[Mailman-Developers] Interesting study -- spam on posted addresses...

[Barry A. Warsaw]

>>>>> "JM" == John Morton <jwm@plain.co.nz> writes:

    JM> No, it just involves squashing the two actions a user needs to
    JM> take into one, more obvious action - rather than subscribe a
    JM> new address, confirm it, then delete the old address and
    JM> confirm it, you change the address (keeping the settings), and
    JM> confirm both dropping the old address and sending to the new
    JM> one as a pair of emails. Iff both confirmations succeed, the
    JM> address changes, otherwise it stays as it was. Adding other
    JM> valid sending addresses will also require an email
    JM> confirmation action.

I'm working on a longer response to this thread, but let me just point
out that MM2.1 already allows users to change their email address
(even globally for all lists at the site).  It requires only a
confirmation from the new address because the action is hidden behind
a password screen.  So we know the old address has been authenticated
and we need only verify that the new address wants the change as well.

Adding email addresses to the user's record requires a more radical
change to the underlying schema so that's put off for MM3, but there
are plans and (tentative) designs for it.

-Barry