Re:Reviewing the Cryptography Used by Signal
by Arathorn on Tuesday February 18, 2025 @02:44PM
(#43094114)
> Afterwards, the Matrix devs admitted they knew about the side-channels in libolm for years and never bothered to fix them.
For anyone reading: Matrix didn’t bother fixing libolm’s sidechannels because instead we switched to a new Rust implementation at https://github.com/matrix-org/vodozemac - which is what the vast majority (installwise) of Matrix clients use. The mea culpa is that libolm should have been explicitly deprecated much sooner.
https://soatok.blog/2025/01/21/too-many-people-dont-value-th...
Responsible Disclosure isn't a real thing.
> and intentionally harassed aswell as spread FUD about the Matrix project.
[citation needed]
I did not harass anyone. Nor did I "spread FUD."
Years ago, I wrote that I do not recommend Matrix after https://nebuchadnezzar-megolm.github.io was published. This was an opinion, but several people pressed me on it.
I followed it up with a first-pass review of libolm, and disclosed it to the Matrix security team. After 90 days, I blogged about it. I literally followed coordinated disclosure. I even shared the draft before it was public so they could be aware of what was written.
Afterwards, the Matrix devs admitted they knew about the side-channels in libolm for years and never bothered to fix them. That should alarm Matrix users more than my disclosure or criticism.
Nobody was harassed in any of this.