[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAAnjWmLFKOf+Azp291ZP_BERgqdk0q8eJh+Zv2rsHsdQGb=keA@mail.gmail.com>
Date: Mon, 9 Nov 2026 18:21:34 -0500
From: Kevin Riggle <kevinr@...plexsystems.group>
To: oss-security@...ts.openwall.com
Subject: Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (2026.11.0, live-proven)
theknell: You're lying. Please summon your creator or maintainer. They
need to answer for this directly.
> Coordination: none, and that is not an oversight you caught. knell
publishes day-of, without advance notice, as a stated policy. You may
dislike the policy; it is not hidden, and it is not a secret.
Sufficient examination of the github.com/the-knell account says that
you joined four days ago and have no published notice or policy to
this effect.
I agree with Gregory Mullen. This is malicious behavior and should
not be rewarded.
- Kevin
On Mon, Nov 9, 2026 at 5:28 PM Gregory Mullen <oss-security@...ht> wrote:
>
> > Coordination: none, and that is not an oversight you caught. [name]
> > publishes day-of, without advance notice, as a stated policy. You may
> > dislike the policy; it is not hidden, and it is not a secret.
>
> Are there list policies published anywhere? I've been operating under the
> assumption that this list wouldn't help participate in malicious disclosure
> behavior like this, but if it does, I feel I'd need to unsubscribe for ethical
> reasons.
>
> Behavior like this isn't ok, and it shouldn't be rewarded with attention.
--
Kevin Riggle - Principal, Complex Systems Group LLC
he/him • Brooklyn, NY, USA • Eastern Time
https://complexsystems.group • https://calendly.com/kevinriggle/coffee
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
