Comment on What can we learn from the matrix.org compromise?Comments−Arathorn7yIf it wasn’t clear, this article wasn’t written by the Matrix.org team, nor did the author discuss any of it with us to our knowledge.We’ll publish our own full post-mortem in the next 1-2 weeks.−Arathorn7yalso, reading this article more carefully, much of this just plain wrong:One of the more interesting pieces of this was how Ansible was used to keep the attacker in the system.Fwiw the infra that was compromised was not managed by Ansible; if it had been we would likely have spotted the malicious changes much sooner.
Comments
If it wasn’t clear, this article wasn’t written by the Matrix.org team, nor did the author discuss any of it with us to our knowledge.
We’ll publish our own full post-mortem in the next 1-2 weeks.
also, reading this article more carefully, much of this just plain wrong:
Fwiw the infra that was compromised was not managed by Ansible; if it had been we would likely have spotted the malicious changes much sooner.