Mailman 3 February 2009 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

PyCon 2009 sprint: Webinterface
by Patrick Ben Koetter March 24, 2009

March 24, 2009

Barry, I am collecting information for my work on the MM3 Webinterface while we meet at PyCon 2009 sprint. So far I have found the "Summer of Code summary" <http://wiki.list.org/display/DEV/2006/08/20/Summer+of+Code+summary>. Any other information/writing I should collect and read before we meet? I also believe I had seen a page where you (?) had noted a link for a design you favoured, but I can't find it. Can you post the link or come up with a list of sites you like? (Not that we weren't able to develop design. I just want to get an idea.). Thanks, p@rick -- state of mind Agentur für Kommunikation, Design und Softwareentwicklung Patrick Koetter Tel: 089 45227227 Echinger Strasse 3 Fax: 089 45227226 85386 Eching Web: http://www.state-of-mind.de Amtsgericht München Partnerschaftsregister PR 563

4 13

mailman-pgp-smime: talks at FOSDEM and in Ulm, new release
by Joost van Baal March 4, 2009

March 4, 2009

Hi, Thanks to the NLnet foundation, the Secure List Server project ( http://non-gnu.uvt.nl/mailman-pgp-smime/ ) , which is including OpenPGP and S/MIME support in Mailman has released a much improved mailman-pgp-smime patch: http://non-gnu.uvt.nl/pub/mailman/mailman-2.1.11-pgp-smime_2009-01-02.patch… . See http://non-gnu.uvt.nl/mailman-pgp-smime/NEWS.PGP-SMIME for the details. There'll be talks about this patch: On monday january 12 I'll talk at the Chaos Seminar</a> in Ulm, Germany, see http://ulm.ccc.de/ChaosSeminar/2009/01_Mailman_PGP_SMIME . On sunday february 8th, 10h20 (probably), I'll give a lightning talk at the FOSDEM conference, ULB Campus Solbosch, Brussels, Belgium. See http://fosdem.org/2009/node/164. The talk will start with a very short overview of the history of Mailman and the mailman-pgp-smime project. Some remarks will be made on how to install and configure the software, so that one can try it. Currently supported features will be mentioned, as well as an overview of development plans. One will learn how to contribute to the project; an overview of the revision control system used will be given. Some remarks on the future of the patch will be made: will it be shipped with Mailman itself? If you have used Mailman, both as a subscriber and as a list admin, and if you know what PGP and S/MIME are, you should definitely attend this talk. Hope to meet you there! Bye, Joost -- irc:joostvb@{OFTC,freenode} ∙ http://mdcc.cx/ ∙ http://ad1810.com/

3 5

Mailman 2.1.12 final released.
by Mark Sapiro Feb. 23, 2009

Feb. 23, 2009

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am happy to announce the final release of Mailman 2.1.12. Since 2.1.12rc2 there have been a few bug fixes, the Polish translation has been updated and a couple of items have been added to the contrib directory. Mailman 2.1.12 is a minor bug fix and Python 2.6 compatibility release. The minimum Python for this release is Python 2.4 and it is compatible with Python through 2.6. The previous Mailman releases are not compatible with Python 2.6. See the release notes at <https://sourceforge.net/project/shownotes.php?release_id=653108&group_id=103> for more details. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, including download links, please see: http://www.list.org http://mailman.sf.net http://www.gnu.org/software/mailman - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFJozBSVVuXXpU7hpMRAgBNAJ0SNpRHqlmRCHcW0L7f/Gxw+7Ro/QCgrfoA qMml0XJorulAaRiCi03e7OY= =fTrb -----END PGP SIGNATURE-----

2 1

Re: [Mailman-Developers] [Mailman-checkins] [Branch ~mailman-administrivia/mailman-administrivia/admin] Rev 43: Updates for 2.1.12 release.
by Barry Warsaw Feb. 23, 2009

Feb. 23, 2009

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Feb 23, 2009, at 4:45 PM, noreply(a)launchpad.net wrote: > ------------------------------------------------------------ > revno: 43 > committer: Mark Sapiro <mark(a)msapiro.net> > branch nick: admin > timestamp: Mon 2009-02-23 13:27:11 -0800 > message: > Updates for 2.1.12 release. > modified: > www/index.ht > www/index.html pushed to gnu.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iQCVAwUBSaMby3EjvBPtnXfVAQIOUQP9GKNsU78h1AzXVQ8iGCsJ/jiYugBEMU26 aFWFAC2NuZFc0ZAtWh7OkI1zo7ukllCVzGH7wKXK9PxqkXlsI6c+tgw5yhEowSNh 6HGfhci51kNfsezL3IsWOQE1bKth4rKoEDLxrRlVZlKdUJMHv1egGjeCBdWXl/On O+STrbgYIJY= =e8PD -----END PGP SIGNATURE-----

