moderated Re: web-based questionnaire for restricted groups a pressing issue #suggestion


 

J,

... when someone requests membership via email, the Pending
Subscription notice is not even sent to them, nor is the moderator
made aware of the membership request in any way, ...
until AFTER the pending member returns the Confirmation email to
groups.io. This is different from when someone requests membership via
the web: ...

I don't understand the reason for this discrepancy (although I'm sure
there must be a good one),
Yup. The +subscribe email command may have been spoofed. If the person is logged in to the web site that's not a concern.

Back before Yahoo Groups implemented the same confirmation requirement it was possible to flood someone's inbox by subscribing them to a bunch of high-volume groups. All you needed to know was the person's email address, and how to forge From addresses (create spoofed messages).

In these days of modern times I think Mark could safely remove the confirmation requirement for any +subscribe commands where the sender can be authenticated. Likewise for +unsubscribe and the other email commands.
https://beta.groups.io/g/main/message/14899

... but I think this two-step process in the case of join requests via
email is contributing to keeping moderators in the dark about
membership requests ...
One thing that Yahoo Groups does is log the +subscribe receipt itself, and then later log the receipt of the confirmation. In the Email Commands tab of the Activity log these would appear as (newer first):

Mar 24 12:53 PM ... Membership confirmed via email
Mar 24 12:49 PM ... Membership requested via email

And only on the confirmed event would an entry be made in the Membership tab of the log and the person added to the pending member list and the APPROVE notice sent to the mods and the Pending file sent to the member.

(Not that those are particularly well worded. Many mods of restricted groups have been shocked to see "membership confirmed" in the log for people they haven't approved - but that's not what happened. The later entry ought to have said "Membership request confirmed via email".)

(This is made worse by the fact that the Confirmation email is sent,
and a response from the person requesting membership via email is
required, even if that person already has a groups.io account.
That's because this is confirming that they sent the +subscribe command. It is unrelated to confirming their email address as part of getting their account set up.

So this seems like a bug, unless I have misunderstood Confirmation all
of this time.
It is confirming something different in this case.

Shal

Join main@beta.groups.io to automatically receive all group messages.