3 ms·
To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-so
by maxmouchet 7y ago
To be fair, the vulnerability was fixed quickly. And in the end it improved the security of Matrix and the governement application. I prefer this to a closed-source application developed internally, without communication on security vulnerabilities.
- Zenst 7y agoYes, does cover that in the link and from my perspective - ruddy good response time upon that and well handled. I can think of many comparable situations in other countries (some EU ones as well) in which the person finding the issue would of very easily been locked up.
- Arathorn 7y agoTo be clear, the vulnerability was with the specific server configuration for the French Matrix deployment (authing people based on email domain), and not a flaw in Matrix itself. We're not aware of anyone else running in that config. https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2 https://matrix.org/blog/2019/04/18/security-update-sydent-1-... had the details. The actual bug was thanks to a long-standing bug in python's standard email.utils library, which finally got fixed: https://bugs.python.org/issue34155 https://bugs.python.org/issue34155, combined with insufficiently-defensive coding and testing on my side. (I wrote the auth code in question).