Subject: Bug in Pine 3.96

From: Hussam Husain Qasem <[email-masked]>
Date: Sat, 12 Apr 1997 00:06:25 -0500

Hi,

I think I found a really annoying bug in Pine 3.96. (Even 3.95)
Every time I compose a long message, and then I suspend, and view the 
files in my home directory, I find a file named: #pico00023# where 
00023 is pine's process id. The problem is that it creates this file 
according to my umask! :( I have my umask set to 022, that means while 
I'm composing my lengthy message on the, everybody can read the 
message I'm sending!

This is what I thought of:

1) Write a front-end script that will set my umask to 077 
   when I enter pine, and 022 when I exist.
2) Hack the source, so it will set the right permission when it 
   creates the file #pico12345#

I'ld probably think the second solution would be the best (if not the 
first). Looking at the help file, this is what I find:

+-------------------------------------------------------------------
| NEW FEATURES IN 3.92
| 
| COMPOSER IMPROVEMENTS  (yeah right!)
| 
|  o Composer checkpointing (Look for files beginning with: #pico... )
| 

Checkpointing? What's that suppose to mean. And apparently, it doesn't 
seem like it "checks". Looking at "other.c", I found:
+----------------------------------------------
| pbuf.ckptdir       = checkpoint_dir_for_pico;
I don't even know if that's relevant.

Do you have any suggestions, or found simiar problems? Is it my pinerc 
file? I'm attaching it just in case.

Does anyone have any idea, suggestions, or similar problems? Is it my 
pinerc file?

Also just a question on the side, under Pine, when I reach the end of the 
page, it scrolls line by line, how can I change this behavior to instead 
scroll by page. The only thing I found in the configuration, was how far 
(from the bottom or top) you want to start scrolling line by line, which is 
not what I wanted.

Also, I couldn't figure out how can I make new versions of Pine, 
highlight what I search for.

Thanks a lot!!

Hussam :)

# Updated by Pine(tm) 3.96, copyright 1989-1996 University of Washington.
#
# Pine configuration file -- customize as needed.
#
# This file sets the configuration options used by Pine and PC-Pine.  If you
# are using Pine on a Unix system, there may be a system-wide configuration
# file which sets the defaults for these variables.  There are comments in
# this file to explain each variable, but if you have questions about
# specific settings see the section on configuration options in the Pine
# notes.  On Unix, run pine -conf to see how system defaults have been set.
# For variables that accept multiple values, list elements are separated
# by commas.  A line beginning with a space or tab is considered to be a
# continuation of the previous line.  For a variable to be unset its value
# must be blank.  To set a variable to the empty string its value should
# be "".  You can override system defaults by setting a variable to the
# empty string.  Switch variables are set to either "yes" or "no", and
# default to "no".
# Lines beginning with "#" are comments, and ignored by Pine.

########################### Essential Parameters ###########################

# Over-rides your full name from Unix password file. Required for PC-Pine.
personal-name=Hussam Husain Qasem

# Sets domain part of From: and local addresses in outgoing mail.
user-domain=

# List of SMTP servers for sending mail. If blank: Unix Pine uses sendmail.
smtp-server=

# NNTP server for posting news. Also sets news-collections for news reading.
nntp-server=news.indiana.edu

# Path of (local or remote) INBOX, e.g. ={mail.somewhere.edu}inbox
# Normal Unix default is the local INBOX (usually /usr/spool/mail/$USER).
inbox-path=

###################### Collections, Folders, and Files #####################

# List of incoming msg folders besides INBOX, e.g. ={host2}inbox, {host3}inbox
# Syntax: optnl-label {optnl-imap-host-name}folder-path
incoming-folders=

# List of directories where saved-message folders may be. First one is
# the default for Saves. Example: Main {host1}mail/[], Desktop mail\[]
# Syntax: optnl-label {optnl-imap-hostname}optnl-directory-path[]
folder-collections=Indiana-University		work/Mail/[]

# List, only needed if nntp-server not set, or news is on a different host
# than used for NNTP posting. Examples: News *[] or News *{host3/nntp}[]
# Syntax: optnl-label *{news-host/protocol}[]
news-collections=

# List of folder pairs; the first indicates a folder to archive, and the
# second indicates the folder read messages in the first should
# be moved to.
incoming-archive-folders=

