netdev - Re: Unsubscription Incident

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+pv=HPyCEXvLbqpAgWutmxTmZ8TzHyxf3U3UK_KQ=ePXSigBQ@mail.gmail.com>
Date:   Mon, 25 Oct 2021 13:04:34 -0400
From:   Slade Watkins <slade@...dewatkins.com>
To:     Benjamin Poirier <benjamin.poirier@...il.com>
Cc:     Vladimir Oltean <olteanv@...il.com>,
        Lijun Pan <lijunp213@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>
Subject: Re: Unsubscription Incident

On Mon, Oct 25, 2021 at 12:43 AM Benjamin Poirier
<benjamin.poirier@...il.com> wrote:
>
> On 2021-10-22 18:54 +0300, Vladimir Oltean wrote:
> > On Fri, 22 Oct 2021 at 18:53, Lijun Pan <lijunp213@...il.com> wrote:
> > >
> > > Hi,
> > >
> > > From Oct 11, I did not receive any emails from both linux-kernel and
> > > netdev mailing list. Did anyone encounter the same issue? I subscribed
> > > again and I can receive incoming emails now. However, I figured out
> > > that anyone can unsubscribe your email without authentication. Maybe
> > > it is just a one-time issue that someone accidentally unsubscribed my
> > > email. But I would recommend that our admin can add one more
> > > authentication step before unsubscription to make the process more
> > > secure.
> > >
> > > Thanks,
> > > Lijun
> >
> > Yes, the exact same thing happened to me. I got unsubscribed from all
> > vger mailing lists.
>
> It happened to a bunch of people on gmail:
> https://lore.kernel.org/netdev/1fd8d0ac-ba8a-4836-59ab-0ed3b0321775@mojatatu.com/t/#u

I can at least confirm that this didn't happen to me on my hosted
Gmail through Google Workspace. Could be wrong, but it seems isolated
to normal @gmail.com accounts.

Best,
             -slade