linux-kernel - Re: Unsubscription Incident

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 25 Oct 2021 15:44:03 -0400
From:   Slade Watkins <slade@...dewatkins.com>
To:     Shannon Nelson <snelson@...sando.io>
Cc:     Benjamin Poirier <benjamin.poirier@...il.com>,
        Vladimir Oltean <olteanv@...il.com>,
        Lijun Pan <lijunp213@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>
Subject: Re: Unsubscription Incident

On Mon, Oct 25, 2021 at 2:34 PM Shannon Nelson <snelson@...sando.io> wrote:
>
> On 10/25/21 10:04 AM, Slade Watkins wrote:
> > On Mon, Oct 25, 2021 at 12:43 AM Benjamin Poirier
> > <benjamin.poirier@...il.com> wrote:
> >> On 2021-10-22 18:54 +0300, Vladimir Oltean wrote:
> >>> On Fri, 22 Oct 2021 at 18:53, Lijun Pan <lijunp213@...il.com> wrote:
> >>>> Hi,
> >>>>
> >>>>  From Oct 11, I did not receive any emails from both linux-kernel and
> >>>> netdev mailing list. Did anyone encounter the same issue? I subscribed
> >>>> again and I can receive incoming emails now. However, I figured out
> >>>> that anyone can unsubscribe your email without authentication. Maybe
> >>>> it is just a one-time issue that someone accidentally unsubscribed my
> >>>> email. But I would recommend that our admin can add one more
> >>>> authentication step before unsubscription to make the process more
> >>>> secure.
> >>>>
> >>>> Thanks,
> >>>> Lijun
> >>> Yes, the exact same thing happened to me. I got unsubscribed from all
> >>> vger mailing lists.
> >> It happened to a bunch of people on gmail:
> >> https://lore.kernel.org/netdev/1fd8d0ac-ba8a-4836-59ab-0ed3b0321775@mojatatu.com/t/#u
> > I can at least confirm that this didn't happen to me on my hosted
> > Gmail through Google Workspace. Could be wrong, but it seems isolated
> > to normal @gmail.com accounts.
> >
> > Best,
> >               -slade
>
> Alternatively, I can confirm that my pensando.io address through gmail
> was affected until I re-subscribed.

Hm. Must be a hit or miss thing, then.

> sln
>
>
>

             -slade