Greg, this seems to be two different things. The Show_group_members is for allowing (or not) members of a group to be listed, rather than allowing (or not) the details of an individual member's activity to be listed.
Even with Show_group_members turned off for every group, it's possible to get the subjects of posts of the founder (from the home page link), and of any member who posts in public groups, even posts that are in members-only groups.
Take for example my name at the footer of
http://www.riocoloradoestates.com . Click on it to get a list of all my (test) messages. The "General Discussion" section is a private section, below "Members Only" which is restricted to those in the "members" group. The page clearly knows this, as it marks them as "private" (and, when they're clicked on, the access controls work).
However, I don't think it's intentional for the names of private groups (in this case, "General Discussion"), which would not otherwise be known to non-members, and even the subject of every post of every thread I've contributed to in those private areas, to be visible to all, even those who have never registered.
For my particular application (a message board for a home owner's association), the main aim of privacy in this case is to hide messages like "the Smiths will be away for a month" from burglers etc., which is why even the subject being visible to all is not a good idea.
Others may have more to hide, and not realise the subjects of everything they're discussing (e.g. "Confidential - Our new model will be launched May 5th") or a sub-topic ("Jones takeover plans") are being leaked.
A work-around for those who want their subjects hidden would be to never post anything in any section which is not hidden (or have no public sections at all), because it will reveal their username and give a link to the subjects of all their "hidden" posts (and use a separate, non-posting, id for the creator of the board, as that name can't be removed from the home page). Even then a brute-force attack stepping through the node numbers would get the user info pages eventually.
A solution would be to apply the topic permissions to the subject listing. The user info page already knows these subjects are private (it puts "private" after them), so there's no extra look-up needed. So rather than putting that, it should not show the subject or sub-topic, unless the user looking has the right permissions to see the message contents.
Another solution, maybe simpler, is to put group permissions on the user info pages /template/NamlServlet.jtp?macro=user_nodes&user= , so they can optionally be restricted to being seen by certain groups, rather than visible to even unregistered visitors, as at present.
Rob
Locked
