Mailman 3 September 2010 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

zc.buildout.buildout error message with installing mailman-3.0.0a6
by UUN Hostmaster 27 Sep '10

27 Sep '10

When I try to install mailman-3.0.0a6, I receive the following error message: [root@host mailman-3.0.0a6]# python2.6 bootstrap.py Downloading http://pypi.python.org/packages/2.6/s/setuptools/setuptools-0.6c11-py2.6.egg [root@host mailman-3.0.0a6]# ./bin/buildout Traceback (most recent call last): File "./bin/buildout", line 17, in <module> import zc.buildout.buildout ImportError: No module named zc.buildout.buildout Where do I obtain the module zc.buildout.buildout? Thanks. Jim ----- Jim Hermann <hostmaster(a)UUism.net> UUism Networks <http://www.UUism.net <http://www.uuism.net/> > Ministering to the Needs of Online UUs Web Hosting, Email Services, Mailing Lists -----

2 1

RELEASED: Mailman 3.0 alpha 6
by Barry Warsaw 20 Sep '10

20 Sep '10

I happy (and somewhat relieved :) to announce the release of the sixth alpha for Mailman 3.0. There is much new coolness that you will want to explore. The biggest change is that the administrative REST API has been greatly improved and is now reasonably well fleshed out. You can create and delete domains and mailing lists, subscribe and unsubscribe members, and reconfigure your mailing lists through the REST API. The documentation has specific examples of how to do it. This means that you can actually start to try to integrate Mailman with your web sites. The big push between now and the first beta will be to complete the import of Mailman 2.1 data, and integrate it with the UI work done by Anna and Florian for the GSoC. The tarball can be downloaded from Launchpad or the Cheeseshop: https://edge.launchpad.net/mailman http://pypi.python.org/pypi/mailman/3.0.0a6 The full documentation is also available online: http://packages.python.org/mailman/docs/README.html See below for the changes since alpha 5. Please note that Mailman 3 is not yet ready for production, although we'd love it if you test it and provide feedback! Enjoy, -Barry 3.0 alpha 6 -- "Cut to the Chase" ================================= (2010-09-20) Commands -------- * The functionality of 'bin/list_members' has been moved to 'bin/mailman members'. * 'bin/mailman info' -v/--verbose output displays the file system layout paths Mailman is currently configured to use. Configuration ------------- * You can now configure the paths Mailman uses for queue files, lock files, data files, etc. via the configuration file. Define a file system 'layout' and then select that layout in the [mailman] section. Default layouts include 'local' for putting everything in /var/tmp/mailman, 'dev' for local development, and 'fhs' for Filesystem Hierarchy Standard 2.3 (LP #490144). * Queue file directories now live in $var_dir/queues. REST ---- * lazr.restful has been replaced by restish as the REST publishing technology used by Mailman. * New REST API for getting all the members of a roster for a specific mailing list. * New REST API for getting and setting a mailing list's configuration. GET and PUT are supported to retrieve the current configuration, and set all the list's writable attributes in one request. PATCH is supported to partially update a mailing list's configuration. Individual options can be set and retrieved by using subpaths. * Subscribing an already subscribed member via REST now returns a 409 HTTP error. LP: #552917 * Fixed a bug when deleting a list via the REST API. LP: #601899 Architecture ------------ * X-BeenThere header is removed. * Mailman no longer touches the Sender or Errors-To headers. * Chain actions can now fire Zope events in their _process() implementations. * Environment variable $MAILMAN_VAR_DIR can be used to control the var/ directory for Mailman's runtime files. New environment variable $MAILMAN_UNDER_MASTER_CONTROL is used instead of the qrunner's --subproc/-s option. Miscellaneous ------------- * Allow X-Approved and X-Approve headers, equivalent to Approved and Approve. LP: #557750 * Various test failure fixes. LP: #543618, LP: #544477 * List-Post header is retained in MIME digest messages. LP: #526143 * Importing from a Mailman 2.1.x list is partially supported.

