How to fix security issues in a decentralized system with multiple vendors
summary
Finding a spec-level vulnerability forces use of security@matrix.org and the public MSC process, but quarterly spec releases and linear spec versioning make the stated 90 days optimistic. Fixes can use MSC unstable flags to gate behavior, deprecation rules block rapid removals, and many independent servers (Conduit, Harmony, Synapse, bridges, thousands of home servers) update on different schedules—some maintainers are unavailable for months—so coordinated disclosure and deployment become the main blockers.
AI-written summary · about
chapters (13)
- 0:00Introduction and disclaimer
- 1:08Security issue in Matrix protocol
- 3:37Current disclosure process
- 5:21MSC process challenges
- 7:52Spec versioning problems
- 9:57Server and client updates
- 13:32Notifying server operators
- 15:15Open secret disclosure method
- 17:01Security team structure
- 18:49Personal security reporting experience
- 20:16Openwall project comparison
- 22:42Proposed process improvements
- 24:32Q&A session
related talks
11mVulnerability Supply Chains
48mImproving the Security of a Large Open Source Project One Step...
47mImproving the Security of a Large Open Source Project One Step at a Time
44mMake It Fixable
37mPlatform and Security Engineering
59mCrossing the Streams - How Downstream Can Understand Upstream Vulns
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
29mMake It Fixable: Preparing for Security Vulnerability Reports