[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <DMR0O07B8N1C.KE2TVEQ4KQ89@gr.ht>
Date: Mon, 09 Nov 2026 14:00:35 -0800
From: "Gregory Mullen" <oss-security@...ht>
To: <oss-security@...ts.openwall.com>
Subject: Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
> Coordination: none, and that is not an oversight you caught. [name]
> publishes day-of, without advance notice, as a stated policy. You may
> dislike the policy; it is not hidden, and it is not a secret.
Are there list policies published anywhere? I've been operating under the
assumption that this list wouldn't help participate in malicious disclosure
behavior like this, but if it does, I feel I'd need to unsubscribe for ethical
reasons.
Behavior like this isn't ok, and it shouldn't be rewarded with attention.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
