Mailman 3 April 2008 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

GNU Mailman Site Redesign
by Satoshi Tanabe July 23, 2008

July 23, 2008

Hello, Currently I'm creating an unofficial site of GNU Mailman. It's not done yet, but the goal is to make the current official site more accessible and usable. The content is almost the same. The unofficial site (since Google Page Creator doesn't support folders, images are not shown and linked docs are not available): http://gnu.mailman.googlepages.com/index.html You can download the source tarball here (with linked docs): Source Tarball (size: 1.1mb) http://gnu.mailman.googlepages.com/Mailman-Site-Redesign.tar.gz This site tries to solve the problems that I listed in the following document: What's wrong with the current Mailman official site? http://gnu.mailman.googlepages.com/wrong.txt I'd love to have your feedback. Also, I listed several questions in the document above, so I'd appreciate if any of you could answer or comment on them (Some questions are not about the official site per se). Best, - Satoshi

12 33

Re: [Mailman-Developers] [Mailman-Users] Encrypted mailing lists
by Barry Warsaw July 3, 2008

July 3, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm moving this discussion to mailman-developers. On Mar 30, 2008, at 2:39 PM, Alster wrote: > > I have been repeatedly tempted to sum up options of setting up > encrypted > mailing lists, with or without using GNU Mailman. > > As such, only these options listed in my previous summary remain: > > * mailman-ssls, a Mailman-Patch which has recently been updated for > Mailman 2.1.9 compatibility: > http://non-gnu.uvt.nl/mailman-ssls/ > > * firma, a standalone encrypted mailinglist server (written in bash): > http://codecoop.org/projects/firma/ > > > Additionally, there are these options which had not been part of the > last overview: > > * MMReencrypt, another Mailman patch > https://sourceforge.net/projects/mmreencrypt/ > no longer maintained > > * Schleuder, a standalone 'crypto mailinglist' > http://codecoop.org/projects/schleuder/ > still maintained (according to their versioning system), but last > release dates back to 2006 I don't have time right now to look at these, however I would really like to support some form of encrypted mailing lists for Mailman 3, if not also 2.2. It isn't possible to add this feature to Mailman 2.1. If you're interested in working on this, it would be good to capture some requirements and use cases in the wiki. If you wanted to do a survey of the approaches and implementations that have gone before, that would also help. Ideally, some folks would be motivated enough to start developing some branches in Bazaar so that we can take a look, with an eye toward supporting the feature officially in a future release. Feel free to discuss further on this mailing list. - -Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkf+l2EACgkQ2YZpQepbvXFFBQCdFY+07fgyROIVGUVInd1+Zhph HBkAnjuh78SV2DzvEtchN0CAFLeoXkjE =iaw1 -----END PGP SIGNATURE-----

3 2

Important Mailman 2.1.9 to 2.1.10 upgrade note.
by Mark Sapiro May 19, 2008

May 19, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Actually, this note really applies to just restarting mailman a Mailman 2.1.9 installation, with or without upgrading to Mailman 2.1.10. But in installations that just 'run' without intervention, this restart may not occur until an upgrade. There is an error in Mailman 2.1.9. In the introduction of the backup and recovery of queue entries, we neglected to remove the backup queue entry for an unparseable message. Thus, if you sometimes receive unparseable messages which are ignored, you may have an accumulation of .bak files in qfiles/in from these messages. When you restart Mailman, these will all be reprocessed, resulting in a flood of error log entries. There is no real harm done, but it would be a good idea when upgrading to stop Mailman and remove any qfiles/in/*.bak files. - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFIDgCwVVuXXpU7hpMRAlOyAJ4/VpFnCL9JHoEBSl4PmZIBowTbigCgjjRr Bh8FoeuGZDAXonphAnvqwMA= =qt1K -----END PGP SIGNATURE-----

7 15

request for Mailman dev consultant
by Victor Aquino April 23, 2008

April 23, 2008

Hello. We are in search a Mailman application developer to help with one of our clients. Our client's site is tightly integrated with Mailman list software and the server environment has been highly customized to enable Apache processes to execute high-level mail configuration commands both within Mailman and Sendmail. This custom integration has been problematic to support for us. Our client does not want to automatically reject messages if addresses are not in their list servers because they want it to be 'user-friendly' to their clientèle. Our client also only moderates when an attachment is too large or something else is out of whack. Of course, spam is a huge problem that has crippled this workflow and we basically cannot even go in and delete. We're looking for help and guidance and would like to contract this out. Thank -- <http://www.dystrick.com> *Victor Aquino* Project Manager dystrick design, Inc. 675 North First St., Suite 280 San Jose, CA 95112 *office:* 408.286.6952 ext. 314 *fax:* 408.904.5019 vaquino(a)dystrick.com <mailto:vaquino@dystrick.com> http://www.dystrick.com

