Sharon Villines <sharon@...> wrote:

My list is set to no attachments but someone just posted a message from
a spoofed address that included a pdf.

How does this happen?

Was the file actually attached to the email, or was it via a web link? Many
email clients will display the latter as the former.


--
rgds
LAurence
<><
...
Click..Click..Click..darn, out of taglines!

My list is set to no attachments but someone just posted a message from a spoofed address that included a pdf.

How does this happen?

开云体育

This was once a HUGE battle on the beta group. Some people feared that email addresses inadvertently included via email top-posts would remain indefinitely in the group archive, thus violating current members' privacy with respect to future members. It was finally settled in favor of the spoofing (aka "figleafing") being a group option, but the option has not yet been implemented. It's on the trello list and some of us have been waiting more than a year for it. :)

J

Pete Spotts <nm5ps@...> wrote:

Sorry folks, a newbie here. What's the best way to prevent people from
using another member's email address to plant a faux post from the
unsuspecting member? We've just set up our account and I've been able to
file a test post using another member's email -- his email address, my
signature in the body.

It's impossible to completely prevent this, since the system uses the
"aparrent" email address to know who is posting. There are ways of
comparing headers in the email, but doing so would probably block a large
number of legitimate messages.

On the other hand, many (most?) ISPs now prevent emails being sent from
addresses that are not their own, and third-party providers require a
username and password, so the risk is probably not great - and much less
than it used to be.

73

--
rgds
LAurence
<><
...
It'sdifficulttobeverycreativewithonly58characters

Recently a message asked if anyone had an email address for a particular company.

It was supplied in a reply, which was fine if receiving postings by email but online the end of the address is replaced by ....

My query is whether there is any way for an online user to find the full address.

Noel

Hi all,

The last two week's change logs:




Feel free to reply to this topic if you'd like to comment on the changes. Or better yet, if you expect a lot of discussion start a new topic (or rejoin an existing one) about a specific change.


* All existing groups that didn't have a welcome message, now have one (no change in behavior, just internal changes).
* Generate a welcome member notice on group and subgroup creation.

There was some confusion about whether newly created groups had a welcome message. As it turns out they did, but it did not show up in the list of Member Notices. I think it is better now, to have it showing there so that the group management can see that it will be sent and can decide if they want to change it.

The second of those implies change in behavior. Formerly the default (unedited) Welcome message was created on the fly when needed and would reflect the group's current name if the group managers had changed the group name or created a subgroup. As I read it that's no longer true - if you take either action you'll want to update your Welcome message accordingly.



* Remove the restriction where there has to be an active member notice. Now you can unset an active member notice.

For me this solves the problem of having two messages sent when I Direct Add members - one the Direct Add notice and the second the Welcome notice. For my PTA group those were redundant - they said pretty much the same thing. Now I can unset the Welcome notice before doing the Direct Add and re-set it after. It's better than having to delete it and re-create it.


* In the Members view, have the Actions menu dropdown normally, only dropup on mobile.

Ah, that fixes a minor annoyance I hadn't yet reported. When I would search for a member I'd usually get a short list of matches. Putting a check mark on the one I wanted then clicking the "Action" button would result in the top of menu being off-screen and unreachable. So I couldn't use the Action button to remove the member I just found; I'd have to open their membership page and use the Remove button there.


* For Yahoo easy group transfers, we now delay sending messages to transferred people until all data has been imported.

This fixes a problem some group managers reported: their members were so eager to get started posting and uploading that their contributions were getting mixed in with the data import in progress. This resulted in those messages being grossly out of chronological order.


Comments about these others are also welcome:

* INTERNAL: Work on the API.
* CHANGE: For some reason, occasionally, the link that people click on as part of the 'email a login link' function contains a trailing "<br". We now catch that.
* NEW: Created new [email protected] subgroup for discussion about the API.
* CHANGE: If not registered, and trying to subscribe to a subgroup via email, stop with an error before the confirmation process.
* INTERNAL: Bumped up the rate limits for logged in users and we now tell you when you've been rate limited, instead of you getting a blank page.


Please call out any you find significant.

Shal

Many thanks, Shal. I suspected that might be the case. We'll just have to keep
an eye out...

