moderated Re: If member of parent, must still confirm request to join unrestricted subgroup #bug


 


>>> "I believe that was implemented so that others couldn't submit subscription requests using your email address."
>>> That makes sense for stand-alone groups.

It does for subgroups as well, for the same reason; due to the inherent insecurity of email it would be easy for someone, anyone for that matter, to "subscribe" another member to the subgroup without them knowing or asking for it; obviously they would have to know group & member specifics, but think about it for a minute, it would be akin to anyone being able to subgroup-DirectAdd someone.  If I knew your group specifics and knew you were a member and your address, nothing then could stop me from spoofing your address and subscribe you through email to all the subgroups, and you wouldn't have a clue, for a while anyway until you got the welcome notices.  The chance of this happening or the reason why it would doesn't matter, it could be a prank or something serious/nefarious, without that confirmation email there is a wide-open hole ready to be exploited.

Email is insecure, being online requires the account to be logged in hence more secure therefore we can relax a bit.

If your objective is to prevent the confirmation email, and you're sending out main-group messages with subscribe links to the subgroups, how about having the links to their home pages instead, and tell folks to click on Join?  Yes I know, it still doesn't address email-only preferred users, they still would have to do the extra step.  But for the rest, work-wise it's easier and faster to click once to go to the group home then click Join and be done, and then they are on the subgroup's pages and can start exploring right away. 

Or alternatively, if the subgroups are announcement groups, you could have a single link to the main group's "Subgroups" link in your message, where all the available subgroups are presented and the members can then join the ones they want to.

Cheers,
Christos

Join main@beta.groups.io to automatically receive all group messages.