Mailman 3 December 2010 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Suggestions about Mailman bounce processing
by Superticker2 (Mark) 07 Jan '11

07 Jan '11

I'm not a subscriber to this list, so please include me superticker2{at}iastate.edu on your cc: line. I have two suggestions I would like to make concerning Mailman bounce processing: 1) All bounces from either a Mass Subscribe or Mass Invite operation should be unconditionally and immediately sent to the list owner. There can be many typos in these Mass Subscribe/Invite lists, and the list owner needs to correct these typos _immediately_. In addition, some of these mass subscription lists come from paper sign-up lists by foreign students where the English alphabet is new to them. Trying to decipher their email addresses can result in 10% typos and bounces, which need immediate corrections. 2) All bounces should be immediately directed to the list owner if bounce processing is switched off. For small lists, it makes the most sense for the list owner to handle bounces manually. Often he'll know the recipients personally and their new email addresses, which he can fix himself when they bounce. As it stand today, there could be 100s of bad addresses on an email list without anyone's knowledge if bounce processing is off; this is bad design.

5 11

Re: [Mailman-Developers] Suggestions about Mailman bounce processing
by David Brown 28 Dec '10

28 Dec '10

Years and years ago (2000, I think), I implemented a script in PHP that allows us to test whether our server will be able to deliver to an email address. It's based on some code by Jon S. Stevens <jon(a)clearink.com> (google that + "validateEmail" and you'll find examples). It first does a DNS lookup for the MX record, then if that's successful it attempts a standard SMTP HELO/MAIL FROM/RCPT TO/QUIT sequence and checks for errors in the mail server's response. If you have some familiarity with PHP, I'd be happy to send you the version I wrapped into a function which you could easily loop through. The RFC822 class from PEAR could help process the text file for addresses. Or perhaps someone here knows more about how to do it in python. Such a utility could make a slick addition to the admin page in version 3. There are also commercial tools to do this. -- David Brown dave(a)aasv.org ; webmaster(a)aasv.org -----Original Message----- [...] If there's a service or utility that can verify a list of email addresses (prior to a mass operation), please suggest it. [...]

1 0

Hacking .py scripts to show config content
by Aitkenhead, Paul C. 19 Dec '10

19 Dec '10

2 1