Subj : Re: User-Deactivate account: Still able to log in via SSH
To   : Nick Boel
From : Dan Clough
Date : Sat Sep 12 2026 10:13:35

-=> Nick Boel wrote to Brian Davidson <=-

 NB> On Sat, Sep 12 2026 01:28:10 -0700, Brian Davidson wrote to GitLab note
 NB> in main/sbbs:

 BD> https://gitlab.synchro.net/main/sbbs/-/issues/1239#note_10343

 BD> I get not alarming the community when there is a rare exploit that only
 BD> affects 1 or 2 systems, Rob. But thatª€™s not the case here. Disabling
thhe

 BD> user account is the front-line defense used by not just Synchronet, but
 BD> most other apps that provide user-level access control. Regardless, the
 BD> feature is there, and so is the vulnerability. Fixing the issue is the
 BD> correct course of action. Closing this issue feels more like a denial of
 BD> its existence and an abandonment of the author when Sysops need him the
 BD> most, whether they realize it or not. Iª€™m not trying to be difficult,
but

 BD> if this was any other software program, I believe this issue would have
 BD> been handled differently. Support your community and they will return
 BD> that support.

 NB> You do realize the issue was fixed before the issue was closed, right?

Haha!  Pretty sure he doesn't...  ;-)

Must be new if he thinks Rob needs some training on supporting his 
community...  Sheesh.



.... So easy, a child could do it. Child sold separately.
=== MultiMail/Linux v0.52
--- SBBSecho 3.37-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (1:135/115)

.