# List of context and folder pairs, delimited by a space, to be offered for
# pruning each month.  For example: {host1}mail/[] mumble
pruned-folders=

# Over-rides default path for sent-mail folder, e.g. =old-mail (using first
# folder collection dir) or ={host2}sent-mail or ="" (to suppress saving).
# Default: sent-mail (Unix) or SENTMAIL.MTX (PC) in default folder collection.
default-fcc=

# Over-rides default path for saved-msg folder, e.g. =saved-messages (using first
# folder collection dir) or ={host2}saved-mail or ="" (to suppress saving).
# Default: saved-messages (Unix) or SAVEMAIL.MTX (PC) in default folder collection.
default-saved-msg-folder=

# Over-rides default path for postponed messages folder, e.g. =pm (which uses
# first folder collection dir) or ={host4}pm (using home dir on host4).
# Default: postponed-msgs (Unix) or POSTPOND.MTX (PC) in default fldr coltn.
postponed-folder=

# If set, specifies where already-read messages will be moved upon quitting.
read-message-folder=

# Over-rides default path for signature file. Default is ~/.signature
signature-file=~/etc/sig2

# List of file or path names for global/shared addressbook(s).
# Default: none
# Syntax: optnl-label path-name
global-address-book=

# List of file or path names for personal addressbook(s).
# Default: ~/.addressbook (Unix) or \PINE\ADDRBOOK (PC)
# Syntax: optnl-label path-name
address-book=~/etc/addressbook

############################### Preferences ################################

# List of features; see Pine's Setup/options menu for the current set.
# e.g. feature-list= select-without-confirm, signature-at-bottom
# Default condition for all of the features is no-.
feature-list=allow-talk,
	compose-cut-from-cursor,
	delete-skips-deleted,
	enable-aggregate-command-set,
	enable-bounce-cmd,
	enable-dot-files,
	enable-dot-folders,
	enable-flag-cmd,
	enable-full-header-cmd,
	enable-goto-in-file-browser,
	enable-incoming-folders,
	enable-jump-shortcut,
	enable-mail-check-cue,
	enable-suspend,
	enable-tab-completion,
	enable-unix-pipe-cmd,
	expanded-view-of-addressbooks,
	expanded-view-of-distribution-lists,
	expanded-view-of-folders,
	include-text-in-reply,
	news-post-without-validation,
	print-formfeed-between-messages,
	print-includes-from-line,
	print-offers-custom-cmd-prompt,
	quit-without-confirm,
	show-selected-in-boldface,
	signature-at-bottom,
	tab-visits-next-new-message-only,
	select-without-confirm,
	auto-zoom-after-select

# Pine executes these keys upon startup (e.g. to view msg 13: i,j,1,3,CR,v)
initial-keystroke-list=

# Only show these headers (by default) when composing messages
default-composer-hdrs=To:,
	Cc:,
	Subject:

# Add these customized headers (and possible default values) when composing
customized-hdrs=

# When viewing messages, include this list of headers
viewer-hdrs=

# Determines default folder name for Saves...
# Choices: default-folder, by-sender, by-from, by-recipient, last-folder-used.
# Default: "default-folder", i.e. "saved-messages" (Unix) or "SAVEMAIL" (PC).
saved-msg-name-rule=default-folder

# Determines default name for Fcc...
# Choices: default-fcc, by-recipient, last-fcc-used.
# Default: "default-fcc" (see also "default-fcc=" variable.)
fcc-name-rule=

# Sets presentation order of messages in Index. Choices:
# subject, from, arrival, date, size. Default: "arrival".
sort-key=

# Sets presentation order of address book entries. Choices: dont-sort,
# fullname-with-lists-last, fullname, nickname-with-lists-last, nickname
# Default: "fullname-with-lists-last".
addrbook-sort-rule=

# Sets the default folder and collectionoffered at the Goto Command's prompt.
goto-default-rule=

# Reflects capabilities of the display you have. Default: US-ASCII.
# Typical alternatives include ISO-8859-x, (x is a number between 1 and 9).
character-set=

# Specifies the program invoked by ^_ in the Composer,
# or the "enable-alternate-editor-implicitly" feature.
editor=emacs

