diff --git a/pkgs/development/libraries/olm/default.nix b/pkgs/development/libraries/olm/default.nix index 3fda0206ace5781..9dcd627d6f9fe24 100644 --- a/pkgs/development/libraries/olm/default.nix +++ b/pkgs/development/libraries/olm/default.nix @@ -34,11 +34,11 @@ stdenv.mkDerivation rec { disclaims that its implementations are not cryptographically secure and should not be used when cryptographic security is required. - It is not known that the issues can be exploited over the network in - practical conditions. Upstream has stated that the library should - not be used going forwards, and there are no plans to move to a - another cryptography implementation or otherwise further maintain - the library at all. + It is not known if the issues can be exploited over the network in + practical conditions. Upstream does not believe such an attack is + feasible, but has stated that the library should not be used going + forward, and there are no plans to move to a another cryptography + implementation or otherwise further maintain the library at all. You should make an informed decision about whether to override this security warning, especially if you critically rely on end‐to‐end @@ -70,6 +70,11 @@ stdenv.mkDerivation rec { project lead: + * A blog post about libolm's deprecation on the Matrix.org blog that also + explains why upstream believes the vulnerabilities are not exploitable + over the network: + + * A (likely incomplete) aggregation of client tracking issue links: '' ];