,
4 tweets,
3 min read
Read on Twitter
Accidentally, I came across the repo of the "Reference Matrix Identity Server" by @matrixdotorg: github.com/matrix-org/syd…. It's this repo that was involved in the @tchap_dinsic vulnerability.
Silently, @matrixdotorg fixed 2 more issues I reported 2 weeks ago. 1/3
Silently, @matrixdotorg fixed 2 more issues I reported 2 weeks ago. 1/3
In this commit, github.com/matrix-org/syd…, they deleted the old sessions from the sydent database 2/3 
In this 2nd commit, github.com/matrix-org/syd…, they made the sid (session id) non sequential. 3/3
At first, these 2 issues were not an issue. 1 week later they fixed them silently.
I am happy to see @matrixdotorg take into account these recommendations. I hope next time, they will do it with more transparency.
I am happy to see @matrixdotorg take into account these recommendations. I hope next time, they will do it with more transparency.