# Specifies the program invoked by ^T in the Composer.
speller=

# Specifies the column of the screen where the composer should wrap.
composer-wrap-column=60

# Specifies the string to insert when replying to  message.
reply-indent-string=

# Specifies the string to use when sending a  message with no to or cc.
empty-header-message=

# Program to view images (e.g. GIF or TIFF attachments).
image-viewer=

# If "user-domain" not set, strips hostname in FROM address. (Unix only)
use-only-domain-name=No

########## Set within or by Pine: No need to edit below this line ##########

# Your default printer selection
printer=

# List of special print commands
personal-print-command=

# Which category default print command is in
personal-print-category=

# Set by Pine; controls beginning-of-month sent-mail pruning.
last-time-prune-questioned=97.4

# Set by Pine; controls display of "new version" message.
last-version-used=3.96

# This names the path to an alternative program, and any necessary arguments,
# to be used in posting mail messages.  Example:
#                    /usr/lib/sendmail -oem -t -oi
# or,
#                    /usr/local/bin/sendit.sh
# The latter a script found in Pine distribution's contrib/util directory.
# NOTE: The program MUST read the message to be posted on standard input,
#       AND operate in the style of sendmail's "-t" option.
sendmail-path=

# This names the root of the tree to which the user is restricted when reading
# and writing folders and files.  For example, on Unix ~/work confines the
# user to the subtree beginning with their work subdirectory.
# (Note: this alone is not sufficient for preventing access.  You will also
# need to restrict shell access and so on, see Pine Technical Notes.)
# Default: not set (so no restriction)
operating-dir=

# This variable takes a list of programs that message text is piped into
# after MIME decoding, prior to display.
display-filters=

# This defines a program that message text is piped into before MIME
# encoding, prior to sending
sending-filters=

# A list of alternate addresses the user is known by
alt-addresses=

# This is a list of formats for address books.  Each entry in the list is made
# up of space-delimited tokens telling which fields are displayed and in
# which order.  See help text
addressbook-formats=

# This gives a format for displaying the index.  It is made
# up of space-delimited tokens telling which fields are displayed and in
# which order.  See help text
index-format=STATUS MSGNO DATE SENDER(34%) SIZE SUBJECT(66%)

# The number of lines of overlap when scrolling through message text
viewer-overlap=1

# Number of lines from top and bottom of screen where single
# line scrolling occurs.
scroll-margin=

# The number of seconds to sleep after writing a status message
status-message-delay=

# The approximate number of seconds between checks for new mail
mail-check-interval=120

# Full path and name of NEWSRC file
newsrc-path=~/etc/newsrc

# Path and filename of news configation's active file.
# The default is typically "/usr/lib/news/active".
news-active-file-path=

# Directory containing system's news data.
# The default is typically "/usr/spool/news"
news-spool-directory=

# Path and filename of the program used to upload text from your terminal
# emulator's into Pine's composer.
upload-command=

# Text sent to terminal emulator prior to invoking the program defined by
# the upload-command variable.
# Note: _FILE_ will be replaced with the temporary file used in the upload.
upload-command-prefix=

# Path and filename of the program used to download text via your terminal
# emulator from Pine's export and save commands.
download-command=

# Text sent to terminal emulator prior to invoking the program defined by
# the download-command variable.
# Note: _FILE_ will be replaced with the temporary file used in the downlaod.
download-command-prefix=

# Sets the search path for the mailcap cofiguration file.
# NOTE: colon delimited under UNIX, semi-colon delimited under DOS/Windows/OS2.
mailcap-search-path=~/etc/mailcap:/usr/local/etc/mailcap

# Sets the search path for the mimetypes cofiguration file.
# NOTE: colon delimited under UNIX, semi-colon delimited under DOS/Windows/OS2.
mimetype-search-path=~/etc/mime.types:/usr/local/etc/mime.types

# Sets the time in seconds that Pine will attempt to open a network
# connection.  The default is 30, the minimum is 5, and the maximum is
# system defined (typically 75).
tcp-open-timeout=10

# Sets the time in seconds that Pine will attempt to open a UNIX remote
# shell connection.  The default is 15, min is 5, and max is unlimited.
# Zero disables rsh altogether.
rsh-open-timeout=

