>BH> It is true that it will not prevent anyone from seeing specific
>BH> addresses. However, you would have to iterate over every single
>BH> alphanumeric string permutation to be able to identify all subscribers
>BH> of a list. Assuming that was a computationally reasonable thing to do
>BH> in the first place, the same could be done with mail to Majordomo as
>BH> well.
>
>I agree with all but your last assertion. Since it's possible to restrict
>which to an exact match (well, subject to aliasing and transformation) of
>the reply address (should we decide to do this), this completely prevents
>hacking since the hacker will never see the reply. The web interface has
>no such restriction, since it can't verify the address and presents its
>results immediately. The shell interface has the same problem.
It's worth remembering that the web interface can refer to a user
registration system that might have (for example) validated the requesters
email address at some recent point in time etc
Manar
References:
|
|
