moderated Re: web-based questionnaire for restricted groups a pressing issue #suggestion
... when someone requests membership via email, the PendingYup. The +subscribe email command may have been spoofed. If the person is logged in to the web site that's not a concern.
Back before Yahoo Groups implemented the same confirmation requirement it was possible to flood someone's inbox by subscribing them to a bunch of high-volume groups. All you needed to know was the person's email address, and how to forge From addresses (create spoofed messages).
In these days of modern times I think Mark could safely remove the confirmation requirement for any +subscribe commands where the sender can be authenticated. Likewise for +unsubscribe and the other email commands.
... but I think this two-step process in the case of join requests viaOne thing that Yahoo Groups does is log the +subscribe receipt itself, and then later log the receipt of the confirmation. In the Email Commands tab of the Activity log these would appear as (newer first):
Mar 24 12:53 PM ... Membership confirmed via email
Mar 24 12:49 PM ... Membership requested via email
And only on the confirmed event would an entry be made in the Membership tab of the log and the person added to the pending member list and the APPROVE notice sent to the mods and the Pending file sent to the member.
(Not that those are particularly well worded. Many mods of restricted groups have been shocked to see "membership confirmed" in the log for people they haven't approved - but that's not what happened. The later entry ought to have said "Membership request confirmed via email".)
(This is made worse by the fact that the Confirmation email is sent,That's because this is confirming that they sent the +subscribe command. It is unrelated to confirming their email address as part of getting their account set up.
So this seems like a bug, unless I have misunderstood Confirmation allIt is confirming something different in this case.