Matthew Hodgson ara4n

i spend quite a lot of time talking about the things i've screwed up (c.f. much of my FOSDEM talk this year: https://youtu.be/lkCKhP1jxdk?t=740)

fwiw, a current snapshot of things i feel i've got wrong would look like this:

Not investing enough in trust & safety. It was always seen as “well, that’d be a good problem to have, let’s fix it when we get there”. I can literally remember the ~2014 vintage conversations of saying “what are we going to do about spam” and everyone shrugging, saying it’s a hard problem, and agreeing to cross that bridge when we come to it.
Getting carried away with the enormous spectrum of potential that Matrix has, and not being focused enough:
- Overinvesting in ‘applications beyond chat’ before getting chat & VoIP excellent, and generally not being targetted enough in spending $ when we had it.

Fixing rust to support compiling libraries for use with Catalyst (Dec 2022)

The problem is that rustc emits synthetic libraries (symbols.o and lib.rmeta) which Apple's ld then chokes on when targetting aarch64-apple-ios-macabi, as they lack an LC_BUILD_VERSION load command to identify them as being intended for use with Catalyst.

The errors produced look like:

ld: in /Users/matthew/workspace/matrix-rust-sdk/target/aarch64-apple-ios-macabi/dbg/deps/libstatic_assertions-fdafb4b8ba800a8a.rlib(lib.rmeta), building for Mac Catalyst, but linking in object file built for , file '/Users/matthew/workspace/matrix-rust-sdk/target/aarch64-apple-ios-macabi/dbg/deps/libstatic_assertions-fdafb4b8ba800a8a.rlib' for architecture arm64

Mini proposal for fixing aliases

Problem

m.room.aliases tries to be a list of possible aliases for a given room; useful for discovering alternative routes into a room (for those already in the room), and for educating users about how Matrix works by illustrating multiple aliases per room. It also helps give a perception of the size of the network (look how many people found it useful to set an alias for this room!).

We consider three attackers:

A malicious third party trying to discover the identity server mappings in the homeserver.

The malicious third party scenario can only be protected against by rate limiting lookups, given otherwise it looks identical to legitimate traffic.

An attacker who has stolen an IS db

In theory the 3PIDs could be stored hashed with a static salt to protect a stolen DB. This has been descoped from this MSC, and is largely an orthogonal problem. XXX: is this the right thing to have done?

A compromised or malicious identity server, who may be trying to determine the contents of a user's addressbook (including non-Matrix users)

	#!/usr/bin/env python3

	import requests
	import pandas as pd
	import matplotlib.pyplot as plt

	# Replace these with your own repository details and personal access token
	GITHUB_TOKEN = 'hunter42'
	REPO_OWNER = 'matrix-org'
	REPO_NAME = 'matrix-doc'

	import olm from "olm";
	import sdk from "matrix-js-sdk";
	import { MatrixEvent } from "matrix-js-sdk";
	import { LocalStorage } from "node-localstorage";

	global.Olm = olm;

	const myUserId = "@matthewtest94:matrix.org";
	const myAccessToken = "secret";
	const matrixClient = sdk.createClient({

	import olm from "olm";
	import sdk from "matrix-js-sdk";
	import { LocalStorage } from "node-localstorage";

	global.Olm = olm;

	const myUserId = "@matthewtest94:matrix.org";
	const myAccessToken = "secret";
	const matrixClient = sdk.createClient({
	baseUrl: "http://matrix.org",

	t='t9688-1300128700_757269739_329105_458837962_294315883_1132696_45078565_22513400_82822'
	while true
	do curl -s 'https://matrix-client.matrix.org/_matrix/client/r0/rooms/!pcfWjiETvnVuspPLPl:mozilla.org/messages?from='$t'&limit=20&dir=b&filter=%7B%22lazy_load_members%22%3Atrue%7D' -H "authorization: Bearer $at" > msg.json >> msgs.json
	cat msg.json \| jq '.chunk[].origin_server_ts'
	t=`cat msg.json \| jq -r '.end'`
	sleep 0.5
	done

	dendrite-sw.js: v0.0.2 SW init
	19:34:08.387 dendrite-sw.js?6ec0:45 dendrite-sw.js: v0.0.2 starting dendrite.wasm...
	19:34:11.092 wasm_exec.js?3f15:44 dendrite.js starting...
	19:34:11.092 p2pLocalNode.js?8092:42 p2plocalnode called with org.matrix.p2p.experiment and /dns4/rendezvous.matrix.org/tcp/8443/wss/p2p-websocket-star/ with seed
	19:34:11.092 p2pLocalNode.js?8092:49 init existing ed25519 key from seed...
	19:34:11.093 dendrite-sw.js?6ec0:51 dendrite-sw.js: v0.0.2 claiming open browser tabs
	19:34:11.116 p2pLocalNode.js?8092:52 Public key bytes: Ed25519PublicKey
	19:34:11.117 p2pLocalNode.js?8092:61 added PeerInfo
	19:34:11.117 p2pLocalNode.js?8092:62 id: {"id":"12D3KooWR7weBT7ecN5tQMyAESw7tWpcENq7gW7rMeCZaVg646Vj","privKey":"CAESYIw1dXRfV9XomJMZDCso+BgK2QMK0PhpFPaIhCI1x3eW42AGlvThjJ3T/7cAw0WApfI8WDPbqEhL6Ubff8N7rt7jYAaW9OGMndP/twDDRYCl8jxYM9uoSEvpRt9/w3uu3g==","pubKey":"CAESIONgBpb04Yyd0/+3AMNFgKXyPFgz26hIS+lG33/De67e"}
	19:34:11.124 p2pLocalNode.js?8092:122 p2p starting now

	bucephalus:tmp matthew$ git clone git+ssh://[email protected]/matrix-org/matrix-appservice-irc
	Cloning into 'matrix-appservice-irc'...
	remote: Enumerating objects: 197, done.
	remote: Counting objects: 100% (197/197), done.
	remote: Compressing objects: 100% (142/142), done.
	remote: Total 16877 (delta 100), reused 118 (delta 50), pack-reused 16680
	Receiving objects: 100% (16877/16877), 3.85 MiB \| 5.95 MiB/s, done.
	Resolving deltas: 100% (12119/12119), done.
	bucephalus:tmp matthew$ cd matrix-appservice-irc/
	bucephalus:matrix-appservice-irc matthew$ yarn install