6 ms·

France developed their own matrix protocol based network called tchap. Great idea for a nation that wants to stay independent in an increasingly american/chine

France developed their own matrix protocol based network called tchap. Great idea for a nation that wants to stay independent in an increasingly american/chinese tech dependent world.

Zenst 7y ago
Ah yes, I'd forgotten about that - https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...
- maxmouchet 7y ago
  To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-source application developed internally, without communication on security vulnerabilities.
  - Zenst 7y ago
    Yes, does cover that in the link and from my perspective - ruddy good response time upon that and well handled. I can think of many comparable situations in other countries (some EU ones as well) in which the person finding the issue would of very easily been locked up.
    - Arathorn 7y ago
      To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details. The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155 https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).
- faeyanpiraat 7y ago
  Interesting read. Nice trick with bypassing email domain restriction.
- grive 7y ago
  This is a good story, but the title seems needlessly clickbait. The flaw was fixed rather quickly, the process for communicating the issue did not seem to be a hassle. It does not really say that the app is "super not secure". Just that people make mistakes, and it's not even shameful the way they reacted to it.
101404 7y ago
When the government in Germany does IT projects, they usually burn millions of Euros even for simple projects. And then, years after the planned rollout, the project is still unfinished and no politician wants to touch it anymore. My favorites was the "special email inbox for lawyers". So, I am somewhat hesitant to let the EU develop a chat client.
- mcv 7y ago
  The Dutch government is also often terrible at managing IT projects. It seems an industry has evolved to game the public procurement rules required by the EU. Those companies just leech money for never-ending IT projects that tend to be over budget, over time, and working poorly.
  - tomatocracy 7y ago
    I think it's more that one of the consequences of painful public procurement processes is that they incentivise public officials to avoid procurement as much as possible. This leads to larger/maximalist projects being specified and a proliferation of "framework agreements" under which small projects are undertaken, both of which seem to benefit the large incumbents disproportionately.
  - jeltz 7y ago
    Having worked at a company in public procurement I would say that matches my experience. I would say we were relatively honest compared to some of our competitors, but there were almost no incentives for us developers to do a good job other than our personal morals and everyone including us were more or less gaming the system. I hated working there because I felt like a parasite just making the world worse. The in-hosue IT of our customer would probably have done a better job if they had just been allowed to hire some guys instead of having to go through an easily gameable procurement procedure. Not because they would have been more competent, but because they would have not have had perverse incentives.
    - j7ake 7y ago
      This story is fascinating, do you know where I can read more about public procurement?
Grumbledour 7y ago
The German Bundeswehr seems also interested in using Matrix. [0] A custom and self hosted Matrix implementation from the EU could be a great IT Project to increase security and be less reliable on foreign software. It would require more work than just writing a memo though. [0] (In German) https://www.heise.de/newsticker/meldung/Open-Source-Bundeswehr-baut-eigene-verschluesselte-Messenger-App-4623404.html https://www.heise.de/newsticker/meldung/Open-Source-Bundeswe...
achamayou 7y ago
Mistakes were made along the way: https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...

France developed their own matrix protocol based network called tchap. Great idea for a nation that wants to stay independent in an increasingly american/chinese tech dependent world.

Zenst 7y ago

Ah yes, I'd forgotten about that - https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...

maxmouchet 7y ago
To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-source application developed internally, without communication on security vulnerabilities.
- Zenst 7y ago
  Yes, does cover that in the link and from my perspective - ruddy good response time upon that and well handled. I can think of many comparable situations in other countries (some EU ones as well) in which the person finding the issue would of very easily been locked up.
  - Arathorn 7y ago
    To be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details. The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155 https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).
faeyanpiraat 7y ago
Interesting read. Nice trick with bypassing email domain restriction.
grive 7y ago
This is a good story, but the title seems needlessly clickbait. The flaw was fixed rather quickly, the process for communicating the issue did not seem to be a hassle. It does not really say that the app is "super not secure". Just that people make mistakes, and it's not even shameful the way they reacted to it.

101404 7y ago

When the government in Germany does IT projects, they usually burn millions of Euros even for simple projects. And then, years after the planned rollout, the project is still unfinished and no politician wants to touch it anymore. My favorites was the "special email inbox for lawyers". So, I am somewhat hesitant to let the EU develop a chat client.

mcv 7y ago
The Dutch government is also often terrible at managing IT projects. It seems an industry has evolved to game the public procurement rules required by the EU. Those companies just leech money for never-ending IT projects that tend to be over budget, over time, and working poorly.
- tomatocracy 7y ago
  I think it's more that one of the consequences of painful public procurement processes is that they incentivise public officials to avoid procurement as much as possible. This leads to larger/maximalist projects being specified and a proliferation of "framework agreements" under which small projects are undertaken, both of which seem to benefit the large incumbents disproportionately.
- jeltz 7y ago
  Having worked at a company in public procurement I would say that matches my experience. I would say we were relatively honest compared to some of our competitors, but there were almost no incentives for us developers to do a good job other than our personal morals and everyone including us were more or less gaming the system. I hated working there because I felt like a parasite just making the world worse. The in-hosue IT of our customer would probably have done a better job if they had just been allowed to hire some guys instead of having to go through an easily gameable procurement procedure. Not because they would have been more competent, but because they would have not have had perverse incentives.
  - j7ake 7y ago
    This story is fascinating, do you know where I can read more about public procurement?

Grumbledour 7y ago

The German Bundeswehr seems also interested in using Matrix. [0] A custom and self hosted Matrix implementation from the EU could be a great IT Project to increase security and be less reliable on foreign software. It would require more work than just writing a memo though. [0] (In German) https://www.heise.de/newsticker/meldung/Open-Source-Bundeswehr-baut-eigene-verschluesselte-Messenger-App-4623404.html https://www.heise.de/newsticker/meldung/Open-Source-Bundeswe...

achamayou 7y ago

Mistakes were made along the way: https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-of-the-french-government-84b31517d144 https://medium.com/@fs0c131y/tchap-the-super-not-secure-app-...