUCK

Edited 1 year ago

@charlotte ah, another state split? Lovely

1
0
0

@ity not state split, but making users disagree about the plaintext of a message event or the like

somewhat related to https://lotte.chir.rs/2024/08/17/Missing-Salamanders-Matrix-Media-can-be-decrypted-to-multiple-valid-plaintexts-using-different-keys/

1
0
1

@charlotte ah

I hate Matrix. Curiosity got the better of me and I read the article and I am just getting flashbacks of trying to explain basic security principles to the spec team and being met with passive aggressiveness or just plain aggressiveness and intentional ignorance... I used to do some basic security work on the spec around certain parts to try to improve at least some of the glaring issues but, gave up.

1
0
0

@ity until soatok linked me to a google sheets doc i couldn’t find the threat model of matrix at all

but that also confirmed that they did consider https://lotte.chir.rs/2024/08/17/Malicious-homeserver-can-trick-Element-Schildichat-into-revealing-links-in-E2EE-Rooms/ to be a vuln

1
0
1

@charlotte I'd be cautious of anything soatok does, considering his "research" into Matrix was all FUD based on lying about the impact of a legit research paper (my focus when I worked on Matrix was actually fixing the stuff in the paper that he lied about in his now-deleted Gist) and then proceeding to lie about the impact of a low severity vuln with no known even theoretical attacks in a deprecated library, lying about the widespreadness of the library and hiding evidence of the lies.

Tho if the google doc is actually official I wonder why is it not shared anywhere. Probably a Matrix moment. To be frank, Matrix has migrated from trying to be a secure messenger to trying to be selfhosted Microsoft Teams for the European Union & Germany, while still insisting that they haven't, despite how clear it is given how they handle E2EE, security, and the recent OAuth2 shit.

0
0
0