On 28/05/2025 12:11, Jonathan Dowland wrote:
On Tue May 27, 2025 at 7:30 PM BST, Ahmad Khalifa wrote:0. keep all the e-mail features it currently offersIMHO, this is a security flaw, not a feature. I hear that everyone loves it, so at least the emails should be authenticated somehow (@debian only maybe? one-time register-confirm emails?).Can you expand on why you think manipulating bugs by mail is a security flaw?
Anyone can manipulate any bug without restriction and in bulk.Untag it as RC, email 0-99999 with the -done suffix, spam it with links, target packages that echo to a mailing list. Sure there would be a log of it all, but initially, the only defense would be to shutdown incoming emails.
Maybe I'm exaggerating a bit, but nowadays I can't login to anything without two factor authentication, because a password isn't enough apparently.
-- Regards, Ahmad