Soatok Dreamseeker soatok

Ignas Kiela is kind of an idiot online. This, by itself, is a forgiveable condition--even on social media. Everyone has off days. Everyone has silly moments.

Unfortunately, Ignas Kiela is the kind of idiot that doubles, triples, and quadruples down on talking out of their ass.

Today, we're talking about this Fediverse thread.

The Thread Itself

I posted two threads earlier this week, after being tagged into someone else's argument and subsequently getting a headache. You can read them here:

Disclosure Timeline

2024-05-15: I took a quick look at the Matrix source code. I identified two issues and emailed them to their security@ email address.In my email, I specify that I plan to disclose my findings publicly in 90 days (i.e. on August 14), in adherence with industry best practices for coordinated disclosure, unless they request an extension in writing.
2024-05-16: I checked something else on a whim and find a third issue, which I also email to their security@ email address.
2024-05-17: Matrix security team confirms receipt of my reports.
2024-05-17: I follow up with a suspected fourth finding–the most critical of them all. They point out that it is not actually an issue, because I overlooked an important detail in how the code is architected. Mea culpa!

README

OwO, What's This?

This is the full email message I received in this screenshot: https://twitter.com/SoatokDhole/status/1486708637422735361

What Can I Do With It?

Read the VICE article first

This code snippet will allow anyone to independently verify the claims of this blog post.

Proctorio is violating Google's Policies about code obfuscation.

AKE Notes

You                                                 Friend
 \              {   I N T E R N E T   }             /
  ()---[]------[]--------[]------Z ? 7-----[]------()

1. Encryption!

If you don't make security a top priority, you will get breached. If you take nothing else away from this letter, let it be those words.

Let's talk, furries.

As we all know, FurAffinity got hacked not too long ago. Rather than rehash the events as they're still unfolding, let's just call it a grease-fire that the staff are desperately trying to put out by

	Delivered-To: [email protected]
	Received: by 2002:a05:6358:4b10:b0:1cb:2a1f:10d0 with SMTP id kr16csp5261208rwc;
	Tue, 24 Dec 2024 21:09:02 -0800 (PST)
	X-Google-Smtp-Source: AGHT+IEt45MWkqbgPWrhCoGhSYiwbFccSqsFktKLMzW+XlvhlDNkmEI0LK9Pe75OBHol8ILXuLje
	X-Received: by 2002:a05:620a:4052:b0:7b6:cf71:2788 with SMTP id af79cd13be357-7b9ba716904mr2931608485a.11.1735103342377;
	Tue, 24 Dec 2024 21:09:02 -0800 (PST)
	ARC-Seal: i=1; a=rsa-sha256; t=1735103342; cv=none;
	d=google.com; s=arc-20240605;
	b=h8bcnBIufc2ts7AMqwpkkEeksPqsYh9fbI2jkclt5SsgHmmT5XdPYKkw/WiE1zMKaa
	U7c6uoh415ALjvgZfXUT9GpJO1JrEfL9zoel+7J8oxxi+5iehySfLpjq6PqM5sXivQ/0

	<?php
	/**
	* Usage: Run this from the command line to generate a secure passphrase in the format
	* of stereotypical bottom keymashing.
	*
	* php bottom-responder.php \| xclip
	*
	* Why? Because furries ruin everything, including bottom jokes.
	*/
	function random_str(int $length, string $charset): string {

	<?php
	declare(strict_types=1);

	$password = 'OwO what\'s this?';

	$alg = SODIUM_CRYPTO_PWHASH_ALG_DEFAULT;
	$opslimit = SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE;
	$memlimit = SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE;
	$salt = 'YIFFYIFFYIFFYIFF';