3 ms·

Pre-disclosure: upcoming critical security release of Matrix SDKs and clients

• klysm 4y ago
  Is this a first in matrix world?
  • Arathorn 4y ago
    nope, alas; occasionally we hit bugs - https://matrix.org/blog/2021/09/10/pre-disclosure-upcoming-critical-fix-for-several-popular-matrix-clients https://matrix.org/blog/2021/09/10/pre-disclosure-upcoming-c... was the last major one. We’ve been doing independent audits on the next-gen implementations to help preemptively catch them (eg https://matrix.org/blog/2022/05/16/independent-public-audit-of-vodozemac-a-native-rust-reference-implementation-of-matrix-end-to-end-encryption https://matrix.org/blog/2022/05/16/independent-public-audit-...) rather than auditing the 1st gen sdks, which is why these snuck through. It’s worth noting that literally all security software occasionally finds security bugs, and fixes and patches them like this - the only difference is that as a decentralised network we have to make a loud noise and give warning to get everyone to upgrade.
• martinralbrecht 4y ago
  - Matrix announcement: https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... - Write-up by research team: https://nebuchadnezzar-megolm.github.io/ https://nebuchadnezzar-megolm.github.io/