I can really recommend all to read the issues opened by the hacker of matrix.org this morning, quite entertaining but also a reminder to everyone (devs and admins) that security should not be compromised on:

https://github.com/matrix-org/...

Wow that's shocking, how a tiny mistake/slip/ or even on purpose, could lead to huge damage.
One would think ya well, they are secure/limited access ...etc.

Thanks for sharing

that's hilarious/tragic.

it kinda makes me cringe when software projects have all this marketing text about how revolutionary and insanely secure it is, but then said websites have massive gaping sec holes.

not trying to be a dick though, I'll always root for the underdog, but when there's cringe, there's cringe.

I see a lot of deleted comments. Am I too late?

@Jilano

It is easier to get started with basically

@Wolle

yeah

archive.org still has it: https://web.archive.org/web/...

jesus fuck, what a shitshow. and here i was, thinking that github was being used by professionals (read: people who take these things seriously instead of devolving a serious issue into a meme pit).

@JustThat

I dont know what usability have to do with matrix.org compromised environment

@JustThat

as @condor pointed out on another platform regarding this: Developers are useless admins. This is why sysadmin will never die

@JustThat

I can reaffirm this. Seen a couple of cases of teams with (likely) only developers, and their server infra is complete and utter garbage. I really hope that project teams will one day learn that when they start dabbling with servers, they really need a sysadmin to go along with it.

Someone else over there also mentioned that those who are proficient in both system administration and development are worth their weight in gold. Usually big fat salaries, very comfortable retirement and so on. But, they are extremely rare unicorns. The fields are completely different, and both of them take a long time to get right.

As for server security, reasonable levels of security (mind, Matrix' server security was really poor compared to industry standard) do not impede development or deployment. For example, Matrix had their package signing keys on their internet-facing production servers. That's a big no-no for security. The package signing should be done on a host that cannot easily be accessed. Could be a VPS, local server, whatever. It can sign packages locally and then use passwordless SSH to push them to production, perhaps after the necessary unit tests and such. Conversely, it must be ensured that the internet-facing server cannot access the signing server. So enforcing key login and not giving the internet-facing server a key to login to the signing server.

There's a lot of things that can go wrong in security, but a proper sysadmin is the one that should be responsible for that. Heck, some larger companies even get dedicated security teams for this. It is not something that should be cheaped out on nor should it be done by developers.

@JustThat All of them are very good points. I wholeheartedly agree with them. Especially Dunning-Kruger is something that I see quite often. It is indeed easy to set up a server (well, some easier than others.. e.g. OpenVPN vs the whole mess that is mail servers), but a secure one requires in-depth knowledge of services, ports, networking, principle of least privilege, permissions, and so on. Not something I think every developer is proficient in, nor are they supposed to be.. at least in my opinion. And you are definitely right on Dunning-Kruger in sysadmin too, haha. I come to realize being fallible to that effect more often than I'd like to admit. Seems to be most common in Windows sysadmins though.. Knopkes and Blinkenlights I guess.

Someone posted screenshots https://github.com/matrix-org/...

@JustThat

"The AWS-effect" - a really good name actually. I will note that.

@Haxk20

Riot?

And they did host their own instance?

@Haxk20

You mean their own physical servers?

What a good hacker. It's really one of those cringe situations when someone catches you red-handed after commiting *private keys* and then the issue gets deleted because someone felt very terrible.