The attacker seems to have responded:<p><a href="https://github.com/matrix-org/matrix.org/issues/357" rel="nofollow">https://github.com/matrix-org/matrix.org/issues/357</a>
edit: just saw the rest: <a href="https://github.com/matrix-org/matrix.org/issues?utf8=%E2%9C%93&q=is%3Aissue+SECURITY" rel="nofollow">https://github.com/matrix-org/matrix.org/issues?utf8=%E2%9C%...</a><p>"[SECURITY] SSH Agent Forwarding<p>I noticed in your blog post that you were talking about doing a postmortem and steps you need to take. As someone who is intimately familiar with your entire infrastructure, I thought I could help you out.<p>Complete compromise could have been avoided if developers were prohibited from using ForwardAgent yes or not using -A in their SSH commands. The flaws with agent forwarding are well documented."
Did the blog get hacked (again?) in between this being posted and now? It has what looks like password hashes and `uname -a` from every(?) server in their infrastructure.<p>This is about as bad as IR can get: you realize you got hacked, you re-build your entire infrastructure and publicly say it's fixed, and then you get popped again...
The most favorable reading of the current defacement page is that the attackers still controls the DNS, but no other parts of the infrastructure.<p>Otherwise, the page probably wouldn't run off github.
Assuming the GitHub issues are from the actual attacker -- and I see no reason to doubt they are -- this is very troubling:<p><a href="https://github.com/matrix-org/matrix.org/issues/363" rel="nofollow">https://github.com/matrix-org/matrix.org/issues/363</a><p><i>Compromise began well over a month ago</i><p>Yikes. That's a long time for a compromise to go unnoticed.
> As we had to log out all users from matrix.org, if you do not have backups of your encryption keys you will not be able to read your encrypted conversation history<p>That seems like a fairly bad usability/security design?
content before it gets fixed:<p><pre><code> Time for actual transparency.
[list of servers, uname -a for each]
root@[name]:/var/lib/postgresql# df -h
[list of partitions]
$ cat users.txt | grep [name] | head -n1
@[name]:matrix.org|[hash]
$ wc -l users.txt
[~6M users]
See you soon.
</code></pre>
(affects whole site, even <a href="https://matrix.org" rel="nofollow">https://matrix.org</a>, site is on jekyll BTW)