Re: it's mailman time again

["John Levine" <johnl () iecc com>]

It appears that Aaron de Bruyn via NANOG <aaron () heyaaron com> said:
> -=-=-=-=-=-
>
> I donno Rich...a couple of decades ago I lost my Slashdot account because someone was able to access it.
> I used the password in two places...Slashdot and all the blasted mailman instances I was signed up with.

I can believe that your Slashdot account got hacked, but why do you
think that's because someone read a monthly mailing list reminder,
figured out how to connect that list to your Slashdot account, and
broke in? That's quite a stretch.

More likely some Slashdot subcontractor sold it*, or you logged in
from a device that was compromised somehow. Or maybe it was just brute
forced.

R's,
John

* - I use tagged email on all my subscriptions and it's amazing how
passwords leak from places like the Wall Street Journal and the
Economist who really should know better. On the other hand, the NY
Times and WaPo don't leak, so pick your subcontractors carefully.