1 0

Mailman 2.1.10b4 Released
by Mark Sapiro April 23, 2008

April 23, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am happy to announce the next beta release of Mailman 2.1.10. This is a security and bug fix release and it is highly recommended that all sites upgrade to this version. Mailman 2.1.10 also adds support for three new language translations, Galician, Hebrew and Slovak and a few new features. Mailman is free software for managing email mailing lists and e- newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, including download links, please see: http://www.list.org http://mailman.sf.net http://www.gnu.org/software/mailman Special thanks are due to Barry Warsaw and Tokio Kikuchi for much coding and support, Moritz Naumann for help with security issues and Jim Tittsler for a significant patch. Here's a list of the major changes. Security - - The 2.1.9 fixes for CVE-2006-3636 were not complete. In particular, some potential cross-site scripting attacks were not detected in editing templates and updating the list's info attribute via the web admin interface. This has been assigned CVE-2008-0564 and has been fixed. Thanks again to Moritz Naumann for assistance with this. New Features - - Changed cmd_who.py to list all members if authorization is with the list's admin or moderator password and to accept the password if the roster is public. Also changed the web roster to show hidden members when authorization is by site or list's admin or moderator password (1587651). - - Added the ability to put a list name in accept_these_nonmembers to accept posts from members of that list (1220144). - - Added a new 'sibling list' feature to exclude members of another list from receiving a post from this list if the other list is in the To: or Cc: of the post or to include members of the other list if that list is not in the To: or Cc: of the post (Patch ID 1347962). - - Added the admin_member_chunksize attribute to the admin General Options interface (Bug 1072002, Partial RFE 782436). Internationalization - - Added the Hebrew translation from Dov Zamir. This includes addition of a direction ('ltr', 'rtl') to the LC_DESCRIPTIONS table. The add_language() function defaults direction to 'ltr' to not break existing mm_cfg.py files. - - Added the Slovak translation from Martin Matuska. - - Added the Galician translation from Frco. Javier Rial Rodríguez. Changes since 2.1.10b3 include the Galician translation and updates to the French translation (Vietnamese and Danish translations were updated in 2.1.10b3). Other changes since 2.1.10b3 include: - - In 2.1.9, queue runner processing was made ~ more robust by making backups of queue entries when they were dequeued ~ so they could be recovered in the event of a system failure. This ~ opened the possibility that if a message itself caused a runner to ~ crash, a loop could result that would endlessly reprocess the message. ~ This has now been fixed by adding a dequeue count to the entry and ~ moving the entry aside and logging the fact after the third dequeue of ~ the same entry. - - Fixed the command line scripts add_members, sync_members and ~ clone_member to properly handle banned addresses (1904737). - - Fixed bin/newlist to add the list's preferred language to the list's ~ available_languages if it is other than the server's default language ~ (1906368). - - Changed the first URL in the RFC 2369 List-Unsubscribe: header to go ~ to the options login page instead of the listinfo page. - - Changed the options login page to not issue the "No address given" ~ error when coming from the List-Unsubscribe and other direct links. ~ Also changed to remember the user's language selection when ~ redisplaying the page following an error. /Mark Sapiro - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFH2eJuVVuXXpU7hpMRAihOAJ4zIREWCWCQt7YDDHp3frDHjzwkCQCfdh7J W3UKWsTTfStBE4z64oqa36c= =ZedT -----END PGP SIGNATURE-----

4 23

Spammers forging addresses for subscribe/unsubscribe
by Justin Long April 19, 2008

April 19, 2008

Greetings, we used to have a situation where a spammer would do the following with qmail: (1) spammer send a message FROM someone (forging their address) TO an invalid address on our server CONTAINING spam (2) our server sees the address is invalid (3) our server BOUNCES error message CONTAINING original message (including spam) FROM us TO the forged address (which was the apparent from address) thus making us a spam source. (Ingenious.) Since we have moved to postfix/mailman, we are now encountering a different situation, also probably arising from spam (1) spammer sends a message FROM someone (forged) TO a range of addresses which include the -subscribe and/or -unsubscribe address (2) mailman BOUNCES confirmation message TO forged address FOR -subscribe/unsubscribe, this may include the spam (as part of the notification) (3) sometimes, if the address is invalid (dead address), we get a bounce back saying the address is no good, which gets caught in the "uncaught bounce" cycle. (4) sometimes, if the address is valid and its to the -subscribe address, the person gets spammed. Is there a way in mailman to do the following - and if not, I'd like to submit these ideas for implementation or adjustment (1) bounces from subscribe requests should not include the original message (2) unsubscribe requests should be dropped if they come from an address which is not a member You can't really tell if a subscribe request is valid or not, but at least the attachments could be stripped out... Cordially, Justin Long -- Never retreat. Never surrender. Never cut a deal with a dragon. ------- Justin Long / justinlong(a)gmail.com http://www.strategicnetwork.org - 120,000 subscribers, 16,000 articles http://www.momentum-mag.org - bi-monthly magazine on unreached peoples http://www.momentum-mag.org/wiki - Missiopedia of Christian missions MSNIM justinlong(a)strategicnetwork.org / Skype nsmjustinlong ------- We help people build 6 things: Drive, Energy, Effort, Inspiration, Power, Strength ------- No armor? Unclean life? Then do not mess in the affairs of dragons, for you are crunchy and taste good with ketchup.

