Mailman 3 December 2011 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 8, 2022

Nov. 8, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Re: [Mailman-Developers] feature request: one-click setting to preserve DKIM
by Barry Warsaw Jan. 6, 2012

Jan. 6, 2012

On Dec 06, 2011, at 10:17 AM, Murray S. Kucherawy wrote: >> I think this is the one big lesson from these discussions: DKIM is >> mostly incompatible with mailing lists. Where the two must be >> integrated, some usability will likely be compromised. > >It depends on your expectations. If there's an expectation that the author's >signature will/should/must persist through a mailing list, then I agree that >they're largely incompatible. If on the other hand you intend for lists to >re-sign mail and for receivers to evaluate the message based on the list >signature rather than the author signature, then it's entirely workable. Of >course, sometimes the author signature will indeed survive, and then you have >two domains to evaluate instead of one. Bonus! My own personal feeling is that having lists re-sign messages is the best expectation to put forward. You're subscribed to a mailing list, so you trust that list much more than you trust the senders on that list. So having the mailing list site re-sign the outgoing messages seems to me to be best practice. My inclination is that removing the original author's signature first is not entirely inappropriate. Note too that Mailman supports anonymizing list traffic to the extent that it would wipe out the original From header. Some lists turn this on for a higher degree of privacy than you see on most open discussion lists. In that case, the From header would look like it's coming from the mailing list, and then it would make the most sense to remove any original signature and leave only the list's signature. It seems to me that relying on From header signing of mailing list messages just isn't that useful. >As Monica points out, DKIM itself is oblivious to the context in which it's >being used. > >> I'm no DKIM expert by far, but it seems to me that a mailing list >> message has enough clues that a DKIM verifier could do a better job at >> helping recipients make good choices. For example, all Mailman >> messages have a List-Id header that contains the domain name hosting >> the list server. With re-signing, why couldn't you verify the >> signature against the List-ID host instead of the original sender? > >You could. The issue isn't that doing so is wrong or impossible. It's >simply that those semantics aren't built into DKIM, largely because we have >no evidence that that's a useful test. > >The ESP community has argued that third-party signatures (those different >than the one in the From: field) shouldn't be valued any less than one that >does match, for various reasons. That argument was apparently persuasive. > >ADSP, and a draft I'm advancing called ATPS, extend DKIM's semantics to do >more than just say "domain X handled this message" (which is really all a >valid DKIM signature tells you). They both attempt to say things based on >whether the domain delivered as part of a valid DKIM signature matches some >identifier in the message, like the domain in the From: or in the List-ID >field. If Mailman (or an MUA, or a filter, or something) implements such >checks and finds that it's operationally beneficial to end users do so, then >it could publish that mechanism in an RFC or elsewhere, and people could >start to use it. The resistance isn't that this is a bad idea, but just that >there's no evidence to back it up that would justify its standardization. In that case, it would be interesting and feasible for you to perhaps line up some mailing list sites to enable this and gather some statistics. It would be pretty easy to do (I think) in Mailman 3 (though that's unreleased) and probably not hard to do in Mailman 2. >The trick, of course, is not just to do something like this, but to get MUA >buy-in. That is, when a signature validates and it presents a domain name >that matches some identifier, change the presentation of the message to show >this in some meaningful way. And then make sure in doing so that you don't >inadvertently discredit legitimate messages for which that's not true. Right. So, Gmail is probably the 800lb MUA gorilla here. Monica, do you have any thoughts on how you could run such an experiment and find out what is most useful to your users? Cheers, -Barry

4 7

Header cleanup/unnoticed header
by Patrick Ben Koetter Dec. 24, 2011

Dec. 24, 2011

Given our recent discussions on header cleanup for MM3 I noted another x-header that went unnoticed: x-mas: Sat, 24 Dec 2011 07:43:57 +0100 Should we standardize that too? ;) p@rick -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

