Skip to content

Instantly share code, notes, and snippets.

@soatok
soatok / matrix.md
Last active May 18, 2024 17:10
Why I Don't Trust Matrix Developers to Produce a Secure Protocol

Update (2024-05-17)

Oh hey, this rant of mine is making the rounds.

After I wrote this, one of the Matrix leads commented on it, which prompted me to look at their code. I have since found, uh, 4 3 different cryptographic issues in Matrix's Olm and Megolm code.

Expect a blog post on Dhole Moments at some point in August.

One of them is extremely bad, and will put a lot of burden on Matrix users to mitigate effectively. False alarm: I was mistaken about this one. I'll include it in the write-up, though.

Important organizational announcement Due to feedback from several people who wish to contribute, this project is being moved to it's own repository. The master copy is now at SalusaSecondus/CryptoGotchas. This will let us more easily take PRs/Issues and track contributions.

import android.content.Context;
import android.content.res.TypedArray;
import android.util.AttributeSet;
import android.support.v7.widget.RecyclerView;
import android.support.v7.widget.LinearLayoutManager;
import android.view.View;
import android.graphics.Rect;
import android.graphics.drawable.Drawable;
import android.graphics.Canvas;