| 18 Jul 2025 |
 Charles | I personally am interested in other protocols at this point | 17:21:28 |
 emily | In reply to @charles:computer.surgery
Yeah IMO they need to drop this change, many good reasons to keep it, no good reasons to drop it I don't know if the embargo lifted yet and I assume you're on the inside of it so feel free to decline to comment but: in your judgement should NixOS even bother trying to upgrade our rooms? or just wait until a less rushed v13 or something? | 17:22:03 |
| Charles | I think I can reasonably confirm I have insider info but on the second point I think I'll just ask if you saw the update to the blog post | 17:23:15 |
| emily | I did, yeah. I was hoping for more nuance 😅 | 17:23:36 |
| emily | but I guess all relevant nuance is an embargo violation really | 17:23:50 |
 f0x | given nixos was already targeted heavily by the spam attacks, I would be afraid of that same person/group trying to mess with rooms, but probably only when the vuln/poc is actually public | 17:23:52 |
| Charles | That is worth considering for sure | 17:24:20 |
| emily | I don't think we even have a way to upgrade our hundreds of rooms en masse | 17:24:38 |
| emily | We've just been manually doing it when the split brain gets bad enough | 17:24:44 |
| emily | and from @k900:0upti.me's grumbling I get the impression it's been very manual every time | 17:25:10 |
| f0x | ideally Draupnir/*nir could handle it, though not sure if they consider that out of scope | 17:25:27 |
| emily | if we should be thinking about upgrading in a fairly timely manner after disclosure then that's only an option if they ship it quick I guess | 17:26:47 |
| f0x | might need to figure out and automated way for my irc bridge's rooms too, but I don't think the bridge itself even handles room upgrades properly.... ugh | 17:27:09 |
| f0x | * might need to figure out an automated way for my irc bridge's rooms too, but I don't think the bridge itself even handles room upgrades properly.... ugh | 17:27:41 |
| Charles | Yeah bridges are like the number one reason people don't upgrade rooms | 17:27:47 |
 Cat | Im not on the inside of the embargo in any capacity so i have no handcuffs. And dont wait for v13 thats way too far off in the pipeline. | 17:27:55 |
| Cat | Its not out of scope. | 17:28:31 |
| Cat | Especially after the blogpost im writing. | 17:28:38 |
| f0x | oh that's good to hear :) | 17:29:19 |
 [0x4A6F] | I did something back then: https://github.com/NixOS/infra/wiki/Tombstoning-a-room-on-Matrix | 17:29:54 |
| emily | if the admins can just run a draupnir command and get every room upgraded that would be great I assume | 17:30:22 |
| Cat | essentially im going to say that in addition to how i already wrote about the broken words we use for moderation im going to write about the broken community structures most communities have and the primary group that doesnt are actually communities with heavy corporate influence.
One of those bits of shit that is broken on matrix is that we dont make all rooms owned by either the administrative team or T&S depending on how the community is setup. That way all room admins who leave the community can be demoted for everyones saftey. | 17:30:26 |
| emily | probably even one command per room would be a big help | 17:30:32 |
| Cat | The reason why communities with corporate influence tend to organise healthy is because corporations learned how to organise properly already. They know that Security, IT administration and Human Relations are not something that the same people are good at. So separate them.
Communities need to understand that your admins need not be moderators. Leave moderation to moderators and administration to administrators even if they sometimes are the same creature with diffrent hats.
So thats the TLDR of what my post will be about and this will materialise in Draupnir with Draupnir supporting this pattern of having a team own stuff so that team members can come and go without it being a security risk. | 17:33:21 |
| Cat | So since Draupnir must be able to create your rooms now it also needs a manual room upgrade command even if its a rudementary one at that. | 17:34:24 |
| emily | In reply to @0x4a6f:matrix.org
I did something back then: https://github.com/NixOS/infra/wiki/Tombstoning-a-room-on-Matrix good grief has @k900:0upti.me really been doing this | 17:35:22 |
| Cat | Thats a creative solution to the problem. | 17:36:54 |
| Cat | using 2 tombstones. | 17:37:03 |
| Cat | https://gitea.blesmrt.net/mikaela/scripts/src/branch/master/bash/matrix-upgrade-room.bash is the script i like to refer to. | 17:38:08 |
| emily | I'm inferring that the bug v12 tries to fix is "an attacker can make a room's state permanently screwed up beyond fixing" | 17:39:22 |
