Mailman 3 June 2008 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

GNU Mailman Site Redesign
by Satoshi Tanabe 23 Jul '08

23 Jul '08

Hello, Currently I'm creating an unofficial site of GNU Mailman. It's not done yet, but the goal is to make the current official site more accessible and usable. The content is almost the same. The unofficial site (since Google Page Creator doesn't support folders, images are not shown and linked docs are not available): http://gnu.mailman.googlepages.com/index.html You can download the source tarball here (with linked docs): Source Tarball (size: 1.1mb) http://gnu.mailman.googlepages.com/Mailman-Site-Redesign.tar.gz This site tries to solve the problems that I listed in the following document: What's wrong with the current Mailman official site? http://gnu.mailman.googlepages.com/wrong.txt I'd love to have your feedback. Also, I listed several questions in the document above, so I'd appreciate if any of you could answer or comment on them (Some questions are not about the official site per se). Best, - Satoshi

12 33

Re: [Mailman-Developers] [Mailman-Users] Encrypted mailing lists
by Barry Warsaw 03 Jul '08

03 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm moving this discussion to mailman-developers. On Mar 30, 2008, at 2:39 PM, Alster wrote: > > I have been repeatedly tempted to sum up options of setting up > encrypted > mailing lists, with or without using GNU Mailman. > > As such, only these options listed in my previous summary remain: > > * mailman-ssls, a Mailman-Patch which has recently been updated for > Mailman 2.1.9 compatibility: > http://non-gnu.uvt.nl/mailman-ssls/ > > * firma, a standalone encrypted mailinglist server (written in bash): > http://codecoop.org/projects/firma/ > > > Additionally, there are these options which had not been part of the > last overview: > > * MMReencrypt, another Mailman patch > https://sourceforge.net/projects/mmreencrypt/ > no longer maintained > > * Schleuder, a standalone 'crypto mailinglist' > http://codecoop.org/projects/schleuder/ > still maintained (according to their versioning system), but last > release dates back to 2006 I don't have time right now to look at these, however I would really like to support some form of encrypted mailing lists for Mailman 3, if not also 2.2. It isn't possible to add this feature to Mailman 2.1. If you're interested in working on this, it would be good to capture some requirements and use cases in the wiki. If you wanted to do a survey of the approaches and implementations that have gone before, that would also help. Ideally, some folks would be motivated enough to start developing some branches in Bazaar so that we can take a look, with an eye toward supporting the feature officially in a future release. Feel free to discuss further on this mailing list. - -Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkf+l2EACgkQ2YZpQepbvXFFBQCdFY+07fgyROIVGUVInd1+Zhph HBkAnjuh78SV2DzvEtchN0CAFLeoXkjE =iaw1 -----END PGP SIGNATURE-----

3 2

Mailman 2.1.11 final has been released.
by Mark Sapiro 01 Jul '08

01 Jul '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am happy to announce the final release of the Mailman 2.1.11. Mailman 2.1.11 is a cleanup of a few problems found since the release of Mailman 2.1.10. It fixes the issue of shunted email subscribe requests and a few minor issues. It updates the contrib/mmdsr script for some 2.1.10 and 2.1.11 log and error messages, and it adds a new cron to cull and optionally archive old entries in the 'bad' and 'shunt' queues. Mailman 2.1.11 has updates to several i18n translations. A few bounce log messages now have the list name prepended. There is a new Defaults.py|mm_cfg.py setting ACCEPTABLE_LISTNAME_CHARACTERS with default value '[-+_.=a-z0-9]'. This Python regular expression character class specifies the characters allowed in list names. The motivation for this is the fact that previously, a list named, e.g., xxx&yyy could be created and MTA aliases generated that would cause the MTA to execute yyy as a command. There is a possible security issue here, but it is not believed to be exploitable in any meaningful way. If anyone is concerned about the security issue and not ready to upgrade, the mailman-2.1.11-listname-patch file contains a patch that can be applied to Mailman 2.1.9 or 2.1.10 to add this feature. See the release notes at <http://sourceforge.net/project/shownotes.php?group_id=103&release_id=605074> for more details. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, including download links, please see: http://www.list.org http://mailman.sf.net http://www.gnu.org/software/mailman Files in this release are: mailman-2.1.11.tgz <- The full release tarball mailman-2.1.11.tgz.sig <- GPG signature for the tarball mailman-2.1.11-listname.patch <- Patch to add new listname ~ validation to 2.1.9 or 2.1.10. ~ This patch is only applicable to ~ the older releases. mailman-2.1.11-listname.patch.sig <- GPG signature for the patch - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFIaTDdVVuXXpU7hpMRApGpAKDXM56DmmpBY28+X6pN2sDpyyZltACgr3wm ePBR1weSHPYd1ViPCTc/L8o= =bV1I -----END PGP SIGNATURE-----

1 1

Another small bug in 2.1.11 RC2
by Jordan Hayes 29 Jun '08

29 Jun '08

This seems to have crept in between 2.1.9 and 2.1.10: % cd cron % grep "#!" * bumpdigests:#! @PYTHON@ checkdbs:#! @PYTHON@ cull_bad_shunt:#! @PYTHON@ disabled:#! @PYTHON@ gate_news:#! @PYTHON@ mailpasswds:#! @PYTHON@ nightly_gzip:#! @PYTHON@ senddigests:#! /usr/bin/python <<---- So senddigest is broken if you redefine where your Python install is. /jordan

