full-disclosure - Re: mailman email harvester

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: bernhard at bksys.at (Bernhard Kuemel)
Subject: Re: mailman email harvester

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dana Hudes wrote:
| The report is good. Attaching the results in their entirety gives
| spammers who don't have your technical capability, not to mention
|  script kiddies looking for victims for their viruses, a huge leg
| up. Irresponsible doesn't begin to describe it.

So let's shut down full-disclosure.

| More appropriate would be specimens and a description of
| methodology.

I informed the mailman developers about the problem more than a year
ago and the number of vulnerable lists only increased:

http://www.mail-archive.com/mailman-developers@python.org/msg06853.html

If they don't spread the word someone else has to do it. I'm not
worried about the 60,000 email addresses. They asked for being this
example by being public. Let's hope this will make list admins
secure the addresses which are only available to subscribers (which
are a lot more).

Bye, Bernhard
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Using GnuPG with Debian - http://enigmail.mozdev.org

iD8DBQFCChum9zL78+QhnUgRAoO8AJ9E3ph/U0Czys+Zx2Dorzx/AamfYACfaELr
G+d9ospmfb902OzDZM4ci24=
=wzz9
-----END PGP SIGNATURE-----