1 0

Re: [Mailman-Developers] MM 3.0 build error
by Mark Sapiro Dec. 20, 2011

Dec. 20, 2011

Panks wrote: >* >On Tue, Dec 20, 2011 at 3:45 AM, Panks <pankajxdx(a)gmail.com> wrote: >> >> But I want to know how should I go forward with making changes in code. I >> mean, do it need to re-install it from source to check the results, every >> time i make some changes in the code or is there any other way out. > >Basically I wanted to ask if I can use any IDE for for debugging, which can >make it easier to debug and test changes. You should be able to use any tools at your disposal to modify the installed Mailman, but ultimately, any changes you make should be applicable to the distributed source. One way of working would be to develop and test your changes against your installed Mailman, but ultimately make them against your copy of the bzr branch. Then, if you want your changes to make their way back to the trunk, you can propose a merge of your branch. Even if the changes are only for your own use, you can update your branch by merging updates from the trunk and then rebuild your installation. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Re: [Mailman-Developers] MM 3.0 build error
by Panks Dec. 20, 2011

Dec. 20, 2011

* * On Tue, Dec 20, 2011 at 3:45 AM, Panks <pankajxdx(a)gmail.com> wrote: > > > That was a just small silly mistake from my side. > Anyway, thank you. > So, I was able to build and install MM 3.0 successfully. > But I want to know how should I go forward with making changes in code. I > mean, do it need to re-install it from source to check the results, every > time i make some changes in the code or is there any other way out. > * > > * > *Pankaj* > *UG Student | **Dept. of Computer Science and Engineering* > *IIT Madras, Chennai, India* > * > * > Basically I wanted to ask if I can use any IDE for for debugging, which can make it easier to debug and test changes. * Pankaj* *UG Student | **Dept. of Computer Science and Engineering* *IIT Madras, Chennai, India*

1 0

Re: [Mailman-Developers] MM 3.0 build error
by Barry Warsaw Dec. 19, 2011

Dec. 19, 2011

Hi Pankaj, Thanks for downloading MM3 and giving it a try. Please note that the bzr branch is a little more up-to-date, and I'll be working over the xmas break to integrate authentication into the REST API. Once that's done, look for the first beta early in 2012. On Dec 18, 2011, at 11:31 PM, Panks wrote: >Hello everyone, >This is Pankaj, I have decent knowledge of C++ and a little bit >of practice in python (I did some projects in python), I am new to Mailman >and I am interested in contributing to it. Today I downloaded the source of >MM 3.0 from launchpad and saw few bugs, I installed apache and got it >running and installed Exim too, but while running _bootstrap.py_ from MM >source directory, I'm getting this output in terminal: We don't have official Exim integration yet. We really need an Exim expert to help us with the integration point, although given that (I believe) Exim supports LMTP, it might be pretty easy. We use LMTP to inject messages into MM3 from Postfix, and of course SMTP to inject messages into the MTA from MM3. >Traceback (most recent call last): > File "bootstrap.py", line 163, in <module> > options.setup_source).read().replace('\r\n', '\n') > File "/usr/lib/python2.7/urllib2.py", line 126, in urlopen > return _opener.open(url, data, timeout) > File "/usr/lib/python2.7/urllib2.py", line 394, in open > response = self._open(req, data) > File "/usr/lib/python2.7/urllib2.py", line 412, in _open > '_open', req) > File "/usr/lib/python2.7/urllib2.py", line 372, in _call_chain > result = func(*args) > File "/usr/lib/python2.7/urllib2.py", line 1201, in http_open > return self.do_open(httplib.HTTPConnection, req) > File "/usr/lib/python2.7/urllib2.py", line 1140, in do_open > h = http_class(host, timeout=req.timeout) # will parse host:port > File "/usr/lib/python2.7/httplib.py", line 693, in __init__ > self._set_hostport(host, port) > File "/usr/lib/python2.7/httplib.py", line 718, in _set_hostport > raise InvalidURL("nonnumeric port: '%s'" % host[i+1:]) >httplib.InvalidURL: nonnumeric port: '' Can you describe the exact steps you took to do the build? What OS are you using? It looks like you're using Python 2.7, which should be fine, but is that your distro's version of Python or a from-source build? Have you set up a mailman.cfg configuration file, and if so, please include its contents. Cheers, -Barry

