Conversation

Notices

1. Embed this notice
   Soatok Dreamseeker (soatok@furry.engineer)'s status on Tuesday, 24-Feb-2026 05:43:30 JST Soatok Dreamseeker

   What should I do with a remotely exploitable DoS in Synapse server?

   (No, I'm not talking about their setup instructions.)

   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Tuesday, 24-Feb-2026 05:49:41 JST Soatok Dreamseeker

     in reply to

     • ww

     @ww Eh, computer crimes aren't my thing

   • Embed this notice
     ww (ww@xyzzy.link)'s status on Tuesday, 24-Feb-2026 05:49:42 JST ww

     in reply to
     @soatok exploit it :KuromiMischevious:
   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Tuesday, 24-Feb-2026 05:53:44 JST Soatok Dreamseeker

     in reply to

     • ww

     @ww Pretty sure the feds would still consider me an accessory if I did that

   • Embed this notice
     ww (ww@xyzzy.link)'s status on Tuesday, 24-Feb-2026 05:53:45 JST ww

     in reply to
     @soatok then you could delegate them to someone else!
   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Tuesday, 24-Feb-2026 06:01:30 JST Soatok Dreamseeker

     • Spork ✌️

     @spork Yeah, I guess. I emailed them.

   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Tuesday, 24-Feb-2026 06:06:56 JST Soatok Dreamseeker

     in reply to

     • ティージェーグレェ
     • Spork ✌️

     @teajaygrey @spork I ended up emailing them.

     Causing availability issues for Matrix is kind of pointless as the service is already unreliable.

   • Embed this notice
     ティージェーグレェ (teajaygrey@snac.bsd.cafe)'s status on Tuesday, 24-Feb-2026 06:06:57 JST ティージェーグレェ

     • Spork ✌️
     I'm guessing this Synapse: https://github.com/element-hq/synapse ?
     
     /me looks forward to another write up/blog post.
     
     I guess you can file a bug? ¯\_(ツ)_/¯
     
     /me looks at project 1.8k issues, 117 open Pull Requests.
     
     That, doesn't look promising.
     
     Just seeing if said bug has already been found and reported, looks as if it might take a while!
     
     /me notes: MacPorts' currently has 71 open Pull Requests: https://github.com/macports/macports-ports/pulls
     
     (MacPorts has IIRC, over 40,000 ports, and attempts to support the current version of macOS going back to OS X Leopard on PPC. [yes, I realize, this does gloss over MacPorts' Trac; but some of those Trac issues are pretty inconsequential, like: https://trac.macports.org/ticket/67457 will I ever get around to finishing the Portfile for SmallTalk-80 to make a Pull Request? Meh, the work in progress Portfile works and I shared it there as a means of documenting things outside of local systems, and I don't think upstream has tagged a release and I sort of got distracted. Someday, maybe. In the meantime: no one is impacted, so, I don't lose sleep.])
     
     CC: @soatok@furry.engineer
     
   • Embed this notice
     vvelox (vvelox@goatdaddy.net)'s status on Tuesday, 24-Feb-2026 06:11:15 JST vvelox

     in reply to
     @soatok Release it and let the fun happen organically? There is even a fun song and dance that goes with this.
   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Tuesday, 24-Feb-2026 06:11:57 JST Soatok Dreamseeker

     in reply to

     • Rodolphe

     @rodolphe Oh, interesting

   • Embed this notice
     Rodolphe (rodolphe@pwet.what.tf)'s status on Tuesday, 24-Feb-2026 06:11:58 JST Rodolphe

     in reply to
     @soatok You could write all the details in an email to cert-fr@ssi.gouv.fr, it's a french government agency with a specific vulnerability disclosure program. It's opened to all kind of vulnerability, the only restriction is that the affected entity must be french. Since Tchap, the french instant-messaging platform for government workers, is based on Matrix, it's likely to be affected.
     
     If you write to them in good faith, they will handle everything after and keep you anonymous so the affected people cannot go after you. People may not react when an individual contact them about a security issue, but when it's a government agency the answer is different.
     
     Related links (in french):
     https://cyber.gouv.fr/reglementation/cybersecurite-systemes-dinformation/declaration-de-vulnerabilit%C3%A9s/
     https://www.cert.ssi.gouv.fr/signalements/