[Mailman-Developers] list membership privacy

[britt]

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to mime@docserver.cac.washington.edu for more info.

--0-346115632-957288197=:6986
Content-Type: TEXT/PLAIN; charset=US-ASCII

I've got a couple of patches to Mailman 2.0b2 that reduces the number of
ways that someone can prob the membership of a list.  It removes all
errors from the options and subscribe pages that mention foo@bar is/is not
on this list, and instead always say "bad password".

You can still probe by trying to subscribe a person.  Fixing this is more
work, so I haven't done it yet...

In short it improves member privacy to a level better than majordomo.

B

-----------------------------------------------------------------------
Britt Bolen               britt@bolen.com               britt.bolen.com 

--0-346115632-957288197=:6986
Content-Type: TEXT/PLAIN; charset=US-ASCII; name="privacy.patch"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.OSF.4.10.10005021323170.6986@hcs.harvard.edu>
Content-Description: 
Content-Disposition: attachment; filename="privacy.patch"

ZGlmZiAtYyBtYWlsbWFuLTIuMGJldGEyL01haWxtYW4vQ2dpL2hhbmRsZV9v
cHRzLnB5IG1haWxtYW4tMi4wYmV0YTItbG9jYWxjaGFuZ2VzL01haWxtYW4v
Q2dpL2hhbmRsZV9vcHRzLnB5DQoqKiogbWFpbG1hbi0yLjBiZXRhMi9NYWls
bWFuL0NnaS9oYW5kbGVfb3B0cy5weQlUdWUgQXByICA0IDE5OjQyOjE4IDIw
MDANCi0tLSBtYWlsbWFuLTIuMGJldGEyLWxvY2FsY2hhbmdlcy9NYWlsbWFu
L0NnaS9oYW5kbGVfb3B0cy5weQlUdWUgTWF5ICAyIDEzOjA2OjA1IDIwMDAN
CioqKioqKioqKioqKioqKg0KKioqIDkwLDk2ICoqKioNCiAgDQogICAgICBp
ZiBub3QgVXRpbHMuRmluZE1hdGNoaW5nQWRkcmVzc2VzKHVzZXIsIG1saXN0
Lm1lbWJlcnMsDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIG1saXN0LmRpZ2VzdF9tZW1iZXJzKToNCiEgICAgICAgICBQcmlu
dFJlc3VsdHMobWxpc3QsIG9wZXJhdGlvbiwgZG9jLCAiJXMgbm90IGEgbWVt
YmVyITxwPiIgJSB1c2VyKQ0KICANCiAgICAgIGlmIGZvcm0uaGFzX2tleSgi
dW5zdWIiKToNCiAgICAgICAgICBvcGVyYXRpb24gPSAiVW5zdWJzY3JpYmUi
DQotLS0gOTAsOTYgLS0tLQ0KICANCiAgICAgIGlmIG5vdCBVdGlscy5GaW5k
