<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">Actually, it's only *your* password that's being emailed in the clear. It's punishment for failing to observe the first rule of this list, which is DO NOT TOP POST.</div></div></div></blockquote><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><br></div><div class="gmail_quote">Huh?</div><div class="gmail_quote"><br></div><div class="gmail_quote">1. I don't know what "top post" means, and I see nothing here about it: <a href="http://www.metzdowd.com/mailman/listinfo/cryptography">http://www.metzdowd.com/mailman/listinfo/cryptography</a></div><div class="gmail_quote"><br></div><div class="gmail_quote">2. The password was sent to me as part of a poorly configured mailing list bot, not any sort of "punishment".</div><div class="gmail_quote"><br></div><div class="gmail_quote">3. Even if it was sent to me as "punishment", that is retarded.</div><div class="gmail_quote"><br></div><div class="gmail_quote"><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">If you don't like the way this list is run, you are welcome to unsubscribe.</div></div></div></blockquote><br></div><div class="gmail_quote">Yeah, I know. I might do that, as seeing the response to my request has convinced me there's little worth reading here anyway.</div><div class="gmail_quote"><br></div><div class="gmail_quote"><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">The person running this list knows his job very well, and I'd suggest you be a bit more respectful of him.</div></div></div></blockquote><br></div><div class="gmail_quote">What did I say that you feel was disrespectful? That he's failing at his job? That's not disrespectful, that's my opinion based on the fact that he is choosing to mail people their list passwords in the clear.</div><div class="gmail_quote"><br></div><div class="gmail_quote">Running a mailing list is not hard work. There are only so many things one can fuck up. This is probably one of the biggest mistakes that can be made in running a mailing list, and on a list that's about software security. It's just ridiculous.</div><div class="gmail_quote"><br></div><div class="gmail_quote">A mailing list shouldn't have any passwords to begin with. There is no need for passwords, and it shouldn't be possible for anyone to unsubscribe anyone else.</div><div class="gmail_quote"><br></div><div class="gmail_quote">User: Unsubscribe [EMAIL] -> Server</div><div class="gmail_quote">Server: Are you sure? -> [EMAIL]</div><div class="gmail_quote">User@[EMAIL]: YES! -> Server.</div><div class="gmail_quote"><br></div><div class="gmail_quote">No passwords, and no fake unsubscribes.</div><div class="gmail_quote"><br></div><div class="gmail_quote">- Greg</div></div></div></div><div>
<br>--<br>Please do not email me anything that you are not comfortable also sharing with the NSA.<br>
</div>
<br><div><div>On Oct 1, 2013, at 4:56 PM, John Ioannidis <<a href="mailto:ji@tla.org">ji@tla.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">On Tue, Oct 1, 2013 at 12:56 PM, Greg <span dir="ltr"><<a href="mailto:greg@kinostudios.com" target="_blank">greg@kinostudios.com</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote">
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex; position: static; z-index: auto; "><div style="word-wrap:break-word">There is nothing difficult about the right course of action here: Don't send the password. Disable this silly default.<div>
<br></div><div>The attitude expressed in these replies is a disgrace to the profession of software security, and a disgrace to the list.</div><div><br></div><div>It doesn't matter whether or not I "should" be using a unique password. I <b>might not be, </b>and even if I am, a nerd next to me shouldn't be able to change my subscription settings because of the listserv's idiotic setting.</div>
<div><br></div><div>It is NOT the user's responsibility to compensate for the incompetence of sys admins or software developers. They are the ones who are failing their jobs.</div><div><br></div></div></blockquote><div>
<br></div><div>Actually, it's only *your* password that's being emailed in the clear. It's punishment for failing to observe the first rule of this list, which is DO NOT TOP POST.</div><div><br></div><div>If you don't like the way this list is run, you are welcome to unsubscribe. The password for unsubscribing has been already emailed to you. The person running this list knows his job very well, and I'd suggest you be a bit more respectful of him.</div>
<div><br></div><div>/ji</div><div><br></div></div></div></div>
</blockquote></div><br></body></html>