2 ms·

OMEMO was modeled around Signals encryption. And I don't think being "respected" makes a persons statement less or more worthy, assuming we don't take into acco

OMEMO was modeled around Signals encryption. And I don't think being "respected" makes a persons statement less or more worthy, assuming we don't take into account this same individual failed to follow responsible disclosure and intentionally harassed aswell as spread FUD about the Matrix project. Something which has been audited by Ukraine, France and other reputable organisations.

some_furry 2y ago
> this same individual failed to follow responsible disclosure https://soatok.blog/2025/01/21/too-many-people-dont-value-the-time-of-security-researchers https://soatok.blog/2025/01/21/too-many-people-dont-value-th... Responsible Disclosure isn't a real thing. > and intentionally harassed aswell as spread FUD about the Matrix project. [citation needed] I did not harass anyone. Nor did I "spread FUD." Years ago, I wrote that I do not recommend Matrix after https://nebuchadnezzar-megolm.github.io https://nebuchadnezzar-megolm.github.io was published. This was an opinion, but several people pressed me on it. I followed it up with a first-pass review of libolm, and disclosed it to the Matrix security team. After 90 days, I blogged about it. I literally followed coordinated disclosure. I even shared the draft before it was public so they could be aware of what was written. Afterwards, the Matrix devs admitted they knew about the side-channels in libolm for years and never bothered to fix them. That should alarm Matrix users more than my disclosure or criticism. Nobody was harassed in any of this.
- Arathorn 2y ago
  > Afterwards, the Matrix devs admitted they knew about the side-channels in libolm for years and never bothered to fix them. For anyone reading: Matrix didn’t bother fixing libolm’s sidechannels because instead we switched to a new Rust implementation at https://github.com/matrix-org/vodozemac https://github.com/matrix-org/vodozemac - which is what the vast majority (installwise) of Matrix clients use. The mea culpa is that libolm should have been explicitly deprecated much sooner.

some_furry 2y ago

> this same individual failed to follow responsible disclosure https://soatok.blog/2025/01/21/too-many-people-dont-value-the-time-of-security-researchers https://soatok.blog/2025/01/21/too-many-people-dont-value-th... Responsible Disclosure isn't a real thing. > and intentionally harassed aswell as spread FUD about the Matrix project. [citation needed] I did not harass anyone. Nor did I "spread FUD." Years ago, I wrote that I do not recommend Matrix after https://nebuchadnezzar-megolm.github.io https://nebuchadnezzar-megolm.github.io was published. This was an opinion, but several people pressed me on it. I followed it up with a first-pass review of libolm, and disclosed it to the Matrix security team. After 90 days, I blogged about it. I literally followed coordinated disclosure. I even shared the draft before it was public so they could be aware of what was written. Afterwards, the Matrix devs admitted they knew about the side-channels in libolm for years and never bothered to fix them. That should alarm Matrix users more than my disclosure or criticism. Nobody was harassed in any of this.

Arathorn 2y ago
> Afterwards, the Matrix devs admitted they knew about the side-channels in libolm for years and never bothered to fix them. For anyone reading: Matrix didn’t bother fixing libolm’s sidechannels because instead we switched to a new Rust implementation at https://github.com/matrix-org/vodozemac https://github.com/matrix-org/vodozemac - which is what the vast majority (installwise) of Matrix clients use. The mea culpa is that libolm should have been explicitly deprecated much sooner.