With best regards,

Pete

--

Peter N. Spotts -- NM5PS
ARRL Public Information Coordinator, New Mexico Section

Email: nm5ps@... | Skype: pspotts
QCWA #34679 | SKCC #4853S | QRP-ARCI #4174
NEQRP #714 | NAQCC #2446 | G-QRP #13202 | Polar Bear #348

Pete,

What's the best way to prevent people from using another member's
email address to plant a faux post from the unsuspecting member?

I don't think there's anything the group management can do about that in terms of settings or other technological approaches. This may be something that you have to approach as a member management issue (grounds for moderation, removal, or banning) if and when it occurs.

In the case of messages posted to Groups.io I haven't tested it myself, but I would expect Groups.io to drop most forms of "spoofed" messages -- particularly those that come from spambots and other illegitimate sources. Less certain (in my mind) are those that come by way of a legit email service - as is probably the case in your test.

Major email services such as Yahoo Mail and Gmail don't allow users to spoof just any address - they require that you prove you are a legit user of that address. Usually they send a code to the address and you have to enter it. A malcontent won't be able to set up a spoof of an unsuspecting member using such a service.

I have used ISPs that don't bother with that test, and allow their users to spoof (nearly) any email address. Verizon, for example, used to allow me to spoof any address that wasn't another Verizon user. I'm not sure what, if anything, Groups.io would be willing to do technologically about malcontents who use a service like that.

If you have a specific example you might cite it to [email protected] and see what they have to say about it. There are tell-tales in the message headers that would allow them to recognize a spoof originating at a legit service. But Groups.io might be hesitant to reject all such spoofs, as there may be people using that technique legitimately.

Shal

Sorry folks, a newbie here. What's the best way to prevent people from using another member's email address to plant a faux post from the unsuspecting member? We've just set up our account and I've been able to file a test post using another member's email -- his email address, my signature in the body.

I know, too much time on my hands.

With best regards,

Pete

Colin,

Other ideas?

Only a previous one: in beta@ "bump" the idea of having an option in subgroups to allow primary group members to post without moderation.

I'd recommend a new topic for it, as the prior references are buried in odd topic subjects. You can cite the trello item, asking that it be "bumped" up in priority.


Shal

J,

Does "following" a topic mean you get the emails from it even though
you have emails turned off for the group?

No.

Following has meaning only when you've selected "Following Only" in the Advanced Preferences of your Subscription to the group. Then it controls which messages are sent to you as Individual or Digest, if you have one of those selected as your Email Delivery. If you have Special Notices Only or No Email delivery that has precedence over Following.

Or does is simply undo muting a topic?

No, Unmute does that. Note that Mute and Unmute are used when you have "All Messages" selected rather than "Following Only" in your Message Selection option.

If the former, how do you do it? I can't find the interface. Thanks.

The links to follow or unfollow a topic are included in your emails only if you have selected "Following Only".

If you read messages in your group's Messages section the Mute and Follow functions have no effect. IMO that's a major bit of unfinished work. At this point I would implement those as filters (the Tools button) in the Messages, Topics and Expanded lists of each group.

As things stand, to see them on the web you have to go to the Groups.io home page (click the logo on the top left) then choose from the buttons in the left column. These combine messages from all of your subscriptions.

Shal

Does "following" a topic mean you get the emails from it even though you have emails turned off for the group? Or does is simply undo muting a topic? If the former, how do you do it? I can't find the interface. Thanks.

J

Just what I was having as a second thought!

Or make all members of the subgroup moderators able to approve messages to it.

On Fri, Aug 18, 2017 at 01:56 pm, Colin Taylor wrote:

Right now, I've got the
membership request subgroup configured to allow non-registered emails to go
through with moderation.

Look at the "Settings" button at the left. Click "Integrations" above it. There look for
"Create a receive-only email address that posts to your group."

Jeremy,

If I really wanted this sort of feature, I think I'd investigate
setting up a moderator e-mail address that auto-responded an
approval...

Depending on the software or service you use that might not work:


I don't know if Mark has actually implemented defense against Approval being triggered by an auto responders, but that could prevent the function you intend.

Shal

If I really wanted this sort of feature, I think I'd investigate setting up a moderator e-mail address that auto-responded an approval...

Colin,

Is it possible to configure the system in some way to allow my
members to email this subgroup without being part of the subgroup
itself.

Yay!

Looking further I find that topic was noticed, and the request has made it to the official to-do list:


I thought it had, but when found that Mark didn't comment in the topic I doubted my memory. Should'a looked at trello before posting.

Shal