Earlier quoted context omitted.
OP here. I waited several hours between contacting MC and posting the blog entry. This was (and still is) a time-sensitive mission-critical issue. I have customers I cannot contact about a potential security flaw in my product. Happily, I need to contact them to tell them that my product is NOT affected, but it could easily have been otherwise, and in the future it might be otherwise. This is an existential threat to…
it almost sounds like they don't want your customers to know your product is not affected. hypothetically speaking, could one of your clients make a possibly bad hasty security move by being under the immpression your product is vulnerable?
I would give you very long odds that no one at MC had a clue who I was before this story showed up on the front page of HN. My mailing list is very small (it's a very niche product) and I hardly use the MC account (which was the problem to begin with). I'm sure I just got caught in their process. I'm equally sure that their process was designed to thwart abuse, which is surely a major problem for them. (In fact, it surely the major problem for them!) But it just seems to me that they just didn't think it through. This whole unfortunate situation could have been avoided with a single automated email drawing my attention to the fact that my account was about to be closed for inactivity.