Subj : User-Deactivate account: Still able to log in via SSH
To   : Brian Davidson
From : Nick Boel
Date : Sat Sep 12 2026 09:26:08

Hey Brian!

On Sat, Sep 12 2026 01:28:10 -0700, Brian Davidson wrote to GitLab note in main/sbbs:

 BD> https://gitlab.synchro.net/main/sbbs/-/issues/1239#note_10343

 BD> I get not alarming the community when there is a rare exploit that only
 BD> affects 1 or 2 systems, Rob. But that’s not the case here. Disabling thhe
 BD> user account is the front-line defense used by not just Synchronet, but
 BD> most other apps that provide user-level access control. Regardless, the
 BD> feature is there, and so is the vulnerability. Fixing the issue is the
 BD> correct course of action. Closing this issue feels more like a denial of
 BD> its existence and an abandonment of the author when Sysops need him the
 BD> most, whether they realize it or not. I’m not trying to be difficult, but
 BD> if this was any other software program, I believe this issue would have
 BD> been handled differently. Support your community and they will return
 BD> that support.

You do realize the issue was fixed before the issue was closed, right?

Regards,
Nick

.... Take my advice, I don't use it anyway.
--- AmberEdit/linux 0.8.2
 # Origin: thePharcyde_ telnet://bbs.pharcyde.org (Wisconsin) (723:1/1)
 ￭ Synchronet ￭ _thePharcyde telnet://bbs.pharcyde.org (Wisconsin)
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

.