• docs/v322_new.md exec/nntpservice.js

    From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Wednesday, November 11, 2026 22:14:54
    https://gitlab.synchro.net/main/sbbs/-/commit/56bf760373543d2902a53f01
    Modified Files:
    docs/v322_new.md exec/nntpservice.js
    Log Message:
    nntpservice: don't log users' passwords

    Every command line was logged verbatim, so each AUTHINFO PASS put the
    user's password in clear text into the services log (syslog/journal on
    *nix). This dates from the service's first version, b4dc5765eb
    (tops-11-roots, 2001-11-13).

    Mask the argument of any AUTHINFO subcommand other than USER wherever a received command line is logged: the per-command log line, the bogus
    command log line, and the reason text given to the IP filter.

    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Wednesday, November 11, 2026 22:14:54
    https://gitlab.synchro.net/main/sbbs/-/commit/8edb4bf421dff349f25bb6d9
    Modified Files:
    docs/v322_new.md exec/nntpservice.js
    Log Message:
    nntpservice: list article ranges from the index, not a lookup per number

    XOVER and XHDR called get_msg_header() for every number in the range the
    client asked for, without clamping it to the group's first and last
    messages. Article numbers are sparse on most groups, so most lookups were
    for numbers that don't exist, and an open range such as "XOVER 1-" on a
    group numbered from 317056 made about 318,000 lookups to list 1,044
    articles. In the mail group only the user's own mail is listed, so even an exact range is mostly other users' messages.

    for_each_article() now clamps the range and, in a sub, binary-searches the index for the first article and reads headers by offset until it passes
    the end of the range; in the mail group it filters one get_index() read by
    user before reading any header. Ranges of up to 32 numbers are still
    looked up directly. Measured on Linux, same results throughout:

    mail group, full range (951 of 9,366): 3.9 s -> 0.1 s
    "1-317356" on a group numbered 317056+: 15.7 s -> 0.04 s
    dense ranges and single articles: unchanged

    LISTGROUP now reads the index once with get_index(), as count_msgs()
    already did, instead of one get_msg_index() call per message.

    XHDR also parsed an open-ended range ("N-") as ending at 0 and returned nothing; XOVER and XHDR now share one range parser that treats it as
    running to the last article.

    Part of #1340.

    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

    ---
    þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net
  • From nelgin@VERT/EOTLBBS to Rob Swindell (on Debian Linux) on Thursday, November 12, 2026 02:44:44
    On Wed, 11 Nov 2026 22:14:54 -0800
    "Rob Swindell (on Debian Linux)" (VERT) <VERT!Rob.Swindell.(on.Debian.Linux)@endofthelinebbs.com> wrote:

    https://gitlab.synchro.net/main/sbbs/-/commit/56bf760373543d2902a53f01 Modified Files:
    docs/v322_new.md exec/nntpservice.js
    Log Message:
    nntpservice: don't log users' passwords

    Every command line was logged verbatim, so each AUTHINFO PASS put the
    user's password in clear text into the services log (syslog/journal on
    *nix). This dates from the service's first version, b4dc5765eb (tops-11-roots, 2001-11-13).

    Mask the argument of any AUTHINFO subcommand other than USER wherever
    a received command line is logged: the per-command log line, the bogus command log line, and the reason text given to the IP filter.

    and what is the sysop would like passwords logged to help with
    debugging?
    --
    End Of The Line BBS - Plano, TX
    telnet endofthelinebbs.com 23
    ---
    * Synchronet * End Of The Line BBS - endofthelinebbs.com