TWF0Y2hpbmdBZGRyZXNzZXModXNlciwgbWxpc3QubWVtYmVycywNCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbWxpc3QuZGln
ZXN0X21lbWJlcnMpOg0KISAgICAgICAgIFByaW50UmVzdWx0cyhtbGlzdCwg
b3BlcmF0aW9uLCBkb2MsICJUaGF0IHBhc3N3b3JkIHdhcyBpbmNvcnJlY3Qu
PHA+IikNCiAgDQogICAgICBpZiBmb3JtLmhhc19rZXkoInVuc3ViIik6DQog
ICAgICAgICAgb3BlcmF0aW9uID0gIlVuc3Vic2NyaWJlIg0KZGlmZiAtYyBt
YWlsbWFuLTIuMGJldGEyL01haWxtYW4vQ2dpL29wdGlvbnMucHkgbWFpbG1h
bi0yLjBiZXRhMi1sb2NhbGNoYW5nZXMvTWFpbG1hbi9DZ2kvb3B0aW9ucy5w
eQ0KKioqIG1haWxtYW4tMi4wYmV0YTIvTWFpbG1hbi9DZ2kvb3B0aW9ucy5w
eQlUdWUgQXByICA0IDE5OjEyOjUwIDIwMDANCi0tLSBtYWlsbWFuLTIuMGJl
dGEyLWxvY2FsY2hhbmdlcy9NYWlsbWFuL0NnaS9vcHRpb25zLnB5CVR1ZSBN
YXkgIDIgMTM6MDU6MjMgMjAwMA0KKioqKioqKioqKioqKioqDQoqKiogNjYs
OTIgKioqKg0KICAgICAgICAgIHJldHVybg0KICANCiAgICAgICMgU2FuaXR5
IGNoZWNrIHRoZSB1c2VyDQogICAgICB1c2VyID0gVXRpbHMuTENEb21haW4o
dXNlcikNCiAgICAgIGlmIG5vdCBtbGlzdC5tZW1iZXJzLmhhc19rZXkodXNl
cikgYW5kIFwNCiAgICAgICAgICAgICAgbm90IG1saXN0LmRpZ2VzdF9tZW1i
ZXJzLmhhc19rZXkodXNlcik6DQohICAgICAgICAgIyB0aGVuDQohICAgICAg
ICAgZG9jLkFkZEl0ZW0oSGVhZGVyKDIsICJFcnJvciIpKQ0KISAgICAgICAg
IGRvYy5BZGRJdGVtKEJvbGQoIiVzOiBObyBzdWNoIG1lbWJlciAlcy4iICUg
KGxpc3RuYW1lLCBgdXNlcmApKSkNCiEgICAgICAgICBkb2MuQWRkSXRlbSht
bGlzdC5HZXRNYWlsbWFuRm9vdGVyKCkpDQohICAgICAgICAgcHJpbnQgZG9j
LkZvcm1hdCgpDQohICAgICAgICAgcmV0dXJuDQogIA0KICAgICAgIyBmaW5k
IHRoZSBjYXNlIHByZXNlcnZlZCBlbWFpbCBhZGRyZXNzICh0aGUgb25lIHRo
ZSB1c2VyIHN1YnNjcmliZWQgd2l0aCkNCiEgICAgIGxjdXNlciA9IG1saXN0
LkZpbmRVc2VyKHVzZXIpDQohICAgICBjcHVzZXIgPSBtbGlzdC5HZXRVc2Vy
U3Vic2NyaWJlZEFkZHJlc3MobGN1c2VyKQ0KISAgICAgaWYgbGN1c2VyID09
IGNwdXNlcjoNCiEgICAgICAgICBjcHVzZXIgPSBOb25lDQohICAgICBpZiBt
bGlzdC5vYnNjdXJlX2FkZHJlc3NlczoNCiEgICAgICAgICBwcmVzZW50YWJs
ZV91c2VyID0gVXRpbHMuT2JzY3VyZUVtYWlsKHVzZXIsIGZvcl90ZXh0PTEp
DQohICAgICAgICAgaWYgY3B1c2VyIGlzIG5vdCBOb25lOg0KISAgICAgICAg
ICAgICBjcHVzZXIgPSBVdGlscy5PYnNjdXJlRW1haWwoY3B1c2VyLCBmb3Jf
dGV4dD0xKQ0KICAgICAgZWxzZToNCiEgICAgICAgICBwcmVzZW50YWJsZV91
c2VyID0gdXNlcg0KICANCiAgICAgICMgRG8gcmVwbGFjZW1lbnRzDQogICAg
