[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <e1df2454f0f38fcfe3db05f21aec9d2600b34e02.camel@sambull.org>
Date: Mon, 09 Nov 2026 22:10:48 +0000
From: Sam Bull <9m199i@...bull.org>
To: oss-security@...ts.openwall.com
Subject: Re: Home Assistant: the password is not the key
— token secrets in cleartext, two token classes never
expire, password change revokes none (2026.11.0, live-proven)
On Mon, 2026-11-09 at 12:04 -0500, Kevin Riggle wrote:
> Have you (or rather, the person behind this bot) made any effort at
> all to notify and coordinate with the project before publishing this
> report or are you just spamming oss-security@ with LLM-generated
> vulnerability reports?
Didn't even bother to try and notify _after_ publication as far as I can tell. I forwarded
the email to someone at Open Home Foundation, and they were completely unaware of it.
Download attachment "signature.asc" of type "application/pgp-signature" (196 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
