To use the web interface, you need a LISTSERV password (which you
can save in a cookie so you don't have to retype it all the time). To obtain
a password, you need confirmation, otherwise there is no security. I can
say I am Goran Larsson, get "your" password and do things in your name,
and the only one who doesn't know your password is you :-) The password
is valid for all lists on the server, ie you only need to get it once. You can also
generate passwords in advance for your members, if you know their e-mail
address. Alternatively, you can use so-called "anonymous" subscription
which requires no password but confirms each command individually. This
is only simpler if the average subscriber will only sign up to one list.

Alternatively you can do like on Moderaterna's web site and allow anyone to
sign on and off. The drawback of course is that you cannot do anything if
a colleague decides to sign you up to Carl Bildt's veckobrev because he
thinks you secretly admire him :-) He can write a little program to sign you
up every hour for your ultimate enjoyment. Likewise, if he knows the name
of someone on LO's list, he can make sure that this person is signed off
every 5 minutes and will never get the mail no matter how hard he tries to
subscribe. This person could be a VIP whose opinion of the Internet is
important to get a higher IT budget next year. This method is normally
used only for public announcement lists, rather than internal lists. In most
organisations it is possible to make people obtain a password once and
save it in a cookie for better security.

The script used at Moderaterna's is for Windows NT, but you can make
your own easily using the lcmdx.c. You just make a 2-line program that
does something like 'lcmdx hostname owner@xxx owner-password ADD
listname $emailaddr $name'.

  Eric