Comment 7 for bug 890411

So Dolph, if I understand correctly, this was by design but could definitely evolve in the future towards service-specific rights ? That means it will probably be improved in Essex but should not be fixed in stable/diablo ?

If that interpretation is correct, I tend to not consider this a security hole but rather an architectural limitation that should be lifted in future releases... and would advocate for this bug being made public (but not before the original reporter is ok with it).

@Jason: let me know if you agree with Dolph's position, and when you're comfortable opening this up (which can be after HP evolves its implementation).