ICByZXBsYWNlbWVudHMgPSBtbGlzdC5HZXRTdGFuZGFyZFJlcGxhY2VtZW50
cygpDQotLS0gNjYsOTYgLS0tLQ0KICAgICAgICAgIHJldHVybg0KICANCiAg
ICAgICMgU2FuaXR5IGNoZWNrIHRoZSB1c2VyDQorICAgICB1bmtub3duVXNl
ciA9IDAgDQogICAgICB1c2VyID0gVXRpbHMuTENEb21haW4odXNlcikNCiAg
ICAgIGlmIG5vdCBtbGlzdC5tZW1iZXJzLmhhc19rZXkodXNlcikgYW5kIFwN
CiAgICAgICAgICAgICAgbm90IG1saXN0LmRpZ2VzdF9tZW1iZXJzLmhhc19r
ZXkodXNlcik6DQohICAgICAgICAgdW5rbm93blVzZXIgPSAxDQogIA0KICAg
ICAgIyBmaW5kIHRoZSBjYXNlIHByZXNlcnZlZCBlbWFpbCBhZGRyZXNzICh0
aGUgb25lIHRoZSB1c2VyIHN1YnNjcmliZWQgd2l0aCkNCiEgICAgIA0KISAg
ICAgaWYgdW5rbm93blVzZXIgPT0gMDoNCiEgCWxjdXNlciA9IG1saXN0LkZp
bmRVc2VyKHVzZXIpDQohIAljcHVzZXIgPSBtbGlzdC5HZXRVc2VyU3Vic2Ny
aWJlZEFkZHJlc3MobGN1c2VyKQ0KISAJaWYgbGN1c2VyID09IGNwdXNlcjoN
CiEgCSAgICBjcHVzZXIgPSBOb25lDQohIAlpZiBtbGlzdC5vYnNjdXJlX2Fk
ZHJlc3NlczoNCiEgCSAgICBwcmVzZW50YWJsZV91c2VyID0gVXRpbHMuT2Jz
Y3VyZUVtYWlsKHVzZXIsIGZvcl90ZXh0PTEpDQohIAkgICAgaWYgY3B1c2Vy
IGlzIG5vdCBOb25lOg0KISAgICAgICAgICAgICAgICBjcHVzZXIgPSBVdGls
cy5PYnNjdXJlRW1haWwoY3B1c2VyLCBmb3JfdGV4dD0xKQ0KISAgICAgICAg
IGVsc2U6DQohIAkgICAgcHJlc2VudGFibGVfdXNlciA9IHVzZXINCiAgICAg
IGVsc2U6DQohICAgICAgICAgbHVzZXIgPSAibHVzZXJAYmF6Ig0KISAJY3B1
c2VyID0gImNwdXNlckBiYXoiDQohIAlwcmVzZW50YWJsZV91c2VyID0gInBy
ZXNlbnRhYmxlX3VzZXIiDQohIAlwcmVzZW50YWJsZV91c2VyID0gVXRpbHMu
T2JzY3VyZUVtYWlsKHVzZXIsIGZvcl90ZXh0PTEpDQohICAgICAgICAgY3B1
c2VyID0gVXRpbHMuT2JzY3VyZUVtYWlsKHVzZXIsIGZvcl90ZXh0PTEpDQog
IA0KICAgICAgIyBEbyByZXBsYWNlbWVudHMNCiAgICAgIHJlcGxhY2VtZW50
cyA9IG1saXN0LkdldFN0YW5kYXJkUmVwbGFjZW1lbnRzKCkNCioqKioqKioq
KioqKioqKg0KKioqIDExNSwxMjAgKioqKg0KLS0tIDExOSwxMzAgLS0tLQ0K
ICAgICAgICAgIG1saXN0LkZvcm1hdE9wdGlvbkJ1dHRvbihtbV9jZmcuQ29u
Y2VhbFN1YnNjcmlwdGlvbiwgMCwgdXNlcikpDQogICAgICByZXBsYWNlbWVu
dHNbJzxtbS1oaWRlLXN1YnNjcmlwdGlvbi1idXR0b24+J10gPSBtbGlzdC5G
b3JtYXRPcHRpb25CdXR0b24oDQogICAgICAgICAgbW1fY2ZnLkNvbmNlYWxT
dWJzY3JpcHRpb24sIDEsIHVzZXIpDQorICAgICBpZiB1bmtub3duVXNlciA9
PSAxOg0KKyAgICAgICAgIHJlcGxhY2VtZW50c1snPG1tLXB1YmxpYy1zdWJz
