3 ms·

Good detective work is done by looking for associations as the starting point. I do not rule out any of those as possibilities, and given that there have been m

Good detective work is done by looking for associations as the starting point. I do not rule out any of those as possibilities, and given that there have been major issues with the security of both the protocol and the official implementation the opportunity exists for those issues to have been deliberate or simply deliberately disclosed to favored parties with priority. That’s obviously far from proof of wrongdoing but combined with the provenience of the project within Amdocs that makes me suspicious. If it doesn’t make you suspicious that’s ok too. “The vulnerabilities we exploit differ in their nature (insecure by design, protocol confusion, lack of domain separation, implementation bugs) and are distributed broadly across the different subprotocols and libraries that make up the cryptographic core of Matrix.” https://nebuchadnezzar-megolm.github.io/ https://nebuchadnezzar-megolm.github.io/

Arathorn 3y ago
All software has bugs, and the ones linked there were found in the first gen Matrix clients and had already been fixed in subsequent ones - https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... has the details. Of course, you are welcome to pick up any and all CVEs and claim they are evidence of a grand conspiracy if you wish. :|
- goodSteveramos 3y ago
  Thats fair. I find it unlikely those issues were deliberately inserted. Part of espionage is developing contacts and sources. Putting people on the inside of organizations from their inception so as to keep tabs, and supporting organizations that you have the most influence in. China for example requires foreign startups hiring Chinese engineering talent to include a Chinese citizen as a founder so they have institutional visibility and influence in case later on that company makes decisions affecting China, such as participating in boycott or honoring Chinese data access requests. Its just smart politics. And yes it happens all the time and is a kind of ‘conspiracy’ if you chose to frame it that way. My concern that something like that happened with your organization is warranted. And just to be clear, I was super excited when I first got on Matrix. It really has the correct vision for how decentralized communications should work and I hope that vision wins, which is why I was so bummed when I heard about the connection to Amdocs.

Arathorn 3y ago

All software has bugs, and the ones linked there were found in the first gen Matrix clients and had already been fixed in subsequent ones - https://matrix.org/blog/2022/09/28/upgrade-now-to-address-encryption-vulns-in-matrix-sdks-and-clients https://matrix.org/blog/2022/09/28/upgrade-now-to-address-en... has the details. Of course, you are welcome to pick up any and all CVEs and claim they are evidence of a grand conspiracy if you wish. :|

goodSteveramos 3y ago
Thats fair. I find it unlikely those issues were deliberately inserted. Part of espionage is developing contacts and sources. Putting people on the inside of organizations from their inception so as to keep tabs, and supporting organizations that you have the most influence in. China for example requires foreign startups hiring Chinese engineering talent to include a Chinese citizen as a founder so they have institutional visibility and influence in case later on that company makes decisions affecting China, such as participating in boycott or honoring Chinese data access requests. Its just smart politics. And yes it happens all the time and is a kind of ‘conspiracy’ if you chose to frame it that way. My concern that something like that happened with your organization is warranted. And just to be clear, I was super excited when I first got on Matrix. It really has the correct vision for how decentralized communications should work and I hope that vision wins, which is why I was so bummed when I heard about the connection to Amdocs.