Re: Issue #18: Access to spi-private mailing list archives unclear

SPI's website allows (visibly) to consult the archives of the
spi-private mailing list, via http://lists.spi-inc.org/private/spi-private/

Unfortunately, this requires authentication using an unspecified
password. I for one am currently unable to access the archives as a
result (I do not remember ever managing to access).

--
This mail's original content (non-quoted parts) is available under the Creative Commons Attribution-ShareAlike License 4.0.

Philippe Cloutier
http://www.philippecloutier.com

Philippe Cloutier wrote:
> SPI's website allows (visibly) to consult the archives of the spi-private
> mailing list, via http://lists.spi-inc.org/private/spi-private/
>
> Unfortunately, this requires authentication using an unspecified password. I
> for one am currently unable to access the archives as a result (I do not
> remember ever managing to access).

All mailman lists have user level passwords. If you don't recall your
spi-private password, you can enter your email in the final box on
http://lists.spi-inc.org/listinfo/spi-private and click [Unscubscibe or
edit options] and get a password reminder from the next page.

--
----------------------------
Michael Schultheiss
E-mail: schultmc(at)spi-inc(dot)org

Hi Michael,

Le 2021-04-10 à 20:12, Michael Schultheiss a écrit :
> Philippe Cloutier wrote:
>> SPI's website allows (visibly) to consult the archives of the spi-private
>> mailing list, via http://lists.spi-inc.org/private/spi-private/
>>
>> Unfortunately, this requires authentication using an unspecified password. I
>> for one am currently unable to access the archives as a result (I do not
>> remember ever managing to access).
> All mailman lists have user level passwords. If you don't recall your
> spi-private password, you can enter your email in the final box on
> http://lists.spi-inc.org/listinfo/spi-private and click [Unscubscibe or
> edit options] and get a password reminder from the next page.

Thank you, I managed to access the archives thanks to the "password
reminder". I also understood what happened. I had never set a password
for spi-private. The password was determined by Mailman, and indicated
to me in the mail which I received on subscription.

That subscription mail (and therefore my password) has been in my
mailbox for 4 years. In my opinion, this might constitutes a security
issue; anyone who would gain access to the mailbox of an spi-private
subscriber who did not delete their subscription message would gain
access to the full history of spi-private.

That being said, to go back to the original problem, the paragraph
"(/The subscribers list is only available to the list administrator./)"
which starts the Spi-private Subscribers section in
http://lists.spi-inc.org/listinfo/spi-private seems to suggest the whole
section is irrelevant for most subscribers.

I recommend the following:

1. Indicate in http://lists.spi-inc.org/private/spi-private/ that all
subscribers have a password, and that it can be sent as a reminder.
2. Clarify the Spi-private Subscribers section by:
1. Moving the paragraph about unsubscribing first.
2. Merging the first 2 paragraphs (the parenthesis can be merged
into the "Enter your admin address and password to visit the
subscribers list" paragraph.)
3. Fixing the "Unsubscribe or edit options" button's label so it
covers all its functions.

--
This mail's original content (non-quoted parts) is available under the Creative Commons Attribution-ShareAlike License 4.0.

Philippe Cloutier
http://www.philippecloutier.com

The behavior has changed, presumably following the modernization of SPI
mailing lists. Trying to access archives now brings to an Authentication
page which contains:

> The site you are about to log into is run by pgarchives_private. If
> you choose to proceed with this authentication, your name and email
> address will be shared with /pgarchives_private/.
>
> Please confirm that you consent to this sharing.
>
> Consent to sharing data with pgarchives_private Consent to sharing
> this data

Activating the "Proceed with login" button yields:

> You are not currently subscribed to any mailing list on this server.
> Account not created.

Since access now seems impossible, I am retitling this report to "Access
to spi-private mailing list archives unclear or impossible".

