Mailman 3 March 2005 - Mailman-Developers

Suggestion on Spam
by Rui Correia 06 Mar '05

06 Mar '05

Hi All Would it be feasible to create a feature that would automate a search for a pre-agreed phrase set by list owner typed on each individual email posted to a list? An email would then begin with the pre-agreed phrase, eg: "We all love red wine", which Mailman would have been programmed to recognise. A "reply to" post would be exempt from such. Anyone initiating a new string and forgetting to include the key-phrase would receive an auto-response notification to resend including key-phrase. This would in most cases replace the "your posting is being held for approval", as most lists have open posting for their members. It would be a matter of days before everybody got used to including the key-phrase in their postings - to make life easier, members can even include it in their signature. Rui ________________________________________________ Rui Correia Advocacy, Media and Language Consultant 36 Finch St, Ontdekkers Park, Roodepoort, Johannesburg, South Africa Tel/ Fax (+27-11) 766-4336 Cell (+27) (0) 83-368-1214

4 3

Hashing member passwords in config.pck
by Barry Warsaw 05 Mar '05

05 Mar '05

I think CAN-2005-0202 gives us the opportunity to finally implement what we have long considered an embarrassing exposure in Mailman's config.pck databases. Member passwords are kept in this database in the clear. The obvious fix is to hash member passwords and keep only the hash in the database. We haven't changed this before now for two reasons: 1. We would have to regenerate all member passwords, which is an administrative burden. We might also need to implement checks to see if the passwords were cleartext or hashed and do the password comparison accordingly. 2. This breaks all password reminders. To fully address CAN-2005-0202 we're recommending sites regenerate their member passwords anyway, so this gives us an opening to fix this properly. And we have a better internal password generator now too. As for #2, well, I think most people hate those password reminders anyway, and we've decided that they are going away for MM3. I don't think many people would shed too many tears if we killed off monthly password reminders for 2.1.6. Doing that would also eliminate the requirement for the site list, since its primary purpose is to function as the sender of the reminder messages. To do this for 2.1.6, we'd have to change the "Email My Password To Me" feature in the options page and in the member login page. These would have to become a "create a new password for me" feature. Also, crontab.in should not call mailpasswds anymore, or that script should turn into a simple "here's the lists you are on" reminder, without the password information in it. This will require i18n updates too. The downside to doing this now is that it's more coding work for 2.1.6 and I'd like to get the new version out asap. Still, this seems like an opportunity that we shouldn't lightly dismiss. What do you all think? Is anybody willing to take a crack at a patch for this? -Barry

28 91

Mailman 2.1.6b4
by Barry Warsaw 04 Mar '05

04 Mar '05

Okay, I've pushed the 2.1.6b4 tarball out to SourceForge (now that file uploads are working again ;). I will likely be off-line until Tuesday. -Barry

4 3

Re: [Mailman-Developers] PGP and Mailman
by J C Lawrence 03 Mar '05

03 Mar '05

On Wed, 2 Mar 2005 12:37:41 +0100 Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > True. A session key would be encrypted to each key id, so the key ids > would be visible. However, subscriber information is not too hard to > get from Mailman even when it's supposedly limited to being available > only to the admin, so I think there may be bigger fish to fry > elsewhere. There's also the difference between using a key for a list subscription which is publicly distributed on key servers, and a special-purpose key that you don't otherwise distribute and use for smaller more privacy critical cases. -- J C Lawrence ---------(*) Satan, oscillate my metallic sonatas. claw(a)kanga.nu He lived as a devil, eh? http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.

1 0

[Mailman-Developers] Using an external system to generate passwords, etc..
by Mark Tilden 01 Mar '05

01 Mar '05

I'm wondering if anybody has integrated Mailman's user name/password system with external systems that generate the user names and passwords. I've searched the archives and found a few references to using MySQL or LDAP, but nothing concrete enough to tell if it's actually implemented somewhere. My goal is to integrate Mailman and it's admin pages into a larger site that already has a system of creating user names and passwords (using email addresses as user names). I run several smaller Mailman lists, and we're trying to integrate one of these lists with the existing site. If anybody has any pointers, I'd appreciate it. I've been running Mailman for a couple of years, but haven't dug deeply into the code (and hope to avoid having to...). Thanks! Mark

2 1