Re: Privacy issue with ackreject

On 27 Mar 12:00, Roger B.A. Klorese wrote:
> We have a case where, in order to encourage opt-in subscriptions in the 
> absence of an actual "invite" operation, I added 400+ subscribers of 
> list A at some other site -- who were notified via that list that they 
> would be invited -- to a list at our site using "subscribe-rule" -- so 
> they would receive confirmation requests.
> 
> When one of the recipients rejected the request, he received an 
> acknowledgment that included all 400+ addresses in the rejection. 

That's also true for anyone who uses the "tokeninfo" command...the
information for the entire session is visible.

You can avoid logging the subscribe commands using "nolog" mode.  That
also prevents the commands from appearing in the event log.

It would be possible to add another administrative mode that prevents a
command from being recorded in the session log, or that prevents the
identity of the victim from being recorded.

Michael