1 0

PyCon 2009 sprint
by Barry Warsaw Feb. 21, 2009

Feb. 21, 2009

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've updated the Mailman sprint page for PyCon 2009: http://wiki.list.org/x/XgB0 If you're attending PyCon this year and want to get your hands dirty with Mailman 3, please sign up! Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iEYEARECAAYFAkmfKpYACgkQ2YZpQepbvXF29gCgobdDXDD22lWBisWttyXtvheV ulMAn0yY4pDtlMihKxSfS6+ZR2KkBi8t =viw3 -----END PGP SIGNATURE-----

2 2

Re: [Mailman-Developers] Bug in Mailman version 2.1.12rc1
by Mark Sapiro Feb. 20, 2009

Feb. 20, 2009

Goodman, William wrote: > >I cannot perform an upgrade at this point when I was at the link it >said: >"The merge of line 773 from 2.1 to 2.2 rev 1027 implies it is recent >code in 2.1." >what's the fix? in the /mailman/Mailman/Cgi/admindb.py ? The relevant info about the fix in the bug report is Related branches ~mailman-coders/mailman/2.1 (Mature) Fixed at rev. 1166. You can see the changes at <http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1166>. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Re: [Mailman-Developers] Bug in Mailman version 2.1.12rc1
by Mark Sapiro Feb. 20, 2009

Feb. 20, 2009

Goodman, William wrote: > >Feb 20 13:10:50 2009 admin(19709): >@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ >admin(19709): [----- Mailman Version: 2.1.12rc1 -----] >admin(19709): [----- Traceback ------] >admin(19709): Traceback (most recent call last): >admin(19709): File "/opt/software/mailman/scripts/driver", line 112, >in run_main >admin(19709): main() >admin(19709): File "/opt/software/mailman/Mailman/Cgi/admindb.py", >line 164, in main >admin(19709): process_form(mlist, doc, cgidata) >admin(19709): File "/opt/software/mailman/Mailman/Cgi/admindb.py", >line 773, in process_form >admin(19709): comment = msgdata.get('rejection_notice', _('[No >explanation given]')) >admin(19709): AttributeError: 'str' object has no attribute 'get' This is Bug #325016 <https://bugs.launchpad.net/mailman/+bug/325016>. It was fixed in 2.1.12rc2. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

PyCon 2009 sprint
by Barry Warsaw Feb. 11, 2009

Feb. 11, 2009

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It's that time of year again! Pycon 2009 is just around the corner. The conference is at the end of March in Chicago. I'm planning on being there for both the conference and the sprints, and Patrick Koetter and his colleagues are flying in for probably one day of sprinting on Mailman 3. If you're interested in joining us, I've created a sprint page on the wiki: http://wiki.list.org/display/DEV/PyCon+Sprint+2009 and I will fill this in as more information is available. This year I'd like to concentrate on the admin REST server for MM3, and if there's time the web u/i. I'll give a brief tour of MM3 as well. I hope you can join us. Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iEYEARECAAYFAkmS2uMACgkQ2YZpQepbvXHBxQCgs5XzuuCrU5ygFE8pQaYyhtOo LmEAnjUpTDuMYj5ei/QwonIIsojnHMeF =VKBK -----END PGP SIGNATURE-----

1 0

USE_ENVELOPE_SENDER
by Barry Warsaw Feb. 10, 2009

Feb. 10, 2009

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does anybody set USE_ENVELOPE_SENDER to Yes these days? I'm considering removing the equivalent of this from Mailman 3.0 and I'd like to know if that would be a hardship for anyone. If you don't know what this value is (which in Mailman 2 lives in Defaults.py), then you probably won't miss its demise in Mailman 3. This flag controls whether the Sender: header is considered before the From: header for purposes of trying to determine the email address of the message's author. At one time in the distant past, this flag was added because it was observed that some MTAs put the RFC 2821 MAIL FROM value into this header, and this was considered less spoofable than the From: header. I think these assumptions are outdated and this workaround is either unnecessary or hurts more than it helps. BTW, the default value is No, which tells Mailman to use the From: header first. I propose hardwiring that default value. Let me know if this would cause you pain. Barry -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iEYEARECAAYFAkmPZuIACgkQ2YZpQepbvXHsbQCgl78AxhkBTbATQbV7jab+P8a+ F10An3skXX9Am4+BOk8gCqNaNiiVU1Vg =Ddit -----END PGP SIGNATURE-----

3 6