2 2

ANNOUNCE: GNU Mailman 3.0a1 (Leave That Thing Alone)
by Barry Warsaw April 14, 2008

April 14, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 After far too long, I'm finally happy to announce the availability of GNU Mailman version 3.0 alpha 1, code name "Leave That Thing Alone". Hopefully, I needn't point out that this version is not suitable for production. Instead, I'm making it available to provide an early snapshot of where Mailman 3 is going, and to give interested developers, users and integrators something real to play with. I am looking forward to your feedback and contributions, and I hope you will at least download the package and give what works a try. For now, I would prefer if all discussion about 3.0a1 were held on the mailman-developers mailing list. Please don't submit bug reports to SourceForge; it's far too early for that. Ideally, you'll be interested enough to create your own branches and push them to Launchpad for all of us to look at. For detailed information on 3.0a1, please read docs/ALPHA.txt. This will explain what works and what doesn't, how to run the test suite and how to actually create, populate, and deliver to some mailing lists. Much does not yet work, but everything that does work is very well documented using Python's doctest framework. Please note that Python 2.5 is required, but a C compiler is no longer needed. You will need some third party packages, but everything you need is available in the Python Cheeseshop. You can download both the tarball and egg file for 3.0a1 from the Cheeseshop as well: http://pypi.python.org/pypi/mailman/3.0.0a1 You'll probably want the source tarball. I hope you will find this first snapshot useful and encouraging. Please participate! Enjoy, - -Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkf8JbMACgkQ2YZpQepbvXGtxgCguOrVEuZ61VnCe86nwkWHXGBm b7sAoLn2fUbRLDmRdWusYxfsAu21FAxw =eiPc -----END PGP SIGNATURE-----

6 14

Google Summer of Code - Spam Defense
by Timo Wingender April 14, 2008

April 14, 2008

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I like to participate in Google Summer of Code this year. One possible Project for me is to implement some Spam Defense in Mailman. I think development for Mailman should be possible through Python Software Foundation. Am I right with this? I administrate a Mailman installation with about 100 lists and thousands of users and I moderate most of the Lists. I think the biggest Problem of Mailman is the lack in spam defense. Discard messages from nonmembers is no option on most lists. Some time ago I began some modification of Mailman. But I never finished it. The first action is to integrate support for SpamAssassin in Mailman. Therefor I wrote a python class spamc which connects to spamd. This gives the possibility to scan all incoming Mail. Further ideas for spam defense are: - - Add the possibility to scan all messages form nonmembers half an hour later again before mark them as hold. This is because most of the mails which are not recognized as spam are to new. The servers are not in any blacklist at time of incoming. - - Train the bayes filter from Mailman. Forward all accepted Messages to SpamAssassin to learn them as ham. The autolearn feature of SA doesn't work for me. It learns to much false negatives. This are my ideas so far. Is this welcome in Mailman and is it enough for an GSoC Project? Where would it be best? 2.1.11? 2.2.0? 3.0.0? Best Wishes Timo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFH67yiakDbqHKnrh8RAhxoAKDYWguLeFxuSAy18sSCXdwWONmdiwCg2YwO W60FvGTr79tAAXZEndPSFSk= =iutB -----END PGP SIGNATURE-----

12 39

Question on pulling list variables
by Justin Long April 11, 2008

April 11, 2008

Greetings, this may be entirely the wrong place to ask this question, and if so I apologize. While integrating mailman with our website, I am trying to integrate in our browse mode. When browsing lists, we generally try to show users the following pieces of data: Mailing List Subscriptions Postings Publicity Access (listname) (moderated/open) (moderated/open) (advertised/not) (person's access to the list) The only way I can see to pull this data is by using config_list. I've actually recoded this (my_config) to drop the comment fields since all I need is the variables and the values. But really, I only need very specific variables and values. Has anyone come up with a simple way to either (a) directly access the configuration files for a given list from PHP or (b) used withlist (I'm not a Python programmer, so I'm hitting my brain against a wall right now... for anything advanced) to pull specific variables? Is there a patch or some little piece of open source code somewhere that can help me with this problem? Config_list seems to work ok but it is taking a lot of compute cycles to run it against 20 lists in a row on a browse screen... Cordially, Justin Long -- Never retreat. Never surrender. Never cut a deal with a dragon. ------- Justin Long / justinlong(a)gmail.com http://www.strategicnetwork.org - 120,000 subscribers, 16,000 articles http://www.momentum-mag.org - bi-monthly magazine on unreached peoples http://www.momentum-mag.org/wiki - Missiopedia of Christian missions MSNIM justinlong(a)strategicnetwork.org / Skype nsmjustinlong ------- We help people build 6 things: Drive, Energy, Effort, Inspiration, Power, Strength ------- No armor? Unclean life? Then do not mess in the affairs of dragons, for you are crunchy and taste good with ketchup.

2 1