Re: security of gen_cookie? (1.94a4)

[Joe Pruett <joey @ teleport . com>]

i wrote the initial code, so i guess i should speak up.

$cookie_seed is supposed to be set in majordomo.cf.  it is taking the place
of $admin_passwd in your example.  yes, it is site wide.  yes, if someone
wants to really mess with you, they could try to find it and then generate
all the confirm messages to go with faked subscribe messages.  the code
was mainly a proof of concept, and has stopped all subscribe spammers at
our site for months now.