From: Walton Hoops <walton@...>
Date: 2010-04-16T01:50:35+09:00
Subject: Re: Who maintains ruby-talk?

On 4/15/2010 12:00 AM, Tony Arcieri wrote:
> On Wed, Apr 14, 2010 at 11:54 PM, Tony Arcieri <tony.arcieri@medioh.com>wrote:
>
>   
>> And, oh by the way, as I referenced in the OP, the MLM is subject to some
>> pretty ridiculous security vulnerabilities.  Anyone can unsubscribe anyone
>> from ruby-talk, so long as the read it via e-mail.  That's silly.
>>
>>     
> And as I realize code speaks louder than words, here you go.  Here's some
> Ruby code to unsubscribe someone from ruby-talk without their permission.
>  This particular snippet is set up to unsubscribe thunk from ruby-talk.
>  Feel free to modify it to unsubscribe whoever you like:
>
> http://gist.github.com/365142
>
> I send you this only to point out that ruby-talk is very much insecure,
> especially for anyone who reads it via email.
>
>   
Actually, all that will do is cause the user to get a confirmation
e-mail asking if they really want to unsubscribe.  I suppose it could
lead to some annoying spam, but I hardly think it's a critical security bug.