2 1

Re: [Mailman-Developers] Web UI
by Vivek Sant 29 Jun '08

29 Jun '08

Hi everyone, My name is Vivek Sant, I am a rising sophomore at Harvard College. I am a member of the Harvard Computer Society, and among other things, we use Mailman to host approximately 3000 mailing lists for student groups. I wanted to start by saying thanks for a great product - we've been using Mailman successfully for several years. Recently, we decided to modify the user interface to make it easier to use, and to make it look nicer. As I've seen from the -users and -developers lists, it seems that there has been discussion lately about modifying the UI, and I'd be glad to help out in any manner possible. For HCS' own instance of Mailman, I went ahead and changed up the UI, integrating CSS and generally making pages look much more visually appealing, and themed. If anyone is interested in seeing the changes I was able to make, check out <http://www.hcs.harvard.edu/~vsant/mm/ mailman.html>. This page has comparison screenshots of a few representative pages where I did most of the work. I'd recommend looking at this page in Firefox/Camino, because Safari renders it badly and I've not checked with IE. If the screenshots look weird, open any image directly in the browser - they are "full-size." Also, I created a branch with bzr and its located at <http:// www.hcs.harvard.edu/~vsant/mm/mailman_stable_newGUI>, in case anyone feels like looking at my code changes. I had to modify files all over the place in making these changes; files in templates/en, Mailman/, Mailman/Cgi, Mailman/Archive, Mailman/Gui, and interestingly, cgi-bin. I had to place a few files in cgi-bin, but in the bzr branch (I pulled this off of lp:mailman/ stable) it seems that cgi-bin scripts were created by the makefile, so I just created a cgi-bin folder in my branch saying that files in there (css, imgs etc) must be copied to the install dir's cgi-bin folder. There is a lot of code that creates links with a function like Link(label, href), and while it seems like great abstraction, it was a bit difficult for me to add something like say, class=cool_link. So I ended up ripping out some of those function calls and just building each link piece by piece. So overall, I just wanted to introduce myself, describe what work I have done so far, and also say that I'd love to help out with UI redesign efforts this summer! Comments/suggestions about my design are, of course, welcome, as well as questions if I have been unclear. Best regards, Vivek

2 1

Small bug/feature request in 2.1.11 RC2
by Jordan Hayes 28 Jun '08

28 Jun '08

This has been bugging me for a while now, and I finally tracked it down. In Mailman/Archiver/HyperArch.py (html_head, line 711) a little structure full of variables gets cobbled together for macro expansion in the templates; it includes the following variables: d = {"listname": html_quote(mlist.real_name, self.lang), "archtype": self.type, "archive": self.volNameToDesc(self.archive), "listinfo": mlist.GetScriptURL('listinfo', absolute=1), "firstdate": quotetime(self.firstdate), "lastdate": quotetime(self.lastdate), "size": self.size, } This gets sent to the expansion of archidxhead.html ... later, when archidxfoot.html is expanded (html_foot, line 678), the following variables get cobbled: d = {"lastdate": quotetime(self.lastdate), "archivedate": quotetime(self.archivedate), "listinfo": mlist.GetScriptURL('listinfo', absolute=1), "version": self.version, } I have some changes that I've been using since Mailman 2.1.5 (that I've used to integrate swish-e) that try to reference %(listname)s in both archidx{head,foot}.html and it doesn't expand in the foot. My belief is that all the variables should be available, but I'll settle for head and foot haveing the same ones; I'd even settle for just having listname available in foot :-) /jordan

3 2

Mailman 2.1.11rc1 has been released
by Mark Sapiro 23 Jun '08

23 Jun '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am happy to announce the release of the second release candidate for Mailman 2.1.11. Mailman 2.1.11 is a cleanup of a few problems found since the release of Mailman 2.1.10. It fixes the issue of shunted email subscribe requests and a few minor issues. It updates the contrib/mmdsr script for some 2.1.10 and 2.1.11 log and error messages, and it adds a new cron to cull and optionally archive old entries in the 'bad' and 'shunt' queues. See the release notes at <http://sourceforge.net/project/shownotes.php?group_id=103&release_id=605074> for details. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, including download links, please see: http://www.list.org http://mailman.sf.net http://www.gnu.org/software/mailman At this point I anticipate releasing 2.1.11 final on June 30. I am currently waiting for some updates to the Brazilian Portuguese (pt-BR) translation. At this point, I expect that to be the only change from 2.1.11rc2 to 2.1.11 final. - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFIX/4fVVuXXpU7hpMRAvxcAKDTjfEJmwPy0qn240kIUiM90Xt0RQCePj1i CkvCyaZtobyr01rJsae5Mik= =GgXp -----END PGP SIGNATURE-----

1 1

needs explanation of the interaction between "site list" and bounces
by Fil 22 Jun '08

22 Jun '08

Hello, (sorry to post here; I've been trying to re-subscribe to mailman-users for two days, w/o luck, and I really need help -- can someone check why I still can't post there?) I'm looking for a description of the interactions between bounce processing and the site list (mailman@...) under 2.1.11rc1. It seems to me that there is a case when the bounce processor doesn't recognize a bounce, sends it to ??? which in turn generates an error like "you are not allowed to post to the list mailman@..." thanks -- Fil

2 4

Mailman Plugin to Geeklog
by aman parnami 21 Jun '08

21 Jun '08

Hi All, I, Aman Parnami, a Google SOC student working in Geeklog, have been assigned the job of developing a Plugin to Geeklog for integrating List/User Moderation,Subscription, Administration etc. features of Mailman with Geeklog Project using REST Api. An abstract of the project idea can be found at: http://code.google.com/soc/2008/geeklog/appinfo.html?csaid=B75B38A30800A2E1 I am grateful for co-operation of Barry and Maki. I would love to hear some suggestions/ideas from Mailman Community on any thing remotely related to the idea briefed above. I hope that if this project completes successfully, not only will the Geeklog community be benefited, it will pave the path for use of Mailman with other such projects and thus increasing it's user base. Regards, -- Aman Parnami Computer Sc & Engg Indian Institute of Technology Bombay

1 0