# Sets the version number Pine will use as a threshold for offering
# its new version message on startup.
new-version-threshold=

---

From: "Glynn, Chadwick" <[email-masked]>
Date: Sat, 12 Apr 1997 10:28:23 -0400 (EDT)

> I'm composing my lengthy message on the, everybody can read the 

	Well, more precisely, *any* file you create can be read or copied 
by any other user on the system if you have a umask of 022. This is *not* 
a bug with pine. Why not re-set your umask? Enter "umask 77" for it 
only to be readable only by you. Even better, to save yourself the typing 
in the future, put "umask 77" in your .login or .cshrc file.

	Again, this is *not* a bug in pine.

				Chad Glynn

---

From: Edward M Greshko <[email-masked]>
Date: Sat, 12 Apr 1997 23:35:24 +0800 (GMT)

> 	Again, this is *not* a bug in pine.

	I beg to differ.  umask only controls the "initial" vaule of the
file permissions.  Any program should then change the permissions, if
prudent, to reasonable vaules for in order to maintain the security of the
information.  A mail program should not leave it up to the user to ensure
their system is configured to makeup for the mail program's faults. 
Indeed the user may *not want* the default mask to be as restrictive as it
should be for mail programs. 

	That said, I started to compose an email with pine and then
simulated a communications failure.  I did not see the exact same
situation as described by the first individual.  However, pine did
leave a file in my home directory (.pine-interrupted-mail) with
permissions of 644.  This, IMNSHO, is *very bad*.

	Regards,

		Ed

-- 
Edward M. Greshko                  Technical Manager, Electronic Commerce
                                   Control Data Asia/Pacific Region
Voice: +886-2-715-2222 x287        6/F, 131 Nanking East Road, Section 3
FAX  : +886-2-712-9197             Taipei, Taiwan R.O.C

---

From: Robin S Socha <[email-masked]>
Date: Sat, 12 Apr 1997 17:43:23 +0200 (MET DST)

-----BEGIN PGP SIGNED MESSAGE-----

  >I think I found a really annoying bug in Pine 3.96. (Even 3.95) 
  
*rotfl*  
  
  >files in my home directory, I find a file named: #pico00023# where 00023
  >is pine's process id. 

Are you sure it doesn't happen with shorter files? Just to make sure, type
500 hundred messages with the following line in the body:

"I shall RTFM before I post. I shall not spread rumours. I shall man bash."

Maybe it'll go away (many bugs have vanished this way in the past...).

  >The problem is that it creates this file according to my umask! :( I have
  >my umask set to 022

KeWL... Since you know how to do it, why don't you go ahead and set it to
.077 generally? Your .<shell>rc would seem a good place for that ;->

  >, that means while I'm composing my lengthy message on the, everybody can
  >read the message I'm sending! This is what I thought of:

A "front-end script"? Woah! Can I have one, too? (BTW, I've never thought of
pine as part of VR)

  >first).
  
K. Hack it, make a patch, submit it --- done. What's all the fuzz about,
anyway? Pico sucks, almost everyone agrees on that, especially Sven "vim"
Guckes and Robin "Joe" Socha >:-> If you want to use pine "professionally",
you'll probably need another editor, anyhow. You've got emacs as your
alternate editor --- set it up to store the tmp files in a "secure"
directory...

AND...
Even if it had been a bug, submitting the report to the list first
doesn't seem the best option imnsho. Ever tried M(ain), B (Report Bug)?

Have a nice weekend,
Robin

- -----
Robin S. Socha,
Political Science Dept., Bonn University, Bonn
Key fingerprint = 7F F2 84 73 CF E9 2C 92  F6 6E F9 B4 8F FE AC 1E
To get my pgp public key, send an e-mail with the subject "get pgp-key"

GMC d++ s+:+ a- C++ UL++$>+++$ P+>++$ E>+ W- N+ o@ w--- M-- PS--- PE+++ Y+
PGP++>+++ t+() 5-- tv++(+) b+++ DI++ D+(++) G++>+++ e++>+++ h r++>+++ y+**

---

From: Hussam Husain Qasem <[email-masked]>
Date: Sat, 12 Apr 1997 13:46:15 -0500 (EST)

> in the future, put "umask 77" in your .login or .cshrc file.

