undefined | Better HN

0 pointssneak4y ago0 comments

> I'm puzzled by this comment. Can you elaborate on what you mean by phoning home?

On first launch, it connects to multiple centralized servers before you have a chance to select your homeserver.

The issue was with the default client, in the default config.

Not sure if it's still happening, but it was concerning enough that it happened in the first place.

https://github.com/vector-im/element-web/issues/13942

https://github.com/vector-im/element-web/issues/12712

https://github.com/vector-im/element-web/issues/11655

https://github.com/vector-im/element-web/issues/11655#issuec...

It would also appear that it intends to maintain a Solarwinds-style remote code execution vulnerability on the machine on which it is installed:

https://github.com/vector-im/element-web/issues/11655#issuec...

0 comments

Arathorn4y ago

As per my comment at https://github.com/vector-im/element-web/issues/11655#issuec..., we'll switch auto-update checks to require user confirmation.

HotHotLava4y ago

Did you maybe post the wrong link?

The comment you're linking to says that there are no current plans to change the default request to matrix.org from the login page, and that you explicitly plan to keep the current auto-updating behavior.

(also, of course "we will fix that" implies that it is currently still broken, which is what the original commenter was pointing out)

Arathorn4y ago

The comment i linked is me saying:

> we're going to fix this, and yes, imo, autoupdates need an opt-in.

i'm not sure how clearer i can be.

2 more replies

j / k navigate · click thread line to collapse

0 pointssneak4y ago0 comments

> I'm puzzled by this comment. Can you elaborate on what you mean by phoning home?

On first launch, it connects to multiple centralized servers before you have a chance to select your homeserver.

The issue was with the default client, in the default config.

Not sure if it's still happening, but it was concerning enough that it happened in the first place.

https://github.com/vector-im/element-web/issues/13942

https://github.com/vector-im/element-web/issues/12712

https://github.com/vector-im/element-web/issues/11655

https://github.com/vector-im/element-web/issues/11655#issuec...

It would also appear that it intends to maintain a Solarwinds-style remote code execution vulnerability on the machine on which it is installed:

https://github.com/vector-im/element-web/issues/11655#issuec...

0 comments

Arathorn4y ago

As per my comment at https://github.com/vector-im/element-web/issues/11655#issuec..., we'll switch auto-update checks to require user confirmation.

HotHotLava4y ago

Did you maybe post the wrong link?

(also, of course "we will fix that" implies that it is currently still broken, which is what the original commenter was pointing out)

Arathorn4y ago

The comment i linked is me saying:

> we're going to fix this, and yes, imo, autoupdates need an opt-in.

i'm not sure how clearer i can be.

2 more replies

j / k navigate · click thread line to collapse