Subject: RE: [Fwd: Re: Update to the IETF E-mail List Request Tool]

From: "Fuller, Barbara" <[email-masked]>
Date: Thu, 31 Aug 2006 10:55:40 -0400

Hi Brian:

Michael Lee replied to this message on Monday, August 28th at 12:19 PM
ET.  However, he did not Cc the Working Group Chairs' list (which I am
Cc'ing on this message).  The message that Michael sent to Sandy is
included below.  We have changed the wording of the "Next" button to
"Proceed to select an approver."

Barbara
--------------------------------------------------------
MESSAGE FROM MICHAEL TO SANDY
Hi Sandy,

The "Next" button will take you to a screen that you can review your
input as well as select a person from a drop down list who can approve
your request. You will definitely see Sam Hartman from the drop down
list.
No action will be taken until the selected approver approves your
request.

With your concern, we will rename the button with more descriptive text
rather than just saying "Next".
Thanks for bringing this issue to our attention and please let us know
if you have any further question or concern on this new feature.

Regards,
Michael Lee,
IETF Secretariat.

-----Original Message-----
From: Brian E Carpenter [mailto:[email-masked]] 
Sent: Thursday, August 31, 2006 4:30 AM
To: Fuller, Barbara
Subject: [Fwd: Re: Update to the IETF E-mail List Request Tool]

Barbara, will someone answer this? I assume the usual
authorization mechanism applies, as for list creation?

     Brian

-------- Original Message --------
Subject: Re: Update to the IETF E-mail List Request Tool
Date: Mon, 28 Aug 2006 11:33:31 -0400 (EDT)
From: [email-masked]
To: [email-masked]
CC: [email-masked]

>The tool now allows a user to request that a working-group or
>non-working-group mailing list that is hosted at ietf.org be closed.

There's no hint here that you do any authorization of such requests.
I presume that your well-known professionalism means that of course you
do.  But just to see what it might be, I looked at the site.  I looked
at the list of non-wg lists, found "saag" which I recognized ("real"
list is at mit.edu) and tried removing it.  (The button said "Next",
which gave me some confidence that there would be some subsequent step
before the mailing list was "automatically deleted from that page.")
I got to a page that requested that I identify myself.  I did not try
typing in "Sam Hartman" or "Jeff Schiller" or any such probably
authorized person.  I trust you guys, but I was chicken.

Tried the same thing with rpsec, with the same result - I was chicken
to go through with the identification step, with or without spoofing.

But.  Just what are you using for authorization and authentication?

--Sandy