On 2021-04-15 16:32, Philippe Cloutier wrote:
>
> Hi Michael,
>
> Le 2021-04-10 à 20:12, Michael Schultheiss a écrit :
>> Philippe Cloutier wrote:
>>> SPI's website allows (visibly) to consult the archives of the spi-private
>>> mailing list, viahttp://lists.spi-inc.org/private/spi-private/
>>>
>>> Unfortunately, this requires authentication using an unspecified password. I
>>> for one am currently unable to access the archives as a result (I do not
>>> remember ever managing to access).
>> All mailman lists have user level passwords. If you don't recall your
>> spi-private password, you can enter your email in the final box on
>> http://lists.spi-inc.org/listinfo/spi-private and click [Unscubscibe or
>> edit options] and get a password reminder from the next page.
>
>
> Thank you, I managed to access the archives thanks to the "password
> reminder". I also understood what happened. I had never set a password
> for spi-private. The password was determined by Mailman, and indicated
> to me in the mail which I received on subscription.
>
> That subscription mail (and therefore my password) has been in my
> mailbox for 4 years. In my opinion, this might constitutes a security
> issue; anyone who would gain access to the mailbox of an spi-private
> subscriber who did not delete their subscription message would gain
> access to the full history of spi-private.
>
>
> That being said, to go back to the original problem, the paragraph
> "(/The subscribers list is only available to the list
> administrator./)" which starts the Spi-private Subscribers section in
> http://lists.spi-inc.org/listinfo/spi-private seems to suggest the
> whole section is irrelevant for most subscribers.
>
> I recommend the following:
>
> 1. Indicate in http://lists.spi-inc.org/private/spi-private/ that all
> subscribers have a password, and that it can be sent as a reminder.
> 2. Clarify the Spi-private Subscribers section by:
> 1. Moving the paragraph about unsubscribing first.
> 2. Merging the first 2 paragraphs (the parenthesis can be merged
> into the "Enter your admin address and password to visit the
> subscribers list" paragraph.)
> 3. Fixing the "Unsubscribe or edit options" button's label so it
> covers all its functions.
>
> --
> This mail's original content (non-quoted parts) is available under the Creative Commons Attribution-ShareAlike License 4.0.
>
> Philippe Cloutier
> http://www.philippecloutier.com

--
Philippe Cloutier
https://www.philippecloutier.com

Hello Philippe, and others who have mentioned spi-private-related issues recently,

To clarify things about spi-private: subscription is done on members.spi-inc.org by ticking "spi-private subscription". There is some delay (max 5 minutes) before this subscription is pushed to lists.spi-inc.org and archives-private.spi-inc.org as this is done by a cron job. If you got an error message accessing archives-private, please try again now.

I know the situation is not ideal. I'll try to work on a solution soon. When I think about it, it would make sense for all contributing members to have access to spi-private's archives, even without subscribing... That would fix all of these issues.

--
Célestin Matte, IT contractor for SPI

Bonjour Célestin,

On 2025-07-26 04:32, Célestin Matte wrote:
> Hello Philippe, and others who have mentioned spi-private-related
> issues recently,
>
> To clarify things about spi-private: subscription is done on
> members.spi-inc.org by ticking "spi-private subscription". There is
> some delay (max 5 minutes) before this subscription is pushed to
> lists.spi-inc.org and archives-private.spi-inc.org as this is done by
> a cron job.

Thank you

> If you got an error message accessing archives-private, please try
> again now.

The situation has changed. I no longer get the Authentication page I
described. But I still get the same error page.

By the way, authentication now uses a "community account". Does this
mean the passwords previously (as of 2021) used to access spi-private
are obsolete?

>
> I know the situation is not ideal. I'll try to work on a solution
> soon. When I think about it, it would make sense for all contributing
> members to have access to spi-private's archives, even without
> subscribing... That would fix all of these issues.

Thanks in advance if someone can achieve that

--
This mail's original content (non-quoted parts) is available under the Creative Commons Attribution-ShareAlike License 4.0.

Philippe Cloutier
https://www.philippecloutier.com