Mailman 3 September 2011 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Faulty Member Subscribe/Unsubscribes
by Andrew Case 29 Sep '11

29 Sep '11

My configuration: Mailman: 2.1.14 OS: Solaris 10 Python: 2.4.5 PREFIX = '/usr/mailman' Server setup: 1 server for web management, 1 server for MTA/qrunner. /usr/mailman is NFS mounted on both servers I've been having the following issue my mailman lists: A user is either subscribed or unsubscribed according to the logs, but then if I look at the member list, the action has not been done (or has been undone). For example, here is where I remove a subscriber and then look at the list members and they are still in the list: [mailman@myhost] ~/logs |> grep testlist subscribe | grep acase Sep 28 17:15:14 2011 (4401) testlist: new acase(a)example.com, admin mass sub Sep 28 17:19:36 2011 (5821) testlist: deleted acase(a)example.com; member mgt page [mailman@myhost] ~/logs |> ../bin/list_members testlist | grep acase acase(a)example.com [mailman@myhost] ~/logs |> The same also happens when subscribing. I will mass subscribe users (or when users confirm subscription via email/web), the logs indicated that they have been subscribed successfully, but then when I go look them up, they are not listed on the members list. This happens sporadically, but I am generally able to reproduce the error if I do it a couple times in a row. I'm suspicious there may be a locking issue and config.pck is reverting to config.pck.last. I found this thread rather helpful in analyzing potential problems, but I have yet to figure anything out: http://web.archiveorange.com/archive/v/IezAOgEQf7xEYCSEJTbD In addition if I just run the following commands over and over, then the bug never seems to come up. This is part of why I am worrying about locking: bin/add_members ... bin/remove_members ... Is there a good way to test locking between servers? I've run the tests/test_lockfile.py, but it reports it is OK. Any and all help would be GREATLY appreciated. We've been trying to triage this bug for weeks and it is terribly disruptive for our users. Thanks, -- Drew

2 11

Hello
by Felipe Gasper 29 Sep '11

29 Sep '11

Hi all, Barry said to email this list with an interest in helping with UI for MM3. I’ve done UI development for cPanel, Inc. for the past couple years. I’m fluent with Perl and JS/CSS/HTML/etc. I messed with Python a tiny bit about 8 years ago; I’m hoping to beef up my skills in that area as part of helping out with MM3. I’d say I’m reasonably well-versed in SMTP. I’ve used Git and SVN; Bazaar will be new to me. I’m looking forward to helping out. cheers, -Felipe Gasper Houston, TX

3 2

Re: [Mailman-Developers] [Bug 860159] Re: Mailman 3.0 support for Postgres
by Barry Warsaw 27 Sep '11

27 Sep '11

On Sep 27, 2011, at 12:44 AM, Stephen A. Goss wrote: >I've attached a branch with the Postgres support code that I've cooked >up. Fantastic, thanks! Do be sure to add a merge proposal. >3. There is now an alternate mailman_pg.sql file which is used to create >the tables. Currently, two foreign key constraints are commented out >because those are violated in Mailman 3 (apparently this doesn't bother >SQLite). Some column TYPES are different from mailman.sql. Classes are >created in a slightly different order due to FK constraint creation >requires the referenced table to actually exist. The primary key indexes >defined after each class are probably redundant, as those are created >automatically for SERIAL columns defined as PRIMARY KEY in Postgres. Do you have any thoughts on whether the two .sql files can possibly be shared? My biggest concern is that it will be difficult-ish to keep them in sync as I add or modify the SQLite version. If it's not possible, so be it. I took a quick look at the Python changes, and I think I'm going to refactor the code to not hardcode so much in stock.py. For example, I'll probably rename StockDatabase to SQLiteDatabase and add a PostgresDatabase class, adding a common super class. That way, you'd only need to put this in your mailman.cfg file: [database] class: mailman.database.postgres.PostgresDatabase Don't worry about that too much, I can make that change when I merge your branch. >4. Probably more FK constraint violations exist that my tests haven't >uncovered. I'd definitely like to be able to run the test suite against Postgres, if even for now it's a manual select (e.g. because Postgres would obviously have to be installed and configured in order to work).

2 2

RELEASED: Mailman 3.0 alpha 8
by Barry Warsaw 25 Sep '11

25 Sep '11

I am very happy to announce the release of the eighth alpha for Mailman 3.0, code named "Where's My Thing?". This is the last planned alpha release, as I want to work toward the first beta in order to meet my goal of an 11/11/11 final release (of the core engine at least). If you've been holding off looking at Mailman 3, I invite you to do so now. Once beta 1 is released I will not be adding any new features. I do hope to put up a few live test lists soon, so stay tuned. There have been a large number of fixes and new features, especially in the REST API. My thanks go to Stephen Goss who has contributed greatly to this release, with bug reports, wish list items, patches, and merge proposals. Full details of what's new in 3.0a8 is available here: http://tinyurl.com/6yxgclf The tarball can be downloaded from Launchpad or the Cheeseshop: https://launchpad.net/mailman http://pypi.python.org/pypi/mailman/3.0.0a8 The full documentation is also online: http://packages.python.org/mailman/ Enjoy, -Barry

1 0