I did a search and found this recommendation from 2019: "It sounds like you don't have the proper privacy setting chosen.? Go to Admin > Settings and scroll down to the Privacy section.? In the Visibility box, you want the last part of the choice to say ", private messages".? Before you change it, be aware that this is a one-way change.? You can never make the archives public again."

But all I see is #3 and #4 below with private messages at the end. Is #4 the best one??

1) Group listed in directory, publicly viewable messages

2) Group not listed in directory, publicly viewable messages

3) Group listed in directory, private messages

4) Group not listed in directory, private messages.?

absolute total number of groups (~32K) as the value for calculating how many result pages with link info to display, but the "fetch data" code returns less because it checks for group visibility; there are 9980 visible groups

开云体育

Thanks, Shal, for the clear and helpful reply!

Not trying to game the system. Just wanted to be sure that I had not missed such a feature when going through the excellent Owners Manual. (I was concerned because -- when I searched on subgroups -- some of the key info turned out to be located in wiki entries rather than in the Owners Manual.)

I got the pre-authorization idea because, at one point the now-living-dead LinkedIn Groups system had pre-authorization, which worked quite nicely.

We will switch to the Premium level. First, in fairness to Mark.?

And we want subgroups.?(We have a website, so we don't need calendar, database, photos, files, or wiki. Our members are not into chat. Unlike many other groups, we've found that an archive of old posts is not very useful for us due to the continually-changing info. Polls would be useful. We have Eventbrite for donations, which works very well.)?

In short, we need an email-based, moderated discussion system with reliable email delivery.

Agree about spamtraps. Given the care our team has taken in vetting applications over the 20 years, we would only have a spamtrap if a legit account has been taken over.

Agree on people marking invitations as spam. Given the varying level of email literacy -- and that many are set to "no email" -- there will be people who do this.?

Deliverability is the Achilles heel for any email-based system.?

For example,?Gmail, marks confirmation emails from Yahoo Groups as spam -- and the spam folder is hidden. Our directions say: "If you don't see the confirmation emails within an hour, check your Spam or Trash folder. (In Gmail, click "More" in the left-hand menu to find the hidden Spam folder.)"

My bet is that, as Groups.io grows in membership and volume, Gmail will do the same with Groups.io's confirmation emails.

Thanks again,
--cg

I know we could send invitations via Premium Groups.io ...

... however, that would increase the chance that email providers (and
public and private blackhole lists) block the Groups.io IP address ...

Is there a way to upload a list of email addresses to pre-authorize
approval of subscription requests?

?Que es un?spambots?

Albums, Photos, Attachments, Files.and more, all exist and arenalive and well, in IO...

开云体育

Shal,

Mark,

> Also, I don't know how the companies' helpdesks are getting signed up:
> All the lists require a confirmation email so whoever signs them up
> has to somehow have access to the confirmation email.

Not necessarily.

If all that is required is a reply to the confirmation email that could happen automatically as part of the helpdesk's response to any new case.

Good point. This is a possibility and I've been foolish not to think of it!

You are correct. See below.

The trick, if this is done by a malcontent/prankster, is to forge the helpdesk's address as the From address in a subscribe request to the list.

Most Mailman lists allow initial signup via web. You can of course enter any email address you wish in the web form.

This results in an authentication email being sent to the given address with a "confirm <authcode>" string in both the Subject and message body. All that the receiver has to do is to reply to the message and include the "confirm <authcode>" string anywhere in the message body and/or Subject and the email address will be successfully signed up.

Thus, as you say, if the helpdesk software automatically replies to any new email it receives (which most do) then it is trivial to fraudulently sign them up to any Mailman 2 mail list. (I say Mailman 2 because I've not confirmed whether or not this vulnerability still affects Mailman 3).

It could be done by a random-address spambot if the list has a separate email address for subscription (like the +subscribe address of a Groups.io group).

The initial signup could also be done with a web bot, since most MM2 mail lists have exactly identical layouts to the signup page.

it is only a matter of time before it sends a spam (virus, phishing, malware, etc.) message To: the list's subscribe address From: the helpdesk address.

What I have observed is that no spam or malware of any sort seems to be sent to the mail lists using this method. Indeed, there's no point signing up an innocent company's helpdesk in order to send spam/malware to a mail list since anyone can sign up to the mail list anyway with a disposable email address and send spam/malware that way if they want.

If this thing is an attack then it is definitely an attack on the companies (or the companies' helpdesks). I.e. It would seem to be a very feeble DoS attack against the helpdesks.

Thanks for causing me to think it through properly. :-)

-- 
Mark Rousell

开云体育

Check out the?new groups.io Help Center??Use your browser to search or download?the PDF.

The spreadsheet only seems to indicate what is available for 'albums'
which does not answer my question.

Since the free group has 1G of space, I assume this means photos and
files can still be attached to a post/email message.

I know that photo and file albums do not exist anymore.

Also, I don't know how the companies' helpdesks are getting signed up:
All the lists require a confirmation email so whoever signs them up
has to somehow have access to the confirmation email.