I hate when a site doesn't let me delete my account. Apparently, drupal.org hasn't been able to implement this feature in more than 11 years already:
Drupal.org compromised
41–50 of 86 posts
Re: Drupal.org compromised
#42Earlier quoted context omitted.
It took me about 4 minutes to receive the email - once I got it, the servers were quite responsive. Just give it a few minutes ... it'll get to you eventually
The servers are responsive because all the rest of us are locked out, still waiting on our reset email :-/ It's been 20 minutes since I submitted the reset, and I still don't have the email. Edit: got email after 40 min.
[deleted]
Re: Drupal.org compromised
#43I hate when a site doesn't let me delete my account. Apparently, drupal.org hasn't been able to implement this feature in more than 11 years already: https://drupal.org/node/8
> https://drupal.org/node/8
While it was a long running thing that the Drupal product couldn't let users delete or disable their own accounts, the issue you linked was resolved[1] in 2009 (more than 4 years ago) and made it into Drupal 7.
Unfortunately, Drupal.org is still running on Drupal 6 and its upgrade to Drupal 7 has been met with repeated setbacks and delays[2] with no ETA[3]. Definitely unfortunate.
Edit: looks like they're accepting requests for account deletion via password@association.drupal.org for the time being.[4]
[1]: https://drupal.org/node/8#comment-1188824
[2]: https://association.drupal.org/node/17738
[3]: https://association.drupal.org/comment/4263#comment-4263
[4]: https://drupal.org/news/130529SecurityUpdate#comment-7475090
Re: Drupal.org compromised
#44This is one of those cases where I completely forgot that I had an account, and now it has been compromised. I'm scratching my head wondering what information/password I had associated with it. Makes a case for actively destroying accounts on services that you're no longer planning on using.
Or not sharing passwords between services.
Or getting rid of passwords as a mechanism entirely.
Not that I have a solution, just whining :)
Re: Drupal.org compromised
#45Earlier quoted context omitted.
It took me about 4 minutes to receive the email - once I got it, the servers were quite responsive. Just give it a few minutes ... it'll get to you eventually
The servers are responsive because all the rest of us are locked out, still waiting on our reset email :-/ It's been 20 minutes since I submitted the reset, and I still don't have the email. Edit: got email after 40 min.
Our email systems are somewhat loaded from the email announcement so it might be a little slow. Things are slowly improving in speed however.
Re: Drupal.org compromised
#46I hate when a site doesn't let me delete my account. Apparently, drupal.org hasn't been able to implement this feature in more than 11 years already: https://drupal.org/node/8
One can't delete their account on Hacker News either. Just sayin'. :p
Re: Drupal.org compromised
#47I hate when a site doesn't let me delete my account. Apparently, drupal.org hasn't been able to implement this feature in more than 11 years already: https://drupal.org/node/8
One can't delete their account on Hacker News either. Just sayin'. :p
Interesting, I didn't know. Is there some good reason for it?
Re: Drupal.org compromised
#48Earlier quoted context omitted.
One can't delete their account on Hacker News either. Just sayin'. :p
Interesting, I didn't know. Is there some good reason for it?
From a programming standpoint it adds a lot of complication (e.g. all of a sudden you'd have posts owned by NULL, and even if you deleted the posts, what about replies to those posts, etc).
Re: Drupal.org compromised
#49Moderately miffed that the email they sent out notifying how THEY allowed my password to be compromised included a lecture telling ME how to construct a strong password. Not the time, or place. Besides, they claim it was salted, so it shouldn't really matter at this point whether my password was "Password123" or "@DJDF*$@!(DGEWGIRGHdfhEWROighMMMM...PIZZA".
I'm not convinced by their salted claim, I thought Drupal 6 (what drupal.org is on) only did MD5() for passwords? Drupal 7 has the more securely hashed passwords.
Drupal.org runs D6 with the phpass module, basically the stuff that went into Drupal 7.
Re: Drupal.org compromised
#50I don't know if they've invalidated my password, or if the attacker has already accessed my account, but I can't login with my details. I can't help but think that they would be better off just doing an UPDATE users SET password=''; , and relying on the forgot-password functionality to let users get access again edit I received my forgot-password email after 4-5 minutes waiting (their servers are under quite a bit of…
Your password was scrambled, which is why you cannot login.
> UPDATE users SET password='';
That would be an extremely bad idea. Never set pass to empty on Drupal 6 sites.