Mailman 3 October 2008 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

"Orignal" MySQL Member Adaptor - 1.71
by Kyrian (list) 08 Jan '09

08 Jan '09

All, I finally managed to find some vestige of free time after midnight (hardly the best time to be coding...) recently, and accordingly put out a new version of my MySQL MemberAdaptor. I have no time, and little motivation (no customers wanting to use it at the present time) to test it, so I haven't, but you're welcome to try it out. It should according to the docs I found, provided I've applied them correctly, fix the non-ASCII character encoding problems (I've relied on the assertions about list members to cover that angle, and just checked encoding on the 'user supplied' parameters to various function calls). Now would be a good time for someone to send me a Python language reference book ;-) However since I've changed development environment since the last version, it's possible that various things have gone wrong (certainly the version numbering has gone mad between RCS and CVS/Eclipse), so don't do it in a production environment. I've put it here, as version 1.71, whatever that might actually mean: http://www.orenet.co.uk/opensource/MailmanMysql/ Incidentally, since Fil seems to be taking all the credit for what I started I think he should actually put a proper credit in there for me, linking to my business website at http://www.orenet.co.uk/ rather than the vague passing mentions that are in the docs/code of his version of the system at the present time. With luck I will be able to coax one of my customers into 'sponsoring' further development of the MySQL Adaptor with proper integration into Mailman in a sane way that is agreed by everyone instead of (as seems to be the case from what little of this list I have had time to read) just going off on its own sweet way and reducing the likelyhood of acceptance into the main code base of Mailman, but I am not sure how that will go. If anyone else wants to sponsor my time to code this thing better and further, then just email me. Best of luck with it, whatever happens. More updates in whichever year I manage to find spare/free time. Yours Sincerely, Kev Green.

7 19

Mailman 2.1.x + Python 2.6 ?
by Heiko Rommel 31 Oct '08

31 Oct '08

Hi, as there is no released version in the 2.2 and 3.0 trees version 2.1.11 appears to me the best choice for production environments. Unfortunately, it does not run with Python 2.6 for several reasons - which brings the project in a difficult situation in medium-term. I prepared a fix for the md5/sha deprecation - but only to run into a the email.message issue (mentioned in another thread). How much pain can I expect on the path to make it work with Python 2.6 ? I am pretty sure that Barry or Mark already investigated to some extend. Please share insight :) -- Heiko Rommel rommel(a)suse.de SUSE LINUX Products GmbH, Maxfeldstr. 5, D-90409 Nuernberg T: +49 (0) 911 74053 0 F: +49 (0) 911 741 77 55

2 2

Headers in administrative messages
by Kenneth Porter 10 Oct '08

10 Oct '08

It might be nice to get the List-id header in messages to the administrator. I have a spam white-listing rule for list messages and I'm finding some of my auto-discard notifications are ending up in my spam folder instead of my administrator folder because they lack the list id pattern I use to white list. It might also be nice to have some kind of digital signature header that signs another dynamic header, such that an admin or regular list recipient can check the signature to verify that it's really from the list.

2 2

Looking for Help
by Thomas M Foley 07 Oct '08

07 Oct '08

I have a client who is looking to move to an In-House mailing system. They are currently using a commercial web company called vertical response, http://www.verticalresponse.com. They would like some assistance in developing some back end tools and interface to do tacking on their mailings. If someone out there is interested in working with us on this project, please let me know. You can call my office or send me back an email. The client is ready to move forward and any help would be appreciated. I would prefer to go with Mailman on this project. I think it can handle what they want to do, but I just need help on the backend and interface. Thanks in advance. Thomas M Foley TMF Consulting LLC 212.473.2325 O thomas(a)tmfconsulting.net

2 1