LSTOWN-L Archives

LISTSERV List Owners' Forum

LSTOWN-L

Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Topic: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Norm Aleks <[log in to unmask]>
Tue, 21 Feb 1995 20:13:55 -0500
text/plain (63 lines)
[John Buckman]
> >... I fail to understand why you would need to "take over" a user's ID
>
> A very good point, and one mostly of ease on my  end.  I wouldn't have to
> add the smarts for the administrator language commands.
 
Ah, now I understand.  You  are planning on  sending mail "From: " the user
in question, i.e.   if  a listowner using  it  wanted to  subscribe someone
InfoMagnet would send out  mail that was  designed to look  as if that user
had  sent the  request on   his or  her  own.   Not  only is that  solution
inelegant (I am amazed you even proposed it, and on a public list!), but it
won't work.   You said  somewhere else  in  your message something   to the
effect  of "this isn't so  bad, people with  Eudora already  can  do it and
look, we  don't hear about  any  abuses."  Well,  there *are* problems with
people forging requests from other  people, and that's why LISTSERV already
has first-line protection against such forgeries: the "validate" mechanism,
whereby  it sends a  confirmation  message through  normal channels to  the
person  who is  supposed  to have   initiated the  request, waiting for  an
affirmative reply  before executing  the  command and thereby  guaranteeing
both that a  path exists to the  address,  and that the  person actually at
that address has seen and approved the  command in question.  Not all lists
use this feature, but your hack won't work with any that do.
 
You know, you really  don't have to implement  that many new commands to do
this right.  Especially if you're  thinking of adding  support for PUT, and
list review functions, and so on, you can add ADD and DEL,  and a few other
common list owner commands.  Not a big deal.  And as a  bonus, if you don't
try to   fool the security  system you   won't need to   put any artificial
controls on which serial number can deal with which lists, etc.  Or are you
thinking of licensing by the number of lists managed?
 
> >-- Editing  and PUTting the  list  header specifically.  A GUI  might be
> >developed   to  enable changing  most  header  keywords by  toggling, or
> >cutting/pasting addresses for Owner=, Editor=, Filter=, Notify=.
>
> Seems   to me that this   should  be a  feature  of LISTSERV,  and not of
> InfoMagnet.
 
Hmm, well, if your program doesn't do this  then it's missing its *biggest*
opportunity to help a   listowner.  ADD, DEL,  and  SET aren't the  problem
commands, it's changing the list header that new listowners are intimidated
by.   It sounds  as if you   think the list  header  is something only  the
postmaster (who has access  to the server hardware  itself) would deal with
...    it's not.  The list  header  is what list  owners  use to manage all
aspects of their list's behavior, and it's a  normal text file, retrievable
and puttable as any other LISTSERV file would  be.  Your program could be a
big help if it  included support for that, with  checkboxes and whatnot  as
the original poster said.
 
Actually I can think of a few more things InfoMagnet should  do if it wants
to be  a serious  help to the  list owner:  welcome, farewell, and  MAILTPL
files   (and these   could   all be  integrated  in   a nice way),  archive
maintenance (though this  varies by LISTSERV  platform and will change when
L-Soft releases the  new archive server code), ...   well, that's all I can
think of right now.  But read a few months' worth of archives of this list,
and you'll get a better feel for a) how  LISTSERV handles these issues now,
and b) some of the problems listowners currently have,  which you could set
your sights on fixing through nifty software.
 
Norm
--
"Tired of cleaning yourself? Let me do it."

ATOM RSS1 RSS2