Re: Help?

Roger Hayter (roger-3A7p0BNfWfcdnm+yROfE0A@xxxxxxxxxxxxxxxx) wrote:

> The only method offered for subscribing to the mailing lists is via a 
> web form on port 8080:  but I presume the lists accept standard mailman 
> commands to subscribe via email.  Can anyone confirm this?

It would be really, extremely, awfully, terribly, tremendously nice
if any such commands would be DOCUMENTED SOMEWHERE!

"Click here to subscribe to this mailing list" is one of the most
atrocious things ever put on the World Wide Web (not counting
Javascript).  And as bad as that is, what's an order of magnitude
*worse* is that there's no alternative given.  (And what the hell
is the point of having a *password* on it?)

So, let's see if we can GUESS how this thing works.

griffon:~$ /var/qmail/bin/maildirmake Testdir
griffon:~$ echo ./Testdir/ > .qmail-test
griffon:~$ echo -e 'From: 
greg-test-kVFnVQ56lIlg9hUCZPvPmw@xxxxxxxxxxxxxxxx\nSubject: help\nTo: 
support-request-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@xxxxxxxxxxxxxxxx\n\nhelp' | 
/usr/sbin/sendmail -t -f greg-test@xxxxxxxxxxxx

(wait)

OK, that generated an acceptable automatic response.

griffon:~$ echo -e 'From: 
greg-test-kVFnVQ56lIlg9hUCZPvPmw@xxxxxxxxxxxxxxxx\nSubject: subscribe\nTo: 
support-request-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@xxxxxxxxxxxxxxxx\n\nsubscribe' 
| /usr/sbin/sendmail -t -f greg-test-kVFnVQ56lIlg9hUCZPvPmw@xxxxxxxxxxxxxxxx

(wait)

Yes, this seems to be working correctly so far.  I got a message
asking for confirmation.  Set the magic qmail environment variables
and then reply to it in mutt, then

(wait)

Subject: Welcome to the "Support" mailing list
From: support-request-HsMa1EcHlTmaN9rM9vLTPmm0pvjS0E/A@xxxxxxxxxxxxxxxx
To: greg-test-kVFnVQ56lIlg9hUCZPvPmw@xxxxxxxxxxxxxxxx

Now let's see if I can unsubscribe the same way (without using the
randomly generated password that it sent me).  Send an unsubscribe
message to the -request address, and

(wait)

Nope.  It wants the password!  What the FUCK?  Why would a list
administrator want to make it *harder* for people to unsubscribe?
Do they *enjoy* getting newbies spamming the list itself with
"Please unsubscribe me!" requests?

So let's send another one, but this time with the stupid password --
the insecure one that's sent to me in *clear text* -- on the
unsubscribe command, and

(wait)

And now it says that I'm unsubscribed.  Why doesn't it ask me for
a confirmation on that, the way it did on the subscription?  Is it
because I used the password that was sent in clear text over an
insecure channel?  What wretched stupidity that is!

So, what can I do to fix this?  Let's update our CVS checkout of the
website and see if this ":8080/mailman/listinfo/support/" page is
in it.  Hmm.  No, as far as I can see, it's not.  It's probably
part of the mailing list manager itself.  Why the mailing list manager
would choose NOT to advertise its own features is beyond me.  So
that leaves "index.php?page=lists" which is clearly a Freenet page.
I guess the content of that page is taken from the file
"website/pages/lists.php".  (There's also a "mailinglists.php" in the
same directory, but I'm guessing it doesn't use that one.)

So, even though that's clearly *not* the best place to put the
instructions for subscription, it's as close as I can possibly get
them.  That leaves the format.  I could write up something horribly
verbose like "Send a message to
<a 
href="mailto:support-request-RdDMkVZAZeuJnvDnx1genB2eb7JE58TQ@xxxxxxxxxxxxxxxx";>support@xxxxxxxxxxxxxxxxxx</a>
with the word <tt>subscribe</tt> (and only that word) in the body
of the message."  But it strikes me that, if someone needs *that*
level of hand-holding, they'll just use the web interface anyway.

So here's my patch.

-- 
Greg Wooledge                  |   "Truth belongs to everybody."
greg-kVFnVQ56lIlg9hUCZPvPmw@xxxxxxxxxxxxxxxx              |    - The Red Hot 
Chili Peppers
http://wooledge.org/~greg/     |

pgpc1AfJjylCF.pgp
Description: PGP signature