HN user
If by task status you mean complete/uncomplete, yes - just click the checkbox next to the task or the edit button. If you mean custom statuses like "in progress", it's possible, but there hasn't been enough demand for it for us to add that functionality.
Yes, double dash '--' is the signature character which is different enough from '-' to detect. But even if you use '-' as the signature separator, we have a pretty good signature detection algorithm that would remove it.
We debated over this, we want to group multiple together (waiting a bit before sending the update to see if any others come in), but people love the "instant feedback" of the update coming right away.
What we plan to do is have the first update come instantly, but then any subsequent ones would get grouped together. That way you still get the instant feedback 90% of the time but at the same time you don't get flooded if someone decides to do a lot of changes in a short time.
We check email headers and have a few other factors to determine if the sender is genuine or spoofed. You would be able to create a new task list with a spoofed address, but you can't spoof your address to add to someone else's list.
Does anyone know of a website or central resource that documents all these vulnerabilities to look out for?