I do WANT people to read files *I* create, but I do *NOT* want them to 
read my mail! I *DO WANT* my umask to be 022.

> 	Again, this is *not* a bug in pine.

Yes, when people can read your personal stuff, then that's a bug.
Have you noticed (even when setting your umask to 000), when you first 
invoke pine, it'll create a ~/mail directory with permisson 700 ??!
Now you've got to tell me, one of them has to be a bug.

Hussam

---

From: Hussam Husain Qasem <[email-masked]>
Date: Sat, 12 Apr 1997 13:56:43 -0500 (EST)

> 500 hundred messages with the following line in the body:

From: http://www.washington.edu/pine/pine-info/96.04/msg00270.html
+--------------------------------------------------------------------------
|     As far as Pico as part of Pine is concerned, in 3.92 it is automagic
| that there is a file checkpointed every 200 keystrokes.  As I compose this
| message, I see the following file increasing in size...
| -rw-rw-r--    1 core     hackerz      766 Apr 10 14:47 #pico00642#
|     This file contains most of the contents of this message.
| 

Oh... how nice! (It's even writable by the group!) I like that...

> .077 generally? Your .<shell>rc would seem a good place for that ;->

My problem is not changing the umask. I want my umask to be 022. But I 
don't want people to read the messages I send!! 
If creating the file ~/#pico00023# with permissions as my umask is 
considered a feature, whey the file ~/dead.letter it creates is set to 600?
I need an explanation. It is a bug.

Besides people, before flaming at my message, so for *NO ONE* has 
answered me with a solution. Did any one notice, I had another part in my 
message??

Hussam

---

From: Peter Karlsson <[email-masked]>
Date: Sat, 12 Apr 1997 21:35:17 +0200

On Sat, 12 Apr 1997, Paul O Bartlett wrote:

>     So writing the checkpoint file is certainly not a bug.  As for
> using your umask, how else should Pine do it to set permissions? 
> Guess?  Roll dice?

Well, since it creates the "mail" subdirectory (for its mail folders) with
a umask of 077, *IMHO* it would only seem reasonable that it would save
the checkpoint files with the same permissions. Why should the work in
progress have other permissions than the ones that are finished (i.e saved
to the folders)?

-- 
\\//
Peter - http://nafmo.home.ml.org/ - ICQ UIN 762719
      - Association Against Big .sigs

---

From: Edward M Greshko <[email-masked]>
Date: Sun, 13 Apr 1997 08:38:28 +0800 (GMT)

> .077 generally? Your .<shell>rc would seem a good place for that ;->

	I believe you are missing the point.

	A mail UA should have security in mind.  Thus, it should have the
where-with-all to ensure that any of the files it creates (or programs
called on its behalf create) have the proper access rights to provide the
level of security one would expect from a UA.

> A "front-end script"? Woah! Can I have one, too? (BTW, I've never thought of

	It isn't polite to make mock of a proposed work-around to a bug
or even a preceived bug.  

	If you like chocolate milk on your corn flakes and others made
fun of it....how would you feel?

> doesn't seem the best option imnsho. Ever tried M(ain), B (Report Bug)?

	So, you think all problems should simply be sent in as a bug
report and not discussed on this list?  Don't you think that is 
counter productive?  I'd rather hear about what others have found and
consider a bug than to have to find them all myself.

	Regards,

		Ed

---

From: [email-masked]
Date: Sun, 13 Apr 1997 00:44:36 GMT

On Sat, 12 Apr 1997 11:13:06 -0400, Paul O Bartlett
<[email-masked]> wrote:

>Guess?  Roll dice?  umask exists for setting permissions by default. 
>If you have your umask set to 022, it seems a reasonable assumption for
>Pine to use that when writing a file.  I don't think this is a bug at
>all, but rather a plausible feature of the design of Pine.  You could
>always reset your umask before starting Pine.

	I don't believe the original poster classified writing the
checkpoint file as a bug.

	It is certainly *not* reasonable for any program which should
have security in mind to simply use whatever is set as the umask when
writing files.

	It is unreasonable to suggest that every program being run
have as part of its instructions, "remember to set your umask to XX
and and then set it back to what you want for other operations".

