Frisk on Nostr: Thank you for posting the response to that disclosure, I were low-key waiting for it ...

Thank you for posting the response to that disclosure, I were low-key waiting for it since I saw Soatok's post.

Not a cryptographer, so can hardly discuss merits of described problems, however knowing reporter's history with disclosures to Matrix I kept a large chunk of salt while reading his most recent blog post regarding issues I can't verify myself with what I know.

While I respect reporter's expertise, his blog posts are personal and they read more like a rant, which is fair, this is a furry blog post first and foremost after all (and I've done my own share of ranting on mine). But it (rantyness, not the type of blog) takes away from trust in what they are writing, as this feels like making points for already prepared conclusion rather than finding issues out of genuine point of concern. And this seems to work in disfavor of how grounded his arguments are. When looking for issues out of spite the bar for research you are willing to do is lower.

Still interested if he will respond to points brought up by this blog post (EDIT: He did).

At least one point I do have to grant to Soatok though even with my expertise, despite terrible choice of repositories he has chosen as representation for his blog post, Matrix ecosystem does have an issue with using depreciated Olm library which again, is a security library still used in clients such as nheko and Neochat (both of which are the only ones I currently consider using).