enhance checkgroups handling

[Bill Davidsen]

Russ Allbery wrote:
>
>> ## AR (Argentina)
>> checkgroups:jorge_f at nodens.fisica.unlp.edu.ar:ar.*:doit
>> newgroup:jorge_f at nodens.fisica.unlp.edu.ar:ar.*:doit
>> rmgroup:jorge_f at nodens.fisica.unlp.edu.ar:ar.*:doit
>>     
>
>   
>> Everyone can make a mess with checkgroups (2000 ar.* newsgroups created
>> in the row with a forged checkgroups... and then another checkgroups
>> which deletes them and afterwards another which...).
>>     
>
>   
>> But well, this can currently also be done with newgroup/rmgroup articles
>> (but the mess is softer).
>>     
>
> Maybe we should put some sort of limit on how many changes can be made
> with one checkgroups without the administrator manually running
> docheckgroups with some flag?  Sort of like what actsync does.
>   

There are two good ways to do this, one being to have a limit for 
changes in PGP signed groups and another for open groups, or the other 
more flexible/complex way is to have a per-hierarchy limit so problem 
hierarchies can be reined in. Note that these methods are NOT mutually 
exclusive, and you could combine a global default with exceptions.

I could tell horror stories about one hierarchy, run by someone who 
alternately wrote letters to management claiming discrimination due to 
the nature of his hierarchy, and telling us he was a "poor old man" who 
couldn't understand how to do anything tight, or why we didn't want 143 
groups in a hierarchy with 3-5 posts a day. Don't get me started...
> Also, make sure that the checkgroups handling in INN actually obeys the
> pattern in control.ctl.  It used to have problems in that area, but I
> haven't looked at it again since your recent modifications.
>
>   
>
>> Wouldn't it be time to only allow PGP-signed control articles to be
>> honoured?  (inviting current hierarchies maintainers to sign their
>> control articles) Active hierarchies are mostly PGP-managed, though.
>>     
>
>   
>> [perhaps we should discuss that in news.admin.hierarchies]
>>     
>
> True.  Maybe it's time to take that step.
>
>   
You better have some good documentation for moderators on that, because 
there are a number of them using ill-suited Windows software who don't 
know PGP from pig latin.

-- 
bill davidsen <davidsen at tmr.com>
  CTO TMR Associates, Inc
  Doing interesting things with small computers since 1979