Re: Debian is secure, the debian lists are not.

[Philip Hands <phil@hands.com>]

> Santiago Vila <sanvila@unex.es> writes:
> 
> > Yes, I'm current smartlist maintainer, and smartlist was not originally
> > designed to be secure. But with the cookie patches, which are already
> 
> I say that if you want cookie patches, then you should be the one that 
> has to handle all of the requests from the users that cannot figure
> out how to do routine things.  You should have to go through the logs
> finding people that have tried to subscribe, but can't, and are afraid 
> to ask or don't know whom to ask for help, etc.  You apparantly aren't 
> aware of just how much work this will cause for the listmasters.
> 
> I would assume that if you were willing to spend several hours a day
> dealing with the trouble cookies cause, then they would have no
> problem implementing it :-)

While I'm certainly not expecting our list maintainers to do anything that 
inflicts more work on themselves, a thought just occurred to me that might 
make all sides happy:

  How about allowing people to set a flag against their subscription, that 
  they want their unsubscription requests to be handled using cookies, on a 
  subscription-by-subscription basis ?

Is this possible ?  That way the people that worry about such things could 
flag their subscription ``cookie mode'' without insisting on cookies for 
newbies that have enough trouble unsubscribing as it is.

Cheers, Phil.