Mailman 3 January 2010 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

New Logo Contest for 2010
by Barry Warsaw March 2, 2010

March 2, 2010

Hello everybody! Our current GNU Mailman logos were designed by the Dragon De Monsyne many years ago. They have served us exceedingly well, but with the coming of Mailman 3, we've decided it's time our logos got a face lift. So we're opening up a new logo contest to the Mailman and GNU communities. We invite your creative and inspiring designs! Details of the contest and submission guidelines are available here: http://wiki.list.org/display/DEV/NewLogo Submissions will be open until February 28, 2010, and is open to everyone, so feel free to forward this announcement. Please contact the Mailman Steering Committee at mailman-cabal(a)python.org with any questions. Enjoy, -Barry

1 1

adding new features for site admin (webUI)
by Kovács Zoltán Feb. 22, 2010

Feb. 22, 2010

Dear Developers, My task is to enhance the web admin interface for mailman-2.1.x, requested by one of my customers. As a programmer, I learned that I need to add some lines of code into Mailman/Cgi/admin.py (or listinfo.py). I also learned that there are upcoming versions (2.2 and 3.0) which may have a different (completely rewritten) interface. As far as I can understand the current version (2.1.x) can be a widely used one for several years, so my changes will be fruitful for the community for a few years or so. I'd like to add the following new features. My customer is running 100+ different lists with 500+ users. So my customer asks me to give a web interface for the following: * Remove a given user from all lists. If a user to be removed is a list admin, then a warning should come instead. * Change the email address of a given user in all lists. I know that these requests could be done via the command line interface, but my customer would like to maintain these task via web. My questions to you are: * If my code is of quality, will it be a part of the mainstream code (from 2.1.14 or so)? * Is admin.py the right place for such an enhancement? Thank you for your answer in advance. Yours, Zoltan Kovacs http://particio.com/english/

3 3

return 401 for bad password?
by Mark Hedges Feb. 8, 2010

Feb. 8, 2010

Hi... is there any possibility a post with a bad password could return 401 instead of 200... that way fail2ban would automatically block bots that try to hack list manager passwords. Mark

2 3

batch editing of users' topic subscriptions (feature request)
by Benjamin Rahn Jan. 30, 2010

Jan. 30, 2010

Hi Mailman devs, As a list admin I would find it hugely helpful if I could batch-edit users' topic subscriptions. ======== Context I use mailman to administer mailing lists for a 400-member community of a college dorm (including students and staff). Many of the announcements aren't applicable to the entire community, but instead to particular subgroups (e.g. sophomores, students living on the third floor, students enrolled in a math class). Our current approach is to set up multiple lists -- one main list to which everyone is subscribed ('announce') and then another list for each subgroup (e.g. 'announce-sophomores', 'announce-third-floor', 'announce-math'). This is, of course, inelegant at best and more typically a major hassle for all involved. I'd like to be able to use topics to filter messages to the appropriate set of users, but as far as I can tell this would require adjusting each user's topics by hand. (It's not realistic to ask members to set up their own topic subscriptions.) If there was a batch mechanism for adjusting users' topic subscriptions this would be much easier. ======== Potential Solution I'm not particularly fussy about how the batch editing would be accomplished, but here's what I came up with that would seem to require little modification of mailman's current interface (I'm using 2.1.9): On the mass-subscribe page (mailman/admin/foo/members/add), permit input to the 'subscribees' textarea with lines of the form 'address(a)domain.com topic1 topic2' which would subscribe the address to the list if it wasn't already, and further subscribe the address to the listed topics. Similarly, the mass unsubscribe page (mailman/admin/foo/members/ remove), this input would unsubscribe the address from _only_ the listed topics, but not from the list as a whole. ========= Would love to get others' thoughts on this feature. Thanks for your consideration! Best regards, Ben PS I'm new to the list -- apologies if this has been covered before and my archive search wasn't sufficiently thorough.

1 0

Re: [Mailman-Developers] Mailman web user interface kick-off
by Nahuel ANGELINETTI Jan. 25, 2010

Jan. 25, 2010

Hi, > Hi there, > > I'm Florian, a web developer from Berlin. I have been subscribed to > the mailing list for a year now, but haven't posted anything so far. > So first things first: Hi to you all! > > I was, however, present at last year's Pycon MM-sprint (and will be > this year), so here's what I recall, along with some thoughts: > > I guess the framework would be one of the first things to decide > about. At last year's sprint, we talked about using Pylons and genshi > as a template engine. On the other hand: Pylons' standard template > engine, Mako, seems to be a lot faster while having a similar set of > features (i18n, ...). Being relatively new to Python I personally > don't have a preferred framework (Pylons seemed fine, though...). But > I am a fan of the MVC pattern because of the separation of logic and > layout. So using something like Pylons or Django seems like a good > idea to me. > > On the Javascript side, I would recommend jQuery because of its > performance, small size, tons of plugins and general awesomeness. > I already did a lot of work using django, jquery, and some python libraries. All is accessible on : http://dev.arbrows.org We already put it in beta production at : http://archives.rezo.net. The main goal of this project, is to have a "generic" webapp for all mailing list managers(mailman, sympa, ...), and it should be a good idea to create an open REST API. We have a lot of ideas for arbrows futur, but well I have not really time atm to work full time on this project, i'm walking slowly. If you're interested to help me/us, please contact me, it'll be a pleasure. Bests, -- Nahuel ANGELINETTI