	Ed

---

From: Christopher Hicks <[email-masked]>
Date: Sun, 13 Apr 1997 01:31:33 -0400 (EDT)

The script that was presented doesn't make tons of sense to me.  Why not
just have a script (or alias) called 'mypine' (or whatever) that does the
umask then runs pine?  The umask doesn't (AFAIK or could imagine) carry
back to the shell that this was invoked from. 

</chris>

"He is one of the best teachers I have had... He is well-organized,
 presents good lectures, and creates interest in the subject.  I
 hope my comments don't hurt his chances of getting tenure."

---

From: [email-masked] (Vikas Agnihotri)
Date: 14 Apr 1997 16:34:43 EDT

On 14 Apr 1997 12:05:59 GMT, Sven Guckes <[email-masked]> wrote:
>[email-masked] (you-know-who-you-are):
>> Robin S Socha ([email-masked]) flamed: [...]
>> I'm sure glad that there's people like you around that I can use as bad
>> examples of humanity to my kids. You're a punk who's mother and father
>> should have bent you over thier knees for a hard spanking whenever you came
>> up with your stupidity and dis-respect. They obviously were bad parents
>> who didn't do their jobs well, and you're a dis-respectful little brat.

>  I'm sure glad that there's people like you around that I can use as bad
>  examples of a broken Pine setup to other Pine users. etc etc

>Don't bother posting before you have learnt how to configure Pine correctly,
>Mrs "[email-masked]".  Followup-To: alt.mail.users.pine.and.whine

Well, from the Mesage-Id: header, it is apparent that
[email-masked] has NOT used PINE to post this to Usenet. Unless of
course, there is a way to have Pine NOT generate the Message-Id: header, but I
would think that involves some serious hacking with Pine/sendmail, etc.

So given that, your admonition about 'configure Pine correctly' is really
quite uncalled for. Or didnt you see the Message-Id: header before you blasted
off? 

Guys, please. Lets have some more tolerance here for the newbies. If you do
want to flame someone, do it by private email, thus displaying the fact that
YOU are not a newbie. 

For the record, I too, didnt like Robin's strong tone and thought it was
downright rude and insulting

Vikas

---

From: Robin S Socha <[email-masked]>
Date: Tue, 15 Apr 1997 03:39:32 +0200 (MET DST)

-----BEGIN PGP SIGNED MESSAGE-----

On 14 Apr 1997, Vikas Agnihotri wrote:

Either this is a misquote, or someone forged my header. Note that I'm using
pgp in *every* post, so if it doesn't have a sig, it's NOT mine. Thank you.

- -----
Robin S. Socha,

---

From: "Glynn, Chadwick" <[email-masked]>
Date: Mon, 14 Apr 1997 23:32:55 -0400 (EDT)

On Sat, 12 Apr 1997, Hussam Husain Qasem wrote:

[snip]
> Now you've got to tell me, one of them has to be a bug.

	I really cannot believe where this thread has lead to. I can't 
believe you call yourselves professionals with all this nonsense. 

	Mr Qasem stated that because pine does not automatically make its 
pico files readable only to its creator, it must be a bug. Hopefully all 
of us can agree this is not programming bug (which causes internal 
errors, crashes, and fuzzy warm stuff like that). Security bug? No, it 
this isn't either. 

	Why? 

	Well, everyone *should* know that there is no such thing as foolproof 
security, and that every user has a responsibilty of their own security. 
Clearly, most of the people here don't realize that. Applications can only 
assume so much about the individuals responsiblty of security. The user 
can't assume every application is going to take care of their security 
for them, but obviously most of you here do that. 

	Ok, so if this is not a programming bug or a security bug, then 
what is it? I would call this a "preferental" bug because this does not 
effect everyone on the same platform. It does not effect me, but it does 
effect people with a conflicting security ideology.  

	Let me review the background again... Mr Qasem has a umask of 22 
because he wants people to read his files, yet he is having a hissy fit 
because pine refers to the umask when is creates a file when he is 
composing a long email. This is *not* a good security stance at all. Its 
very conflicting. 

