2 ms·

As others have pointed out… > They killed it. It's dead. …is ridiculous hyperbole. This is a debate around the “system warns you when something bad happens” v

As others have pointed out… > They killed it. It's dead. …is ridiculous hyperbole. This is a debate around the “system warns you when something bad happens” versus “system stops something bad happening in the first place”. It’s like saying SSL is “killed dead” because browsers let you connect to sites with bad certs albeit with a big red warning. And much as this was addressed for SSL with HSTS etc, we’re working on the fix for Matrix. For what it’s worth, the current approach is https://github.com/matrix-org/matrix-spec-proposals/blob/fayed/cryptographic-membership/proposals/3917-cryptographic-membership.md https://github.com/matrix-org/matrix-spec-proposals/blob/fay... Screaming about Matrix being “killed dead” helps no-one, and risks completely sabotaging our efforts to improve open communication, just in order to score a rhetorical point.

tptacek 4y ago
You're changing the protocol! Nobody has ever disputed that it's possible for the Matrix team to build a secure messaging protocol. I'm sure you can. But: have you yet? By way of example: TLS 1.0 is dead as a doornail, too. If you like, we can use a different word to capture the equivalence class here. TLS 1.0 and the current Matrix protocol: "ex-parrots". This whole situation is wild. What we're discussing on this thread is the single most impactful set of cryptographic vulnerability findings against any secure messaging system ever. And this thread is, I think, one of a very few places on the whole Internet where there's even a conversation about it. Everybody else is just rolling along as if nothing happened. If I sound mean about this, I don't mean to be. But, fair warning, I'm in full-on "wake up, sheeple" mode over this.