Subject: Update to the IETF E-mail List Request Tool

From: IETF Secretariat <[email-masked]>
Date: Mon, 28 Aug 2006 11:01:36 -0400

The IETF Secretariat is pleased to announce an update to the "IETF Email
List Request" tool (https://datatracker.ietf.org/public/request_list.cgi).

The tool now allows a user to request that a working-group or
non-working-group mailing list that is hosted at ietf.org be closed.  In
addition, if the list is a non-working-group mailing list *and* if it is
also listed on the "IETF Non-WG Mailing Lists" Web page
(https://datatracker.ietf.org/public/nwg_list.cgi), then it will be
automatically deleted from that page.

If you have any questions about these new features, or require assistance
in using the tool, then please send a message to [email-masked].

The IETF Secretariat

---

From: [email-masked]
Date: Mon, 28 Aug 2006 11:33:31 -0400 (EDT)

>non-working-group mailing list that is hosted at ietf.org be closed.

There's no hint here that you do any authorization of such requests.
I presume that your well-known professionalism means that of course you
do.  But just to see what it might be, I looked at the site.  I looked
at the list of non-wg lists, found "saag" which I recognized ("real"
list is at mit.edu) and tried removing it.  (The button said "Next",
which gave me some confidence that there would be some subsequent step
before the mailing list was "automatically deleted from that page.")
I got to a page that requested that I identify myself.  I did not try
typing in "Sam Hartman" or "Jeff Schiller" or any such probably
authorized person.  I trust you guys, but I was chicken.

Tried the same thing with rpsec, with the same result - I was chicken
to go through with the identification step, with or without spoofing.

But.  Just what are you using for authorization and authentication?

--Sandy