	Mr Qasem, the only two reasons I could come up with why you would 
want people to read all of your email was because you are sharing 
educational-related file (you are a student or instructor at indiana 
university) or you have files for your web page. If the files are 
education related, put them on your systems shared directory, which is 
usually /usr/share (which any competent adminstrator at a institution 
should have set up, and willing to assist you). If the files are for a 
web page, the standard is to put them in a sub directory (bus_html, etc) 
off of your home directory with the directory and its files the only 
files around with 755 permissions. Either way, you would need to change 
your umask. If the files dont fall in either two of these categories, 
then find another solution, which includes changing your umask. 

	I talked this over with a friend, who is more of a security and 
unix expert than I, and he thinks the same. You don't want to hear what 
he tought of some of responses on this thread. :)

	In other words, I'm behind Robin. From watching this list for a 
number of months, Robin is clearly competent in the field.

			Chad

---

From: Christopher Hicks <[email-masked]>
Date: Tue, 15 Apr 1997 01:02:35 -0400 (EDT)

> believe you call yourselves professionals with all this nonsense. 

Given that you're ignoring a valid user complaint we can reasonably place
you in the category of 'computer professional'.

> 	Mr Qasem stated that because pine does not automatically make
> its pico files readable only to its creator, it must be a bug. Hopefully
> all of us can agree this is not programming bug (which causes internal

Actually it is both.  The program should be consistant wherever possible.

> 	Well, everyone *should* know that there is no such thing as
> foolproof security, and that every user has a responsibilty of their own
> security.  Clearly, most of the people here don't realize that.
> Applications can only assume so much about the individuals responsiblty
> of security. The user can't assume every application is going to take
> care of their security for them, but obviously most of you here do that.

That's WAY off base.  I DON'T assume every application is going to take
care of security for me.  That's why I read the source code for many
things.  Pine hasn't been one of them because I've found it to be rather
consistant and unbroken.  That applications "can only assume so much" is
not being violated by the perception many of us have about whether this is
a bug or not.  Pine already assumes "so much" in creating the mail
directory.  It should do this for other temporary files as well.

> effect people with a conflicting security ideology. 

If its a 'preference' bug (which its not) then the behaviour should be
controllable and optional.

> composing a long email. This is *not* a good security stance at all. Its

No.  Email is often vastly more private than the rest of what I do.  I can
always change the permissions on a specific directory to protect something
if necessary.

</chris>

---

From: [email-masked] (Dana Booth)
Date: Tue, 15 Apr 1997 02:39:26 GMT

: [email-masked] (you-know-who-you-are):

: Don't bother posting before you have learnt how to configure Pine correctly,
: Mrs "[email-masked]".  Followup-To: alt.mail.users.pine.and.whine

I don't use Pine to post to the newsgroups, and I intentionally leave
my real address out of the 'from:' line to prevent computer generated
junk mail. Anyone live person wishing to email me can do so to the
address listed in my sig.

Anyway, I think that you're due back in boystown, better get a move on,
sonny.

--

----------------------------
Dana Booth <[email-masked]>
----------------------------

---

From: Hussam Husain Qasem <[email-masked]>
Date: Tue, 15 Apr 1997 03:22:14 -0500 (EST)

> believe you call yourselves professionals with all this nonsense. 

I didn't call myself a professional. I'm learning, and will always be. 
And that is *why* I posted to the forum in the first place.

> errors, crashes, and fuzzy warm stuff like that). Security bug? No, it 

Ok, well, I apologize for putting it in the wrong "bug" category. Maybe I 
should've stated: it's a Bad Thing (tm).

> for them, but obviously most of you here do that. 

I agree with you, but this is a "mailing" program, and it should preserve 
that while I'm reading, composing, deleting, my mail, nobody should read 
my mail.

> composing a long email.

That's right, I want to people read my files, not my mail.

> university) or you have files for your web page. 

Again, I don't want them to read my mail. Anything I'ld like to share 
with other people, is put in a directory with the right permission. (That 
includes my web page). But again, I do not want them to read my mail.
Perhaps I was mailing a student his grade, perhaps I was writing a test, 
I do not want people to read my mail.

Let me give you an outline of my problem again:
1) I want my umask to be 022
2) I do not want people to read my _mail_
3) Pine makes people read my mail!!

Here's the best solution I found (so far):
+--------------------------------
| alias   pine    (umask 022; pine)

> number of months, Robin is clearly competent in the field.

