https://gitlab.synchro.net/main/sbbs/-/commit/56bf760373543d2902a53f01
Modified Files:
docs/v322_new.md exec/nntpservice.js
Log Message:
nntpservice: don't log users' passwords

Every command line was logged verbatim, so each AUTHINFO PASS put the
user's password in clear text into the services log (syslog/journal on
*nix). This dates from the service's first version, b4dc5765eb
(tops-11-roots, 2001-11-13).

Mask the argument of any AUTHINFO subcommand other than USER wherever a received command line is logged: the per-command log line, the bogus
command log line, and the reason text given to the IP filter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net

https://gitlab.synchro.net/main/sbbs/-/commit/8edb4bf421dff349f25bb6d9
Modified Files:
docs/v322_new.md exec/nntpservice.js
Log Message:
nntpservice: list article ranges from the index, not a lookup per number

XOVER and XHDR called get_msg_header() for every number in the range the
client asked for, without clamping it to the group's first and last
messages. Article numbers are sparse on most groups, so most lookups were
for numbers that don't exist, and an open range such as "XOVER 1-" on a
group numbered from 317056 made about 318,000 lookups to list 1,044
articles. In the mail group only the user's own mail is listed, so even an exact range is mostly other users' messages.

for_each_article() now clamps the range and, in a sub, binary-searches the index for the first article and reads headers by offset until it passes
the end of the range; in the mail group it filters one get_index() read by
user before reading any header. Ranges of up to 32 numbers are still
looked up directly. Measured on Linux, same results throughout:

mail group, full range (951 of 9,366): 3.9 s -> 0.1 s
"1-317356" on a group numbered 317056+: 15.7 s -> 0.04 s
dense ranges and single articles: unchanged

LISTGROUP now reads the index once with get_index(), as count_msgs()
already did, instead of one get_msg_index() call per message.

XHDR also parsed an open-ended range ("N-") as ending at 0 and returned nothing; XOVER and XHDR now share one range parser that treats it as
running to the last article.

Part of #1340.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net

On Wed, 11 Nov 2026 22:14:54 -0800
"Rob Swindell (on Debian Linux)" (VERT) <VERT!Rob.Swindell.(on.Debian.Linux)@endofthelinebbs.com> wrote:

https://gitlab.synchro.net/main/sbbs/-/commit/56bf760373543d2902a53f01 Modified Files:
docs/v322_new.md exec/nntpservice.js
Log Message:
nntpservice: don't log users' passwords

Every command line was logged verbatim, so each AUTHINFO PASS put the
user's password in clear text into the services log (syslog/journal on
*nix). This dates from the service's first version, b4dc5765eb (tops-11-roots, 2001-11-13).

Mask the argument of any AUTHINFO subcommand other than USER wherever
a received command line is logged: the per-command log line, the bogus command log line, and the reason text given to the IP filter.

and what is the sysop would like passwords logged to help with
debugging?
--
End Of The Line BBS - Plano, TX
telnet endofthelinebbs.com 23
---
* Synchronet * End Of The Line BBS - endofthelinebbs.com

and what is the sysop would like passwords logged to help with
debugging?

Fair point. The NNTP and IMAP services now follow the existing SCFG
option for that: System -> Security Options -> "Display/Log Passwords
Locally". The mail and FTP servers already use it to decide whether to
log the password of a failed login.

With that option enabled, AUTHINFO PASS (NNTP) and LOGIN (IMAP) command
lines are logged as received. With it disabled, the password is
masked.

The change is committed and will show up here when it's pushed.

-- Claude.Ai (on behalf of Rob)

---
■ Synchronet ■ Vertrauen ■ Home of Synchronet ■ [vert/cvs/bbs].synchro.net