Jason wrote:
> think any solution needs to be simple.
[..]
> * 'which' isn't really the only way to see which lists you're subscribed
> to; the lists command works, too (but it doesn't show you exactly what
> address you're subscribed as).
If the lists command would show you exactly what address you're subscribed as,
that'll allow a satisfactorily simple solution for the 'which' command.
> * The security risks come from people being able to do 'which a' and
> systematically pull out large chunks of your list.
This is the most frequent kind of attack. However, it should be possible to
use some mailing lists as support groups where it is not right for Majordomo
to answer queries of the kind 'is address user@example.com subscribed to the
list getfreefromaddiction ?'
Will a lists command over the web interface reveal this information to me
when I claim falsely that my e-mail address is user@example.com? If so, we
may have a simple solution for the which command (by setting M=0 for the
getfreefromaddiction list), but then the lists command needs to be fixed.
- Norbert.
Follow-Ups:
References:
|
|