Y3JpcHRpb24tYnV0dG9uPiddID0gKA0KKyAgICAgICAgICAgIG1saXN0LkZv
cm1hdE9wdGlvbkJ1dHRvbihtbV9jZmcuQ29uY2VhbFN1YnNjcmlwdGlvbiwg
MSwgdXNlcikpDQorICAgICAgICAgcmVwbGFjZW1lbnRzWyc8bW0taGlkZS1z
dWJzY3JpcHRpb24tYnV0dG9uPiddID0gKA0KKyAgICAgICAgICAgIG1saXN0
LkZvcm1hdE9wdGlvbkJ1dHRvbihtbV9jZmcuQ29uY2VhbFN1YnNjcmlwdGlv
biwgMCwgdXNlcikpDQorICAgICAgICAgDQogICAgICByZXBsYWNlbWVudHNb
JzxtbS1kaWdlc3Qtc3VibWl0PiddID0gbWxpc3QuRm9ybWF0QnV0dG9uKA0K
ICAgICAgICAgICdzZXRkaWdlc3QnLCAnU3VibWl0IE15IENoYW5nZXMnKQ0K
ICAgICAgcmVwbGFjZW1lbnRzWyc8bW0tdW5zdWJzY3JpYmUtYnV0dG9uPidd
ID0gKA0KZGlmZiAtYyBtYWlsbWFuLTIuMGJldGEyL01haWxtYW4vQ2dpL3N1
YnNjcmliZS5weSBtYWlsbWFuLTIuMGJldGEyLWxvY2FsY2hhbmdlcy9NYWls
bWFuL0NnaS9zdWJzY3JpYmUucHkNCioqKiBtYWlsbWFuLTIuMGJldGEyL01h
aWxtYW4vQ2dpL3N1YnNjcmliZS5weQlUdWUgQXByICA0IDE5OjM4OjI1IDIw
MDANCi0tLSBtYWlsbWFuLTIuMGJldGEyLWxvY2FsY2hhbmdlcy9NYWlsbWFu
L0NnaS9zdWJzY3JpYmUucHkJVHVlIE1heSAgMiAxMzoxODoyOCAyMDAwDQoq
KioqKioqKioqKioqKioNCioqKiAxMDAsMTExICoqKioNCiAgICAgICAgICBh
ZGRyID0gZm9ybVsnaW5mbyddLnZhbHVlDQogICAgICAgICAgbWVtYmVyID0g
bWxpc3QuRmluZFVzZXIoYWRkcikNCiAgICAgICAgICBpZiBub3QgbWVtYmVy
Og0KISAgICAgICAgICAgICBkb2MuQWRkSXRlbShIZWFkZXIoMiwgIkVycm9y
IikpDQohICAgICAgICAgICAgIGRvYy5BZGRJdGVtKEJvbGQoIiVzIGhhcyBu
byBzdWJzY3JpYmVkIGFkZHIgPGk+JXM8L2k+LiINCiEgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAlIChtbGlzdC5yZWFsX25hbWUsIGFkZHIpKSkN
CiEgICAgICAgICAgICAgZG9jLkFkZEl0ZW0obWxpc3QuR2V0TWFpbG1hbkZv
b3RlcigpKQ0KISAgICAgICAgICAgICBwcmludCBkb2MuRm9ybWF0KGJnY29s
b3I9IiNmZmZmZmYiKQ0KISAgICAgICAgICAgICByZXR1cm4NCiAgDQogICAg
ICAgICAgY2FsbF9zY3JpcHQobWxpc3QsIG1lbWJlciwgJ29wdGlvbnMnKQ0K
ICAgICAgICAgICMgc2hvdWxkIG5ldmVyIGdldCBoZXJlIQ0KLS0tIDEwMCwx
MDYgLS0tLQ0KICAgICAgICAgIGFkZHIgPSBmb3JtWydpbmZvJ10udmFsdWUN
CiAgICAgICAgICBtZW1iZXIgPSBtbGlzdC5GaW5kVXNlcihhZGRyKQ0KICAg
ICAgICAgIGlmIG5vdCBtZW1iZXI6DQohICAgICAgICAgICAgIG1lbWJlciA9
IGFkZHINCiAgDQogICAgICAgICAgY2FsbF9zY3JpcHQobWxpc3QsIG1lbWJl
ciwgJ29wdGlvbnMnKQ0KICAgICAgICAgICMgc2hvdWxkIG5ldmVyIGdldCBo
ZXJlIQ0K
--0-346115632-957288197=:6986--