Mailman 3 March 2014 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Re: [Mailman-Developers] Testing MM3
by Stephen J. Turnbull March 28, 2014

March 28, 2014

Kẏra writes: > Well, I haven't done either of those yet, but I'd love some help > doing so! If you or anyone else has the time to assist, my irc > handle is kxra on freenode, oftc, and gnome Hrm. I'm not in the habit of hanging around on IRC (even during GSoC when I should do so :-( ), but we could make an appointment -- I mostly am free to do what I want to when I want to for the next few weeks at least. I can generally handle anything 01:00 - 17:00 UTC. Handle is yaseppochi@freenode. > just how i can keep track of the work being done towards the next beta > release. like a page which lists the tasks that need to be done and where > they stand. I suspect the only reliable list is in Barry's head. The bug.launchpad.net/mailman page is pretty complete, but I'm not sure all the Mailman 3-related bugs are tagged "mailman3", and of those, I'm not sure the showstoppers are all tagged or priorities set on non-showstoppers. Barry would probably go through the tracker and update bugs if you ask. My suspicion is that his policy on such requests is "ask nicely - and repeat at polite intervals". ;-) I suppose I could do a lot of the legwork and save him some time, but I'm much better at helping people than doing homework. :-(

2 1

Re: [Mailman-Developers] Testing MM3
by Barry Warsaw March 28, 2014

March 28, 2014

On Mar 28, 2014, at 12:01 AM, Kẏra wrote: >I keep hearing about the need for migration scripts, but all indicates that >these do not exist yet (via blocking bug for the next MM3 beta). Is that >true? > >Is there a way to keep tabs on the progress towards the beta 4 release? >looking at launchpad, it looks like development and beta releases were >steady up to the last beta. Is there a reason for that? Aurelien submitted this merge proposal a while back: https://code.launchpad.net/~abompard/mailman/import21/+merge/192146 It improves the import command for migrating from MM2 to MM3. It's a big branch and needs some fixes, but it's generally pretty good and I have been slowly working my way through it. I should push my WIP merge to Launchpad for others to take a look at. Mostly I'm trying to flesh out the related tests. -Barry

1 0

Re: [Mailman-Developers] Testing MM3
by Stephen J. Turnbull March 28, 2014

March 28, 2014

Kẏra writes: > I keep hearing about the need for migration scripts, but all > indicates that these do not exist yet (via blocking bug for the > next MM3 beta). Is that true? Yup. It's not hard, if you have the skills necessary to setup a current Mailman 3 beta installation, you almost certainly have the skills to migrate Mailman 2 lists to a Mailman 3 installation (perhaps with consultation here!) Obviously, we can't require even that level of skill in a public release, so the scripts are a blocker. But such scripts are a non-trivial exercise even when what they implement is "easy": they need documentation, tests, and intelligible error and warning messages. > Is there a way to keep tabs on the progress towards the beta 4 > release? looking at launchpad, it looks like development and beta > releases were steady up to the last beta. Is there a reason for > that? I'm not sure what you're asking.

2 1

Testing MM3
by Stephen J. Turnbull March 28, 2014

March 28, 2014

Kẏra writes: > Is there a page documenting how to start testing MM3 with > postorius+hyperkitty and how to upgrade from MM2? The relevant and up-to-date documentation is mostly in the docs in the source trees of the various projects. Some effort has been made to update the wiki, but I doubt it's thorough. The Mailman sprint at PyCon in April is likely to spend time on this issue (hopefully only the 5 minutes needed to announce a previous success :-).

2 1

Mailman 3 / Hyperkitty presentation at LibrePlanet 2014 Boston
by Máirín Duffy March 26, 2014

March 26, 2014

Hi folks, Just a head's up that this weekend I'm going to be giving a presentation about Mailman 3 - mostly focused on Hyperkitty - at LibrePlanet in Boston this coming weekend. I'm going to give an overview of the design process, the implementation progress made, and also report on Karen Tang's work on the Hyperkitty UI for the Outreach Program for Women internship period that just finished up. It looks like the conference will be streaming live so if you want to watch and heckle me virtually, the talk is after lunchtime east coast time on Sunday: https://libreplanet.org/2014/live/ I'm intending to 'convert' the presentation into a blog post too so if you miss it and are curious I can link back to that once it's written (post-presentation.) ~m

2 3

Hyperkitty usability testing at SpinachCon (LibrePlanet 2014)
by Máirín Duffy March 26, 2014

