<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#CCCCCC">
<br>
<br>
<div class="moz-cite-prefix">On 6/9/19 2:32 PM, Rick Moen wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20190609213232.GT1802@linuxmafia.com">
<pre class="moz-quote-pre" wrap="">Quoting Ehud Kaldor (<a class="moz-txt-link-abbreviated" href="mailto:ehud.kaldor@gmail.com">ehud.kaldor@gmail.com</a>):
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">So, what you're saying, Rick, is let's ignore the fact that it is a bad
idea to have clear-text passwords (to which every security person agrees)
because, for this specific is case, no one (yet? No one you ever had this
discussion with?)
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
That of course is not what I said.
I don't honestly thing that what I said was all that difficult to
understand, but I think we've been seeing a persistent unwillingness to
_think_, and instead just repeat platitudes over and over, while utterly
ignoring the point about no credible threat model existing in the matter
under discussion, as can be seen if one bothers to look at details.
Since I'm not a GNU Mailman developer, I feel absolutely no obligation
to argue to justify their architecture. If you feel a desire to have
that argument, you know where to find them.</pre>
</blockquote>
<br>
Of course I know nothing about the operation of Mailman and I
used<br>
a throw-away password when I was asked to do so.<br>
<blockquote type="cite"
cite="mid:20190609213232.GT1802@linuxmafia.com">
<pre class="moz-quote-pre" wrap="">
To your point earlier - I'm sure those dworves at Moria had that
discussion, and someone said "I cannot remember a single time, and I cannot
rationalize in any way, that a Balrog will come at us if we dig here". If
that what you are saying now?
</pre>
<pre class="moz-quote-pre" wrap="">
I'm saying that further reinforcing the dwarf Narvi's door facing
towards Eregion and removing Celebrimbor's inscription 'Say "friend",
and enter' from the outer face of said door would obviously have been
pure pointless security theatre, as proven if nothing else by the fact
that the balrog didn't enter from there, but rather up from the roots of
the Misty Mountains. <a class="moz-txt-link-freetext" href="http://tolkiengateway.net/wiki/Doors_of_Durin">http://tolkiengateway.net/wiki/Doors_of_Durin</a></pre>
</blockquote>
<br>
The Balrog had been hiding at the root of the mountain since
he<br>
hid from the Gods at Morgoth's final overthrow and expulsion from
the<br>
Universe. Now the Dwarfs had probably never seen a Balrog when<br>
they decided to delve to the roots of the mountain, and the Dwarfs
with<br>
the Quest likely had no idea why the mountain had been abandoned to<br>
the Orcs. Some people of course think that the stuff published
after<br>
the LOTR trilogy is unreadable but I really enjoyed those older
stories.<br>
<blockquote type="cite"
cite="mid:20190609213232.GT1802@linuxmafia.com">
<pre class="moz-quote-pre" wrap="">
That would qualify as clueless security theatre rather like tut-tutting
on mailing lists over how terrible it is for GNU Mailman to default to
storing a toothless 'password' token in plaintext and periodically
re-mailing it to users, and ignoring people who point out that it cannot be
credibly used for harm, even in the unlikely event of being intercepted.
I didn't think I would need to cluebat you with the parallel, but, there,
you required the cluebatting, I've typed it out for you. Don't say I
never did you a favour.
Now, seriously, if you have an argument with the GNU Mailman developers,
go bother them and stop trying to argue with me.
</pre>
</blockquote>
<br>
Bobbie Sellers<br>
</body>
</html>