Mailman 3 May 2010 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Hello
by Diwaker Ghimire May 31, 2010

May 31, 2010

I am working on mailman, I need to do some changes that i have to intercept subscriptions comming to our mailing list so that i can work with it. i tried to subclass OldStyleMemberships (succeed in hooking though) but could not find which of the class member is called during subscription. Is there any method that i missed or i doing the wrong way .. What should i do for this task. dwaker, >From Nepal

2 1

Listen to or hook into mailman subscription system
by Bibek Shrestha May 27, 2010

May 27, 2010

Hi, If i have to hook into user's subscriptions (new/edit/remove) and then perform specific non mailman related activities, how do I go about it? -- Bibek Shrestha bibekshrestha at gmail dot com Blog: http://bibekshrestha.com.np Twitter: http://twitter.com/bibstha

3 2

We have a winner!
by Barry Warsaw May 26, 2010

May 26, 2010

I am very pleased to announce the winner of the 2010 GNU Mailman logo contest. By an almost 2-to-1 margin, you voted for this logo: http://www.list.org/images/logo2010.jpg Congratulations Andrija Arsic! A little bit about Andrija: originally from Trstenik, Serbia and now studying IT technology in Belgrade, Andrija is a self-employed, part-time graphic designer, specialising in the fields of corporate identity (logo) design, web design, print design and branding with the majority of his time spent designing and implementing marketing promotions for businesses such as logos, websites, letterhead, business cards, packaging and more. I'm glad that he also contributes to free software, as I think his winning logo is spectacular. My thanks and appreciation to all the artists who contributed logos to the contest. All the designs are very nice, and in their own way, capture the spirit of GNU Mailman. Thanks also to all of you who voted! Cheers, -Barry Full announcement: http://www.wefearchange.org/2010/05/we-have-winner.html

1 0

Adding to the FAQ Wiki
by Jonathan Kamens May 25, 2010

May 25, 2010

Greetings, Last night, I sent a message to mailman-users pointing people at a turnkey, mimedefang-based solution to the problem of Mailman footers on MIME messages not displaying properly in some mail clients. That message has not yet been approved for the list, since I just joined it, so I've attached it here as well. I wanted to add a description of and link to my new solution on the relevant page of the Mailman Wiki (http://wiki.list.org/pages/viewpage.action?pageId=4030707), so I created an account for myself on the Wiki, but even after doing that, I can't find any way to edit the page. I suppose this means that either I'm missing something, or new Wiki users are not granted write access to the Wiki by default. I searched a bit but couldn't find any obvious explanation of this policy or the right channel for requesting write access to the Wiki. I assume there are people on this list who have write and admin access to the Wiki, so could I ask for someone to either (a) give me write access, at least to the page referenced above, so I can add something about my solution to it, or (b) add a description of my solution and a link to it (http://stuff.mit.edu/%7Ejik/software/mailman_mimedefang/) on the Wiki page? Thanks, Jonathan Kamens

2 1

DKIM and MLMs draft RFC
by Barry Warsaw May 14, 2010

May 14, 2010

Hello folks, I wanted to point people to this draft RFC: http://datatracker.ietf.org/doc/draft-kucherawy-dkim-lists/ by Murray S. Kucherawy, addressing DKIM issues related to mailing list managers. Murray has contacted Mark and I, and I'd like to invite your input on this mailing list. -Barry

2 1

installing Mailman 3.0
by Anna Granudd May 6, 2010

May 6, 2010

Hi, I downloaded the latest Mailman branch from Launchpad (using bzr branch lp:mailman) and tried installing it but ran into some trouble. The commands I was told to use for the installation were: "python bootstrap.py" followed by "bin/buildout" and "bin/test" (I assume the bin-folder will be created after the bootstrap file is run since I don't have it right now). However, running the first command I encounter the following error: Traceback (most recent call last): File "bootstrap.py", line 69, in <module> ws.find(pkg_resources.Requirement.parse('setuptools')).location AttributeError: 'NoneType' object has no attribute 'location' The file belong to my user which was also used for the python command (meaning I did not use sudo to run it, although doing so gives me the same error). Any tips how I should proceed to install Mailman 3.0 and should the commands be run using sudo? I should probably add a user "mailman" instead of using my own, but right now I'm more interested in getting the whole thing to run. I currently run Kubuntu 10.04 and Python v. 2.6.5 if that might have something to do with the error message. Thanks, Anna

3 4

Ham, mailing lists, and oddball character sets
by Philip A. Prindeville May 5, 2010

May 5, 2010

Hi. I work a bit in OSS and contribute to mimedefang and spamassassin, and myself am on about 70 mailing lists. I notice that some of these lists that are open to outside mailings are magnets for spam. As a consequence, the end-recipients of these lists can't "trust" mail coming from these lists, and if we filter it (and reject it), we run the risk of being auto-unsubscribed for too many delivery failures... It's a thorny issue. In a perfect world, all MUA's would comply with the following recommendation: RFC 2046, last paragraph of section 4.1.2: In general, composition software should always use the "lowest common denominator" character set possible. For example, if a body contains only US-ASCII characters, it SHOULD be marked as being in the US- ASCII character set, not ISO-8859-1, which, like all the ISO-8859 family of character sets, is a superset of US-ASCII. More generally, if a widely-used character set is a subset of another character set, and a body contains only characters in the widely-used subset, it should be labelled as being in that subset. This will increase the chances that the recipient will be able to view the resulting entity correctly. And thereby, it would be trivial to bounce a message sent to an English-language only mailing list that wasn't encoded in USASCII or Latin1 (iso-8859-1) as the charset. But alas they don't. So end-users mail systems end up having to do this, which creates all sorts of backscatter to the mailing list, etc. What if mailing list exploders did the following? When you receive a message that has text/plain parts that aren't "charset=usascii" or "charset=latin1" attempt to transcode the parts into one of these (in that order, until success). If the transcoding fails, reject the message. Otherwise, substitute the rewritten parts in the forwarded message. Yes, I know that it's not a good thing to rewrite messages... but most mailing lists do a fair amount of message munging anyway (to the point that PGP becomes useless, for instance). What do you all think? It doesn't have to be the default behavior... But it would definitely be handy to be an option. Thanks, -Philip

3 2