I'm sure he is... Ok, how about forget about the first part of my 
message, and reply to my other questions? ;)
I had question about how to make new versions of Pine scroll page by 
page, rather than line by line when I reach the end/beginning of a page.

Thanks again for all of those who have responded.

Hussam :)

-- Hussam Husain Qasem                                 +--+/|
-- [email-masked]                                  |  | |
-- http://www.cs.indiana.edu/~hqasem/                  +--+/

---

From: Mike Brudenell <[email-masked]>
Date: Tue, 15 Apr 1997 10:15:54 +0100 (BST)

Hi -

> page, rather than line by line when I reach the end/beginning of a page.

Ummm... if you take a quick glance at the Command Menu at the bottom of
the screen whilst reading a message you'll see:

                                      vvvvvvvvvvvv
? Help       M Main Menu  P PrevMsg     - PrevPage    D Delete      R Reply
O OTHER CMDS V ViewAttch  N NextMsg   Spc NextPage    U Undelete    F Forward
                                      ^^^^^^^^^^^^

(Feeble attempts at highlighting mine.)

In particular:

	- and SPACE	Move you by whole pages (screenfuls)

	Up and Down Arrows
or	^N and ^P	Move you through the message one line at a time

Incidentally, you may also like to check out the following in the Setup
Configuration screen:

	viewer-overlap           = <No Value Set: using "2">
	scroll-margin            = <No Value Set: using "1">

The former lets you set how much overlap there is between screenfuls when
you move between them using - and SPACE (the default is 2 lines).  The
latter lets you say how close to the top/bottom of the screen you must
drive the cursor with the Up/Down Arrow Keys before it scrolls.

Better information is available in the on-line help for these: just put
your cursor on one of them and give the Get Help (^G) command.

Cheers,

-- 
Mike Brudenell                                         <[email-masked]>
------------------------------------------------------------------------
The Computing Service, University of York, Heslington, York, YO1 5DD, UK
Tel: +44-1904-433811  FAX: +44-1904-433740  http://www.york.ac.uk/~pmb1/

---

From: [email-masked] (Sven Guckes)
Date: 14 Apr 1997 12:05:59 GMT

Sven

---

From: Hussam Husain Qasem <[email-masked]>
Date: Tue, 15 Apr 1997 19:24:55 -0500 (EST)

> O OTHER CMDS V ViewAttch  N NextMsg   Spc NextPage    U Undelete    F Forward

In older versions of Pine, when you reach the end/top of a page, the 
defaults was to scroll page by page when hitting ^N and ^P. Well, how can 
I change the new versions of Pine to behave that way. I'ld like to use 
the same key when I reach the bottom/top rather than hitting Space and '-'

Thanks again,

Hussam

---

From: Terry Gray <[email-masked]>
Date: Tue, 15 Apr 1997 20:33:05 -0700 (PDT)

Hussam,
Please note that in the Index view, ^P and ^N behavior was changed in
order to provide a *choice*... Use P and N (no control) if you want the
page-at-a-time behavior.

-teg

---

From: Hussam Husain Qasem <[email-masked]>
Date: Tue, 15 Apr 1997 23:10:14 -0500 (EST)

> order to provide a *choice*... Use P and N (no control) if you want the

Great! That's exactly what I was looking for! :)

Thanks a lot!!

Hussam

---

From: [email-masked] (Sven Guckes)
Date: 15 Apr 1997 09:18:18 GMT

[email-masked] (Dana Booth):
> : Don't bother posting before you have learnt how to configure Pine correctly
> I don't use Pine to post to the newsgroups, ...

Rading this and Vikas followup I checked upon the header of your post again:

	X-Newsreader: TIN [version 1.2 PL2]
	Message-ID: <[email-masked]>
	References: <[email-masked]>

Guess I must have seen the Pine id in the References: while I was editing my
followup instead of looking at the Message-ID of your post.
Yes, you are obviously not using Pine, but tin.
I stand corrected.  Apologies!

> ... and I intentionally leave my real address out of the 'from:'
> line to prevent computer generated junk mail.  Anyone wishing to
> email me can do so to the address listed in my sig.

But I still don't like that nospam address attitude.  ;-)

Sven