Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: Unsubscription Incident
To:     Slade Watkins <slade@sladewatkins.com>,
        Benjamin Poirier <benjamin.poirier@gmail.com>
Cc:     Vladimir Oltean <olteanv@gmail.com>,
        Lijun Pan <lijunp213@gmail.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Networking <netdev@vger.kernel.org>,
        Alan Coopersmith <alan.coopersmith@oracle.com>
References: <CAOhMmr7bWv_UgdkFZz89O4=WRfUFhXHH5hHEOBBfBaAR8f4Ygw@mail.gmail.com>
 <CA+h21hqrX32qBmmdcNiNkp6_QvzsX61msyJ5_g+-FFJazxLgDw@mail.gmail.com>
 <YXY15jCBCAgB88uT@d3>
 <CA+pv=HPyCEXvLbqpAgWutmxTmZ8TzHyxf3U3UK_KQ=ePXSigBQ@mail.gmail.com>
From:   Metztli Information Technology <jose.r.r@metztli.com>
Message-ID: <c00f22d2-6566-8911-b56b-142f6fe42b8c@metztli.com>
Date:   Mon, 25 Oct 2021 11:08:16 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <CA+pv=HPyCEXvLbqpAgWutmxTmZ8TzHyxf3U3UK_KQ=ePXSigBQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Precedence: bulk


On 10/25/21 10:04 AM, Slade Watkins wrote:
> On Mon, Oct 25, 2021 at 12:43 AM Benjamin Poirier
> <benjamin.poirier@gmail.com> wrote:
>> On 2021-10-22 18:54 +0300, Vladimir Oltean wrote:
>>> On Fri, 22 Oct 2021 at 18:53, Lijun Pan <lijunp213@gmail.com> wrote:
>>>> Hi,
>>>>
>>>>  From Oct 11, I did not receive any emails from both linux-kernel and
>>>> netdev mailing list. Did anyone encounter the same issue? I subscribed
>>>> again and I can receive incoming emails now. However, I figured out
>>>> that anyone can unsubscribe your email without authentication. Maybe
>>>> it is just a one-time issue that someone accidentally unsubscribed my
>>>> email. But I would recommend that our admin can add one more
>>>> authentication step before unsubscription to make the process more
>>>> secure.
>>>>
>>>> Thanks,
>>>> Lijun
>>> Yes, the exact same thing happened to me. I got unsubscribed from all
>>> vger mailing lists.
>> It happened to a bunch of people on gmail:
>> https://lore.kernel.org/netdev/1fd8d0ac-ba8a-4836-59ab-0ed3b0321775@mojatatu.com/t/#u
> I can at least confirm that this didn't happen to me on my hosted
> Gmail through Google Workspace. Could be wrong, but it seems isolated
> to normal @gmail.com accounts.
>
> Best,
>               -slade

Niltze [Hello], all-

Could it have something to do with the following?

---------- Forwarded message ---------

From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu, Oct 21, 2021 at 12:06 PM
Subject: [oss-security] Mailman 2.1.35 security release
To: <oss-security@lists.openwall.com>


Quoting from Mark Sapiro's emails at:
https://mail.python.org/archives/list/mailman-announce@python.org/thread/IKCO6JU755AP5G5TKMBJL6IEZQTTNPDQ/

 > A couple of vulnerabilities have recently been reported. Thanks to Andre
 > Protas, Richard Cloke and Andy Nuttall of Apple for reporting these and
 > helping with the development of a fix.
 >
 > CVE-2021-42096 could allow a list member to discover the list admin
 > password.
 >
 > CVE-2021-42097 could allow a list member to create a successful CSRF
 > attack against another list member enabling takeover of the members 
account.
 >
 > These attacks can't be carried out by non-members so may not be of
 > concern for sites with only trusted list members.


 > I am pleased to announce the release of Mailman 2.1.35.
 >
 > This is a security and minor bug fix release. See the attached
 > README.txt for details. For those who just want a patch for the security
 > issues, see
 > https://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1873.
 > The patch is also attached to the bug reports at
 > https://bugs.launchpad.net/mailman/+bug/1947639 and
 > https://bugs.launchpad.net/mailman/+bug/1947640. The patch is the same
 > on both and fixes both issues.
 >
 > As noted Mailman 2.1.30 was the last feature release of the Mailman 2.1
 > branch from the GNU Mailman project. There has been some discussion as
 > to what this means. It means there will be no more releases from the GNU
 > Mailman project containing any new features. There may be future patch
 > releases to address the following:
 >
 > i18n updates.
 > security issues.
 > bugs affecting operation for which no satisfactory workaround exists.
 >
 > Mailman 2.1.35 is the fifth such patch release.
 >
 > Mailman is free software for managing email mailing lists and
 > e-newsletters. Mailman is used for all the python.org and
 > SourceForge.net mailing lists, as well as at hundreds of other sites.
 >
 > For more information, please see our web site at one of:
 >
 > http://www.list.org
 > https://www.gnu.org/software/mailman
 > http://mailman.sourceforge.net/
 >
 > Mailman 2.1.35 can be downloaded from
 >
 > https://launchpad.net/mailman/2.1/
 > https://ftp.gnu.org/gnu/mailman/
 > https://sourceforge.net/projects/mailman/

 > --
 >        -Alan Coopersmith- alan.coopersmith@oracle.com
 >         Oracle Solaris Engineering - https://blogs.oracle.com/alanc


Best Professional Regards.

-- 
Jose R R
http://metztli.it
---------------------------------------------------------------------------------------------
Download Metztli Reiser4: Debian Bullseye w/ Linux 5.13.14 AMD64
---------------------------------------------------------------------------------------------
feats ZSTD compression https://sf.net/projects/metztli-reiser4/
---------------------------------------------------------------------------------------------
or SFRN 5.1.3, Metztli Reiser5 https://sf.net/projects/debian-reiser4/
-------------------------------------------------------------------------------------------
Official current Reiser4 resources: https://reiser4.wiki.kernel.org/