1 0

Mailman 2.1.14 released.
by Mark Sapiro 20 Sep '10

20 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am happy to announce the final release of GNU Mailman 2.1.14. Mailman 2.1.14 is mainly a bug fix release, but it contains one security fix as previously announced at <http://mail.python.org/pipermail/mailman-announce/2010-September/000151.html> and one new feature. It differs from the previously released 2.1.14rc1 only in wording clarifications and typo corrections in a few messages. This new feature controls the addition/replacement of the Sender: header in outgoing mail. This allows a list owner to set include_sender_header on the list's General Options page in the admin GUI. The default for this setting is Yes which preserves the prior behavior of removing any pre-existing Sender: and setting it to the list's -bounces address. Setting this to No stops Mailman from adding or modifying the Sender: at all. Additionally, there is a new Defaults.py/mm_cfg.py setting ALLOW_SENDER_OVERRIDES which defaults to Yes but which can be set to No to remove the include_sender_header setting from General Options, and thus preserve the prior behavior completely. Python 2.4 is the minimum supported, but Python 2.5.or 2.6 is recommended. See the changelog at <https://launchpad.net/mailman/2.1/2.1.14> for more details. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see: http://www.list.org http://www.gnu.org/software/mailman Mailman 2.1.14 can be downloaded from https://launchpad.net/mailman/2.1/ http://ftp.gnu.org/gnu/mailman/ - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFMl7bXVVuXXpU7hpMRAtKyAJ4hnS08i71tx9nx1iG9wkGI9FalggCgqjnF 3CvTQeW7TOY76+u/KBNBGuM= =we0d -----END PGP SIGNATURE-----

1 0

Mailman security patch.
by Mark Sapiro 09 Sep '10

09 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I plan to release a Mailman 2.1.14 candidate release towards the end of next week (Sept 9 or 10). This release will have enhanced XSS defenses addressing two recently discovered vulnerabilities. Since release of the code will potentially expose the vulnerabilities, I plan to publish a patch against the 2.1.13 base with the fix before actually releasing the 2.1.14 candidate. I will post the patch to the same 4 lists that this post is being sent to in the early afternoon, GMT, on September 9. The vulnerabilities are obscure and can only be exploited by a list owner, but if you are concerned about them you can plan to install the patch. The patch is small (34 line diff), only affects two modules and doesn't require a Mailman restart to be effective, although I would recommend a restart as soon as convenient after applying the patch. - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFMgutpVVuXXpU7hpMRAsX1AJ48C0RxSpV7r9lg3J0V7OTs44ISqgCgn1wX LZ5RkuGLo0r04eDNYOBDYpo= =gscN -----END PGP SIGNATURE-----

3 3

Mailman 2.1.14rc1 released.
by Mark Sapiro 09 Sep '10

09 Sep '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am happy to announce the first release candidate for the 2.1.14 release of the 2.1 stable maintenance branch of GNU Mailman. Mailman 2.1.14rc1 is mainly a bug fix release, but it contains one security fix as previously announced at <http://mail.python.org/pipermail/mailman-announce/2010-September/000151.html> and one new feature. This new feature controls the addition/replacement of the Sender: header in outgoing mail. This allows a list owner to set include_sender_header on the list's General Options page in the admin GUI. The default for this setting is Yes which preserves the prior behavior of removing any pre-existing Sender: and setting it to the list's -bounces address. Setting this to No stops Mailman from adding or modifying the Sender: at all. Additionally, there is a new Defaults.py/mm_cfg.py setting ALLOW_SENDER_OVERRIDES which defaults to Yes but which can be set to No to remove the include_sender_header setting from General Options, and thus preserve the prior behavior completely. Python 2.4 is the minimum supported, but Python 2.5.or 2.6 is recommended. See the changelog at <https://launchpad.net/mailman/2.1/2.1.14rc1> for more details. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see: http://www.list.org http://www.gnu.org/software/mailman Mailman 2.1.14rc1 can be downloaded from https://launchpad.net/mailman/2.1/ http://ftp.gnu.org/gnu/mailman/ - -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32) iD8DBQFMiVTzVVuXXpU7hpMRAoOBAJ9toQK+LGWfIW0GQ3bwGd7oQlDUJACfe+8a wyxtS0VdLRJfjicrVGewmyA= =uGQl -----END PGP SIGNATURE-----

1 0

REST server status and MM3.0alpha6 soon
by Barry Warsaw 01 Sep '10

01 Sep '10

Just a heads up that I've *finally* managed to wrestle restish, webob, and cgi to the ground and hack in PATCH support for the Mailman 3 REST server. It's a kludge but it works. This was one of the last things I needed to do before I could release 3.0alpha6, so look for that in the next day or so. How goes the new web ui work? -Barry

2 1