[perttir]

They had root account activated in hebe? Am i reading this right? He got an passlist of 5 million users?

[beagle3]

But even if they didn't, "sudo -u root /bin/bash" or similar gives it to you unless sudo is extremely locked down (which, from audits I have done, is "rarely if ever").

There are hundreds of ways to get root prompt even with the root account nominally deactivated.

[saagarjha]

Yup: https://github.com/matrix-org/matrix.org/issues/358

[m_b]

yeah