I-Matrix iyiphrothokholi yemiyalezo esheshayo evulekile. Iklanyelwe ukuvumela abasebenzisi ukuthi baxhumane ngengxoxo ye-inthanethi, ngezwi nge-IP, nengxoxo yevidiyo.
Muva nje, abathuthukisi beplatifomu yokuxhumana ehlukaniswe ngokwezinga i-"Matrix" bakhiphe isexwayiso mayelana nobuthakathaka obuningana obubalulekile obutholakale kulabhulali ye-matrix-js-sdk, matrix-ios-sdk, kanye ne-matrix-android-sdk2 evumela abaphathi beseva ukuthi bazenze abanye abasebenzisi futhi bafunde imiyalezo yengxoxo ebethelwe kusukela ekuqaleni kuze kube sekupheleni (E2EE).
Kushiwo ukuthi ukuze uqedele ngempumelelo ukuhlasela, kudingeka ukufinyelela kuseva yasekhaya elawulwa abahlaseli (iseva yasekhaya: iseva esetshenziselwa ukugcina umlando wamaklayenti nama-akhawunti). Ukusetshenziswa kokubethela kusukela ekuqaleni kuya ekugcineni ohlangothini lweklayenti kuvimbela umphathi weseva ukuthi angaphazamisi imiyalezo, kodwa ubuthakathaka obutholiwe buvumela ukuthi lokhu kuvikelwa kudlule.
Lezi zinkinga zithinta iklayenti eliyinhloko le-Element Matrix (elaliyi-Riot) le-Web, ideskithophu, i-iOS ne-Android, kanye nezinhlelo zokusebenza zamakhasimende ezinkampani zangaphandle ezifana ne-Cinny, i-Beeper, i-SchildiChat, i-Circuli kanye ne-Synod.im.
Ubungozi abubonakali kulabhulali i-matrix-rust-sdk, hydrogen-sdk, Matrix Dart SDK, mautrix-python, mautrix-go, ne-matrix-nio, kanye ne-Hydrogen, ElementX, Nheko, FluffyChat, Siphon, Timmy, Gomuks, futhi Pantalaimon izicelo.
Qaphela ukuthi izinkinga ezibucayi ezibucayi ziyizinkinga zokusetshenziswa ku-matrix-js-sdk nokuphuma kokunye, futhi akuzona izinkinga zephrothokholi ku-Matrix. Inguqulo yakamuva yephepha labacwaningi esiyibonile iveza i-Element ngendlela engalungile "njengeklayenti le-Matrix lokumaki" futhi idida amaphutha okusebenzisa ukuqina okuphezulu nokugxekwa kwephrothokholi yokuqina okuphansi.
Kunezimo ezintathu eziyinhloko zokuhlasela :
- Umlawuli weseva ye-Matrix angakwazi ukwephula ukuqinisekiswa okusekelwe ku-emoji (SAS, Amaketanga Okuqinisekisa Amafushane) ngokusebenzisa amasiginesha ahlukene nokuzenza omunye umsebenzisi. Inkinga ibangelwa ukuba sengozini (CVE-2022-39250) kukhodi ye-matrix-js-sdk ehlobene nenhlanganisela yokuphathwa kwe-ID yedivayisi nokhiye bokusayina.
- Umhlaseli olawula iseva angakwazi ukuzenza umthumeli othembekile futhi adlulise ukhiye mbumbulu ukuze abambe imilayezo evela kwabanye abasebenzisi. Inkinga ingenxa yokuba sengozini ku-matrix-js-sdk (CVE-2022-39251), i-matrix-ios-sdk (CVE-2022-39255), kanye ne-matrix-android-sdk2 (CVE-2022-39248), okubangele the Iklayenti lamukela ngokungalungile imilayezo eqondiswe kumadivayisi abethelwe kusetshenziswa iphrothokholi ye-Megolm esikhundleni se-Olm , ichaza imilayezo kumthumeli we-Megolm esikhundleni somthumeli wangempela.
- Ngokuxhaphaza ubungozi obushiwo esigabeni sangaphambilini, umlawuli weseva angakwazi futhi ukwengeza ukhiye oyidummy oyisipele ku-akhawunti yomsebenzisi ukuze akhiphe okhiye abasetshenziselwa ukubethela imilayezo.
Abacwaningi abathole ubuthakathaka baphinde babonisa ukuhlaselwa okwengeza umsebenzisi wesithathu engxoxweni noma ukuxhuma idivayisi yomuntu wesithathu kumsebenzisi. Lokhu kuhlasela kusebenzisa kabi iqiniso lokuthi imiyalezo yesevisi esetshenziselwa ukwengeza abasebenzisi engxoxweni ayixhunyanisiwe nezihluthulelo zomdali wengxoxo futhi ingakhiqizwa umphathi weseva.
Abathuthukisi bephrojekthi ye-Matrix bahlukanise lobu buthakathaka njengento encane , njengoba ukukhohlisa okunjalo kungeyona into ethile ku-Matrix futhi kuthinta amaklayenti kuphela ngokusekelwe kuphrothokholi, kodwa lokhu akusho ukuthi ngeke kunganakwa: uma umsebenzisi eshintshwa, uzoboniswa ohlwini lwabasebenzisi bengxoxo, futhi uma idivayisi ingeziwe, kuzoboniswa isexwayiso futhi idivayisi izomakwa njengengaqinisekisiwe (kulokhu, ngokushesha ngemva kokwengeza idivayisi engagunyaziwe, izoqala ukuthola okhiye bomphakathi abadingekayo ukuze kususwe ukubethela imiyalezo).
Uzoqaphela ukuthi i-matrix-rust-sdk, i-hydrogen-sdk, namanye ama-SDK esizukulwane sesi-XNUMX nesesithathu awathintwanga iziphazamisi kumsuka wezinkinga ezibucayi lapha. Yingakho nje kade sisebenzela ukumiselela ama-SDK esizukulwane sokuqala ngokusetshenziswa okuhlanzekile, okubhalwe ngokucophelela kwe-Rust ngendlela ye-matrix-rust-sdk, egcwaliswe ngocwaningomabhuku oluzimele oluqhubekayo.
Ubuthakathaka bubangelwa amaphutha ekusetshenzisweni ngakunye kwephrothokholi ye-Matrix futhi akuzona izinkinga ngephrothokholi ngokwayo. Iphrojekthi okwamanje ikhiphe izibuyekezo zama-SDK athintekile kanye nezinye zezinhlelo zokusebenza zamakhasimende ezakhelwe phezu kwawo.
Okokugcina, uma unesithakazelo sokufunda kabanzi ngalokhu , ungathola imininingwane kusixhumanisi esilandelayo.