1 0

Mailman web user interface kick-off
by Barry Warsaw Jan. 24, 2010

Jan. 24, 2010

Hello folks, I'd like to officially kickoff the Mailman 3 web user interface project. I want to invite all interested developers and designers to join in on helping to produce an awesome, modern user interface for the next version of Mailman. I believe we have enough infrastructure in the core Mailman 3 engine to support at least initial work on the WUI. The architecture we've laid out is solid I believe. The Mailman 3 engine provides a REST HTTP server exposing a full-access administrative interface. The WUI will be a separate optional process that sites can run, which communicates over REST to manage security and provide external HTTP/HTML access to Mailman functionality for users, list administrators, and site administrators. All discussions about the WUI can be conducted on the mailman-developers mailing list. The wiki can be used to collect artifacts such as design notes, decisions, and progress: http://wiki.list.org/display/DEV/Web+Interface (Contact me or mailman-cabal(a)python.org off-line if you need write access. The wiki is fairly locked down due to spam.) The Launchpad project for the Mailman WUI is here: https://launchpad.net/mailmanweb but there is currently very little there at the moment. Remember too that we are trying to gather critical mass to sprint on the WUI at Pycon 2010: http://wiki.list.org/display/DEV/PyCon+Sprint+2010 Enjoy, -Barry

2 1

Re: [Mailman-Developers] Mailman web user interface kick-off
by John Fitzsimons Jan. 24, 2010

Jan. 24, 2010

On Sat, 23 Jan 2010 19:33:24 -0800, Mark Sapiro wrote: >On 11:59 AM, John Fitzsimons wrote: < snip > >> Sounds good. Is this instead of the news server integration ? Being >> done prior to that ? Or are they being developed concurrently ? >> Is this meant to be a Mailman "alternative" to CPanel ? Or are you >> thinking of adding such things as posting to an email list via a >> Mailman web page ? In other words an (optional ?) Mailman >> created web forum. < snip > >And no, this is independent of any possible NNTP support and is probably >happening first Okay, though I expect that if a news server option were offered it might include a "common" database for email/news/web posts. > (although in open source, you never know what might >happen), and no it is not a "Mailman "alternative" to CPanel" whatever >that might be. As a windows user the CPanel interface is all that I am familiar with. >It is a redesign of the existing MM 2.1 web interface Okay, I haven't seen that. >(most of which is virtually unchanged by cPanel). I.e. all of the >existing list admin, admindb, options, etc. web interface that you see >in your cPanel installation is virtually unchanged from standard Mailman >2.1. This is a redesign of that interface for MM 3. Sounds good. Particularly if one has a "Delete (or hide ?) archive" option. :-) >The ability to post from a web page could be part of this if there is >enough interest. Though I don't like web forums many people do. I am sure that a lot of people would like a web forum interface if it were offered as an "option". For many people "Web Mail" is a handy way to check what is in their "home" mailbox when on the road, or at work. The current web access to Mailman archives is very close already to a web forum IMO. All that needs to be added is a "reply" button and a "new post" button. IF that page were offered, as a html page that administrators could alter, it would enable them to make things "prettier". Regards, John.

1 0

Advanced user reputation/moderation features
by Marlon Menezes Jan. 22, 2010

Jan. 22, 2010

Let me state that I am not a IT person, so some of my questions/comments may not be the most appropriate lingo that is used by you folks. It is also very likely that my issues/ideas have been raised before, though I have not been able to find it in the archives. I have been moderating non-commercial mailing lists (initially majordomo and then mailman) since the mid 1990s. One of the biggest issues has been in the moderation of posts on these discussion lists. Usually, we have had a set of volunteer moderators who review the posts for spam, obscenity, personal attacks etc before they get approved for distribution. While stuff like spam, obscenity etc are for the most part obvious and can be auto filtered using various options, the problem remains that the issue of more mundane posts are still subject to the moderator's bias. Besides being subjective, it can be many, many hours before a post gets approved, which hampers the continuity and spontaneity of the posts. An alternate approach to moderation could be via a "user reputation score" as is often found in many web based discussion forums. A person with a higher user reputation score could have fewer restrictions posed on him, in terms of the number of posts (say per unit of time) without moderation, before he gets flagged for manual moderation. At this stage, it is not my intent to propose an a specific mathematical algorithm, but rather to bring out general concepts. The issue of course is how would a "user reputation score" be determined? I would think it would be composed of a variety of components such as: (in no particular order) 1) Feedback scores as determined by the general mailing list population. The feature could be embedded into an email to allow collective input from the reader base. This will automatically provide a feedback loop to poor quality posters to either reign in their posts or suffer a demotion in their posting rights via the pre-defined algorithm. Furthermore, it will be based on the fopinions of the collective masses, rather than that of the moderator. 2) Verified identity/open ID: I understand that open ID is one of the features being considered for a future release of mailman. Individuals with larger networks on sites such as facebook etc could be given a higher starting reputation score as opposed to a ID that has little or no prior history or network to back that person's identity. This will help reduce the possibility of fraudulent posts under freshly created IDs. I would appreciate some feedback on whether something like this is possible. Since I am not a programmer, I would not be able to provide technical support for the development of this code. However, I may be able to get some funding from a non-profit foundation to get this done. Regards, Marlon

4 6

Pycon 2010 sprint
by Barry Warsaw Jan. 22, 2010

Jan. 22, 2010

I would like to conduct another sprint at the 2010 Python conference in Atlanta this year. The focus should be on building the new web user interface for Mailman 3. We'll be doing things like reviewing and choosing technologies, doing the information layout, building the framework, and fleshing out the REST API. Please sign up on this page if you plan on attending. http://wiki.list.org/display/DEV/PyCon+Sprint+2010 (You can also sign up there if you're only able to participate virtually.) Hope to see you there, -Barry

1 0