2 1

MM 3.0 build error
by Panks Dec. 18, 2011

Dec. 18, 2011

Hello everyone, This is Pankaj, I have decent knowledge of C++ and a little bit of practice in python (I did some projects in python), I am new to Mailman and I am interested in contributing to it. Today I downloaded the source of MM 3.0 from launchpad and saw few bugs, I installed apache and got it running and installed Exim too, but while running _bootstrap.py_ from MM source directory, I'm getting this output in terminal: Traceback (most recent call last): File "bootstrap.py", line 163, in <module> options.setup_source).read().replace('\r\n', '\n') File "/usr/lib/python2.7/urllib2.py", line 126, in urlopen return _opener.open(url, data, timeout) File "/usr/lib/python2.7/urllib2.py", line 394, in open response = self._open(req, data) File "/usr/lib/python2.7/urllib2.py", line 412, in _open '_open', req) File "/usr/lib/python2.7/urllib2.py", line 372, in _call_chain result = func(*args) File "/usr/lib/python2.7/urllib2.py", line 1201, in http_open return self.do_open(httplib.HTTPConnection, req) File "/usr/lib/python2.7/urllib2.py", line 1140, in do_open h = http_class(host, timeout=req.timeout) # will parse host:port File "/usr/lib/python2.7/httplib.py", line 693, in __init__ self._set_hostport(host, port) File "/usr/lib/python2.7/httplib.py", line 718, in _set_hostport raise InvalidURL("nonnumeric port: '%s'" % host[i+1:]) httplib.InvalidURL: nonnumeric port: '' Can someone please help me with this. *-- Panks*

1 0

[internet-drafts@ietf.org: [EAI] I-D Action: draft-ietf-eai-mailinglistbis-01.txt]
by Patrick Ben Koetter Dec. 16, 2011

Dec. 16, 2011

FYI ----- Forwarded message from internet-drafts(a)ietf.org ----- Date: Thu, 15 Dec 2011 15:33:54 -0800 From: internet-drafts(a)ietf.org To: i-d-announce(a)ietf.org Cc: ima(a)ietf.org Subject: [EAI] I-D Action: draft-ietf-eai-mailinglistbis-01.txt Authentication-Results: mail.state-of-mind.de (amavisd-new); dkim=pass header.i=(a)ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Email Address Internationalization Working Group of the IETF. Title : Mailing Lists and UTF-8 Addresses Author(s) : John Levine Randall Gellens Filename : draft-ietf-eai-mailinglistbis-01.txt Pages : 8 Date : 2011-12-15 This document describes considerations for mailing lists with the introduction of internationalized email addresses. It outlines some possible scenarios for handling lists with mixtures of internationalized and traditional addresses, but does not offer implementation or deployment advice. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-eai-mailinglistbis-01.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ This Internet-Draft can be retrieved at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-eai-mailinglistbis-01.txt _______________________________________________ IMA mailing list IMA(a)ietf.org https://www.ietf.org/mailman/listinfo/ima ----- End forwarded message ----- -- state of mind () http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563

1 0

Re: [Mailman-Developers] feature request: one-click setting topreserve DKIM
by Mark Sapiro Dec. 7, 2011

Dec. 7, 2011

Monica Chew wrote: > >This is why Google Groups removes incoming DKIM signatures and >re-signs, because chances that the original signature survives are >vanishingly small given most people's list settings. And it is fairly simple to configure a Mailman installation to do the same, but this won't satisfy you unless the list is also anonymous. What do you say to some other service that applies the same policies as Gmail when they complain their users don't receive Google Groups mail from some senders? -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1

Re: [Mailman-Developers] feature request: one-click setting topreserve DKIM
by Mark Sapiro Dec. 7, 2011

Dec. 7, 2011

Monica Chew wrote: > >In any case, a non-default setting is not going to solve the problem >of senders from highly-phished domains to communicate with gmail and >yahoo users through mailman. How would the list members even know to >change this setting? The same way they now know that they aren't seeing this mail. The same way they ultimatly figure out that they never receive copies of their own posts to the list. BTW, you may be interested in the 3rd paragraph of the answer at <http://wiki.list.org/x/2IA9>. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0