The man signs up and finds a bug. give that man a golden star.

Hmm. Conventional security wisdom says that you should not provide hackers with an easy way of figuring out whether or not a particular username is valid. Like, most systems that request a username and password will give the same error message for invalid usernames and invalid passwords, for security reasons. Along the same lines, I wrote the password generator system to say that the e-mail was sent even for invalid usernames...

But, actually, since then I've decided that that rule is more trouble than it's worth. It's really just security by obscurity, and it's not hard to figure out what user names you want to crack by looking at any of the hosted sites.

In short: It's a feature, not a bug... but you're right that it shouldn't work that way.

It's not a new feature. I wrote it that way in the first place. There's nothing to update. evlan.org has no security section. This feature/bug actually makes the system more secure, not less.

I understand what you mean about the security of it. My problem was that I used Cow on the old posse site and forgot I switched it, so I requested the password for Cow and then checked all my email accounts and didn't see anything. So then I went to scouring the site looking for an admin email/message option. Thats when I noticed that I registered a different name for this one. I was just worried that I had mistyped my email addy or something.

Can anonymous users leave messages on here?