March 26, 2014

Hi folks, One of the events affiliated with LibrePlanet this past weekend was an event called 'SpinachCon' (so named because letting projects know about usability bugs is helpful, like pointing out spinach in a friend's teeth. :) ) My colleague Ryan Lerch and I hosted a Hyperkitty table at SpinachCon to get some Hyperkitty testing done - we had 8 test participants who worked through 6 tasks in the interface and then filled out a questionnaire about their experience. Hyperkitty did really well in testing. It scored high marks on look and feel, and users had very positive things to say in the freeform fields on the questionnaire. The most prominent issue throughout the tests and across users was search; Aurélien has already been looking into search improvements, so I think we already knew this too :) I've written a high-level blog post summary of the results (which also talks about the mechanics of the testing as well) here: http://blog.linuxgrrl.com/2014/03/25/hyperkitty-at-the-0th-spinachcon I also transcribed and collated the raw test data here, which includes tester demographics/background as well as the content of their questionnaires and the per-task notes they took as they completed the test: https://fedorahosted.org/hyperkitty/wiki/SpinachConZero Our Hyperkitty OPW intern Karen Tang was able to come out too, and she caught the last couple of hours of SpinachCon. She's been working on making Hyperkitty's UI responsive & mobile-friendly, and is interested in working on the same for Postorious now that her internship is over, so you might be hearing from her soon regarding that. Deb Nicholson, who organized SpinachCon, mentioned that she's looking at doing another one in Boston in May, so I am planning to bring Hyperkitty (and potentially Postorious?) to that one as well! ~m

1 0

Testing MM3
by Kẏra March 25, 2014

March 25, 2014

Is there a page documenting how to start testing MM3 with postorius+hyperkitty and how to upgrade from MM2? -- Board of Directors, Free Culture Foundation: www.freeculture.org Blog: http://kxra.info - StatusNet Microblog: http://identi.ca/kxra Email: kxra(a)freeculture.org - SMS: +1.617.340.3661 Jabber/XMPP: kxra(a)riseup.net - IRC: kxra @freenode @oftc @indymedia

1 0

Re: [Mailman-Developers] Moderation rules priority
by Ian Eiloart March 25, 2014

March 25, 2014

Hi, That’s interesting. Is it a script that can be called from the command line? If so, maybe Exim could call it directly, instead of using an LMTP callout. On 20 Mar 2014, at 17:10, Jim Popovitch <jimpop(a)gmail.com> wrote: > On Thu, Mar 20, 2014 at 9:17 AM, Ian Eiloart <iane(a)sussex.ac.uk> wrote: >> >> For me, the big win for spam prevention with mailing lists is the restriction on posters: it's what keeps mailing lists relatively spam free. Most sites don't like to bounce messages that they've previously accepted, so that means that the spam gets held for moderation, which creates a lot of work for list owners. If list bound mail can be rejected by the MTA at SMTP time, that would save a lot of work for list owners. > > Sorry, haven't been following along... > > I discussed this several months back on the main list. > https://mail.python.org/pipermail/mailman-users/2013-August/075523.html > > Basically I hacked a copy of find_member into scripts/check_subscriber: > (http://paste.debian.net/hidden/c36ff81c/ ) > > check_subscriber is called by multiple postfix tcp_tables (one per > list post addr in master.cf), such that incoming emails are checked > against the membership list, and smtp rejected if not subscribed. > Let me know if you want more details. > > -Jim P. > _______________________________________________ > Mailman-Developers mailing list > Mailman-Developers(a)python.org > https://mail.python.org/mailman/listinfo/mailman-developers > Mailman FAQ: http://wiki.list.org/x/AgA3 > Searchable Archives: http://www.mail-archive.com/mailman-developers%40python.org/ > Unsubscribe: https://mail.python.org/mailman/options/mailman-developers/iane%40sussex.ac… > > Security Policy: http://wiki.list.org/x/QIA9 -- Ian Eiloart Postmaster, University of Sussex +44 (0) 1273 87-3148

2 1

small logging change for ListAdmin.py
by Stephen Willey Mats Mats March 21, 2014

March 21, 2014

Please consider this small logging change. This helps trace issues, or claimed issues, with message moderation. Also, it adds symmetry with many of the messages that log mail going into a moderated state. Patch is against 2.1.17 thanks, steve --- ListAdmin.py 2013-12-12 19:40:27.276252413 -0800 +++ /usr/local/mailman/Mailman/ListAdmin.py 2014-03-21 11:59:50.826700290 -0700 @@ -285,8 +285,8 @@ # message directly here can lead to a huge delay in web # turnaround. Log the moderation and add a header. msg['X-Mailman-Approved-At'] = email.Utils.formatdate(localtime=1) - syslog('vette', 'held message approved, message-id: %s', - msg.get('message-id', 'n/a')) + syslog('vette', '%s held message approved, message-id: %s', + self.internal_name(), msg.get('message-id', 'n/a')) # Stick the message back in the incoming queue for further # processing. inq = get_switchboard(mm_cfg.INQUEUE_DIR)

2 1