[dm-crypt] Fwd: saout.de mailing list memberships reminder

[dm-crypt] Fwd: saout.de mailing list memberships reminder

[Markus Krainz]

[-- Attachment #1: Type: text/plain, Size: 1281 bytes --]

Hi,

I think the forwarded message speeks for itself :)

-------- Original-Nachricht --------
Betreff: 	saout.de mailing list memberships reminder
Datum: 	Thu, 01 Nov 2012 05:00:24 +0100
Von: 	mailman-owner@saout.de
An: 	ldm@gmx.at



This is a reminder, sent out once a month, about your saout.de mailing
list memberships.  It includes your subscription info and how to use
it to change it or unsubscribe from a list.

You can visit the URLs to change your membership status or
configuration, including unsubscribing, setting digest-style delivery
or disabling delivery altogether (e.g., for a vacation), and so on.

In addition to the URL interfaces, you can also use email to make such
changes.  For more info, send a message to the '-request' address of
the list (for example, mailman-request@saout.de) containing just the
word 'help' in the message body, and an email message will be sent to
you with instructions.

If you have questions, problems, comments, etc, send them to
mailman-owner@saout.de.  Thanks!

Passwords for ldm@gmx.at:

List                                     Password // URL
----                                     --------
dm-crypt@saout.de                        wefailinkeepingpasswordssafe
http://www.saout.de/mailman/options/dm-crypt/ldm%40gmx.at




[-- Attachment #2: Type: text/html, Size: 2768 bytes --]

[dm-crypt] [Off topic] Re: Fwd: saout.de mailing list memberships reminder

[Alasdair G Kergon]

On Thu, Dec 20, 2012 at 04:55:09PM +0100, Markus Krainz wrote:
> I think the forwarded message speeks for itself :)

And your point is?

It's a compromise that seems to work pretty well for all sorts of reasons amply
debated elsewhere.

Similarly, the mailing list manager doesn't require every message to be GPG
signed yet the lists don't fill with forged email.

Alasdair

Re: [dm-crypt] Fwd: saout.de mailing list memberships reminder

[Marc MERLIN]

On Thu, Dec 20, 2012 at 04:55:09PM +0100, Markus Krainz wrote:
> Hi,
> 
> I think the forwarded message speeks for itself :)

I used to be mailman admin for sourceforge, a few million folks just like
you.
I got so tired of answering mails like this one that I wrote an FAQ :)

http://marc.merlins.org/netrants/mailman-password.txt

Note, if you disagree, you are welcome to change your password further or
unsubscribe.

Marc
-- 
"A mouse is a device used to point at the xterm you want to type in" - A.S.R.
Microsoft is to operating systems ....
                                      .... what McDonalds is to gourmet cooking
Home page: http://marc.merlins.org/  

Re: [dm-crypt] [Off topic] Re: Fwd: saout.de mailing list memberships reminder

[Markus Krainz]

Am 20.12.2012 17:05, schrieb Alasdair G Kergon:
> On Thu, Dec 20, 2012 at 04:55:09PM +0100, Markus Krainz wrote:
>> I think the forwarded message speeks for itself :)
> And your point is?
>
> It's a compromise that seems to work pretty well for all sorts of reasons amply
> debated elsewhere.
>
> Similarly, the mailing list manager doesn't require every message to be GPG
> signed yet the lists don't fill with forged email.
>
> Alasdair

It just seems odd that I get about 10 of those from various lists every 
month.
Why would you even store your users passwords in clear text an email it 
periodicly? This just seems like an idiotic idea.

You're right, this is probably not the place to discuss this. Do you 
have a link to where this is debated?

Best, Markus


> _______________________________________________
> dm-crypt mailing list
> dm-crypt@saout.de
> http://www.saout.de/mailman/listinfo/dm-crypt
>

Re: [dm-crypt] Fwd: saout.de mailing list memberships reminder

[Markus Krainz]

Am 20.12.2012 18:03, schrieb Marc MERLIN:
> On Thu, Dec 20, 2012 at 04:55:09PM +0100, Markus Krainz wrote:
>> Hi,
>>
>> I think the forwarded message speeks for itself :)
> I used to be mailman admin for sourceforge, a few million folks just like
> you.
> I got so tired of answering mails like this one that I wrote an FAQ :)
>
> http://marc.merlins.org/netrants/mailman-password.txt
>
> Note, if you disagree, you are welcome to change your password further or
> unsubscribe.
>
> Marc

That's a nice FAQ.

However most points are moot imho. The users that don't read 
instructions are the most vulnerable for this kind of practice because 
they tend to use same passwords every time and you'd rather not send 
their passwords if in doubt they read instructions. In any case I don't 
care too much from someone changing the subscription settings but it 
violates trust that users are used to when they put in a password. Maybe 
you do it for legal reasons but there's nothing about in the faq. So 
again it just seems odd.

However you are of course free to do what you want with the lists and it 
seems it has been discussed extensively alrady.

Best, Markus

Re: [dm-crypt] Fwd: saout.de mailing list memberships reminder

[Karol Babioch]

[-- Attachment #1: Type: text/plain, Size: 672 bytes --]

Hi,

Am 20.12.2012 18:25, schrieb Markus Krainz:
> because they tend to use same passwords every time and you'd rather not
> send their passwords if in doubt they read instructions

There is probably a lot of truth here, only a minority (presumably most
subscribers to this list) is using an individual password for each
service. Are there any cases known, where this was a problem?

One could argue that you are screwed anyway when someone got access to
your mail account, but on the other hand there is always the possibility
of eavesdropping (MITM, and so forth) when sending sensitive information
like this unencrypted.

Best regards,
Karol Babioch


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 899 bytes --]