[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Debian is secure, the debian lists are not



Santiago Vila wrote:
> On Fri, 7 Aug 1998, Hanno Wagner wrote:
> 
> > The reason why we, the listmasters, are not going to enable the cookie
> > mechanism for unsubscribing is that at the moment there are already
> > too many people who a) don't manage to get unsubscribed and b) don't
> > manage to get subscribed *without* manual help of either
> > Joey or myself.
> 
> There is a very interesting word here: "at the moment". I would like to
> know which efforts, if any, are currently being made to avoid this to
> happen, specially a). For example, what about an "unsubscription FAQ" 

Please go ahead and write it.

But I wonder what this should help since beneath _every_ mail you
find a notice about unsubscribing from that very list.

> posted weekly? One of the most common problems with unsubscriptions is
> that people have a different address in the From: header than in the
> Sender: header. Is people aware of this? Would not be a really good thing
> for you to educate users a little bit, or just you don't want to do that?

Please go ahead and educate them.  I can give you the list of all
~8000 subcriber.

> On the other side: Is this problem really general to all lists? Is
> debian-devel as populated by dummies as debian-user is? Which would be the
> problem in enabling unsubscription cookies in some selected "important"
> lists for the project, like debian-devel, debian-policy, etc?

It's a general problem.  However I believe that there are more
problems with user lists than with development lists but the problems
exist for all of them.

> a matter of time. How many additional persons would be required to do the
> listmaster work if cookies are enabled for unsubscriptions also? Maybe
> there are people here who would volunteer. Saying both "it is more work"
> and "we will not accept any help" does not look very fair, IMHO.

We haven't said we won't accept any help.  We've said that managing
two single lists by different people doesn't help.

Go ahead and bother us, soon Debian will also need new listmasters.
There's not much missing.  I'm sorry.

> > Yes, using cookie unsubscription you can ensure that nobody than you
> > can unsubscribe you from the lists.  But you also ensure that many
> > people can't unsubscribe at all - and increase the load for the
> > listmasters.
> > 
> > Maintaining 2 lists and leaving the listmasters with n - 3 doesn't
> > make sense.
> 
> Well, should I offer to maintain n / 3 lists, then?

You should better offer to maintain n-1 lists or form a new team to
maintain all but one lists.

> > All lists should be maintained by a unique team.
> 
> Could you please elaborate on that? Is there a technical reason why
> the lists may not be maintained by several persons?

Bounces, misdirected un/subscription, misdirected cookies, unprocessed
cookies, unprocessed un/subscription, questions, misdirected postings
go to listmaster@lists.debian.org.  Sure, we can get different
listmaster addresses for each list, but I don't want to maintain
that.  I'll make the situation worse in my eyes.

> BTW: Are you going to apply the work-around I emailed to the bug address
> three days ago to make this to be less grave, or it will be ignored
> completely, as the rest of the mail was?

Are you referring to the removal of the body before piping into
unsubscribe?  This is implemented.

Regards,

	Joey

-- 
There are lies, statistics and benchmarks.

Attachment: pgppBEJSyGPQm.pgp
Description: PGP signature


Reply to: