Even without the who command, a user could see the list of
subscribers by connecting directly to the mail server and doing
an expn command for the name of the list. Perhaps this could
be prevented by having a relay mail server forward the mail from
an externally visable machine to the machine with majordomo
running. But that would complicate things quite a bit. You
have to remember that Brent Chapman states over and over in the
documentation that majordomo was not built with great security
in mind.
Peter Strong.
----------------------------------------------------------------------------
>Date: Thu, 11 Jul 1996 13:39:28 -0400 (EDT)
>From: "Homer W. Smith" <homer@lightlink.com>
>
> We simply changed the who command to something else and
>only the list owners know it.
>
> 1.94 I believe will handle it properly.
>
>------------------------------------------------------------------------------
>
>On Thu, 11 Jul 1996, Michael Lambright wrote:
>
>> I work for an Internet Service Provider. We've set up majordomo
>> mailing lists (v1.9.2) for several of our users (mostly businesses), and
>> have been requested by two different list owners that we disable the
>> "who" command for their lists.
>>
>> It seems that the list owners are worried about their competion requesting
>> a list of email addresses of people subscribed to their lists.
>> This is understandable, given that the subscribers are all
>> (theoretically) people interested in their products/services.
>> Such a list would be fairly valuable to a company with a
>> competing product/service.
>>
>> >From what I can see, majordomo allows you to configure a list so that
>> only someone subscribed to that list can do a "who", but it doesn't
>> allow you to totally disable the "who" command for a list.
>>
>> We're considering just writing some code to handle the problem,
>> but before doing that, I just wanted to see if anyone else
>> had come up against this problem and/or found a solution for it.
>> (Or if there is a way to do this, and I just missed it when I
>> read the documentation/FAQ/etc.)
>>
>> Any information would be greatly appreciated.
>>
>> Thanks,
>> _________________________________________________________________________
>> Michael Lambright e u r o p a c o m m u n i c a t i o n s
>> MIS/Technical Support
>> michael@europa.com 503.222.9508 MAIN
>> www.europa.com 503.796.9134 FACSIMILE
>>
>
Follow-Ups:
|
|
