Mailman 3 October 2015 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 08 Nov '22

08 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Let's try to package mailman3 in Debian!
by Pierre-Elliott Bécue 22 Feb '16

22 Feb '16

Hey, As a Debian fanboy and also a mailman addict, I'd like to try packaging it in Debian. As I'm not a DD and as I'm not in a hurry, I'd like to take some time to think about what would be relevant. For that, I'd like to have some help. And I was suggested to come here and ask. I decided to use https://gitlab.com/groups/mailman as a basis for my work. First of all, to create the source package, I've to think about what to put in it. It seems that if I want to have a good source package, I need 5 repos : - Mailman - HyperKitty - Postorius - HyperKitty - MailMan Plugin - MailmanClient My first question is "Am I right?". And the second one is whould I consider looking into mailman-suite-doc and also have it in the source package? On another way, I also see that there is a standalone postorius repo and also some django project files for HyperKitty in another one. I have the impression it is more designed for people to work on as standalone - forkable projects for other features, and so I wouldn't need them in a Debian package. Am I also right? Thanks for your answer, I hope I'll be able to make this package look as you'd like. :) Cheers, -- PEB

5 13

Mozilla funding opportunity for Mailman work
by Sumana Harihareswara 21 Nov '15

21 Nov '15

Hi Cabal. I'm sorry that I've neglected Mailman so much for the past several months; I've just registered for PyCon 2016 and will be ramping up my participation especially leading up to that. Mozilla https://blog.mozilla.org/blog/2015/10/23/mozilla-launches-open-source-su pport-program/ has just announced that it wants to "identify up to 10 projects we rely on and can fund in a thoughtful, meaningful way by December 12th". They use Mailman and if we can identify useful ways they can spend that money to advance Mailman's development and usefulness to them (e.g., paying for someone's time to get packaging or localization to a better state), I'd be happy to take point on organizing that proposal. Again, regrets on my absence. -- Sumana Harihareswara http://brainwane.net

4 4

listadmin script
by n 29 Oct '15

29 Oct '15

Hello, (I hope I'm not off topic..) Since I maintain a couple of dozen lists, I need a way to reduce the time taken to process them. I use listadmin[1], a command line tool to manipulate the queues of messages held for moderator approval and subscription requests. It's a great tool that saved me a lot of time. But, sadly, the upstream author does not work anymore on the listadmin script since years. So, new versions of mailman brings new bugs, and make it less and less usable[2]. It's not a big script, but I haven't the technical skills to maintain it. I was hoping that someone on this list, with the inside knowledge of mailman, could maintain it, or write something similar. It would save me (and others) so much time ! Thank you for your work on mailman, ned [1] http://heim.ifi.uio.no/kjetilho/hacks/#listadmin [2] https://bugs.debian.org/cgi-bin/pkgreport.cgi?pkg=listadmin and others unreported.. --

3 5

New DMARC workaround hack
by John Levine 21 Oct '15

21 Oct '15

Take a look at these: https://tools.ietf.org/html/draft-andersen-arc-00 https://tools.ietf.org/html/draft-jones-arc-usage-00 These add new headers based on DKIM that document a chain of custody for mail. It would let mail providers accept list mail that DMARC would otherwise reject. The drafts are a mess (the XML versions are easier to read than the txt), but I think the design is sound. They are intended to be implemented via upgraded DKIM libraries, and the idea is to allow lists to work like they always have, without any changes visible to users. You can intuit from the authors who's likely to implement it. It'd be helpful for people to look at it and write to the contact address in the first draft and tell them how likely it is that Mailman would support it, or what problems it would present. R's, John

1 0

Re: [Mailman-Developers] Initial experiments with Mailman 3/Buildout
by Simon Hanna 17 Oct '15

17 Oct '15

> Installing mailman-web. > Error: There is a version conflict. > We already have: pbr 1.8.1 > but lockfile 0.11.0 requires 'pbr!=0.7,<1.0,>=0.6'. It looks like lockfile does not actually need a specific version of pbr. https://bugs.launchpad.net/pylockfile/+bug/1506679 not sure though since I manually installed mailman

1 0

Initial experiments with Mailman 3/Buildout
by Andrew Hodgson 17 Oct '15

17 Oct '15

Hi, I have looked in several list archives for different approaches for Mailman 3 installation, and am trying a few things. I have got a new Debian 8.2 install, and installed the Python 2 and 3 developer tools etc. I am making a virtual environment in /opt/mailman. When running buildout, I get up until this point: […] Getting distribution for 'djangorestframework>=3.0.0'. warning: no previously-included files matching '__pycache__' found under directory '*' warning: no previously-included files matching '*.py[co]' found under directory '*' Got djangorestframework 3.2.4. Getting distribution for 'django-gravatar2>=1.0.6'. zip_safe flag not set; analyzing archive contents... Got django-gravatar2 1.3.0. While: Installing mailman-web. Error: There is a version conflict. We already have: pbr 1.8.1 but lockfile 0.11.0 requires 'pbr!=0.7,<1.0,>=0.6'. Any ideas as to how to resolve? Thanks. Andrew.

1 0

Re: [Mailman-Developers] Off topic : Regarding Python
by Mark Sapiro 09 Oct '15

09 Oct '15

On 10/08/2015 11:40 PM, Aswin kumar wrote: > > I am new to python programming language and I saw that there are two > versions python2 and python3. Which one should I start learning ? Should I > learn python2 first and then switch to python 3? I am asking this question > here as maiman3 has switched to python3 , but some other projects still > stick to python2, so I am kind of confused which version to start with. Definitely start with Python 3. There is still much legacy Python 2 code, and many projects have a hard time porting to Python 3 because of dependencies on other packages which are still Python 2, but the future is Python 3, and any new code is best as Python 3. The only reason to learn Python 2 at this point is if you are tasked with supporting a legacy Python 2 project. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1

Off topic : Regarding Python
by Aswin kumar 09 Oct '15

09 Oct '15

Hi, I am new to python programming language and I saw that there are two versions python2 and python3. Which one should I start learning ? Should I learn python2 first and then switch to python 3? I am asking this question here as maiman3 has switched to python3 , but some other projects still stick to python2, so I am kind of confused which version to start with. Regards, Aswin

1 0

substitution variables
by Lindsay Haisley 08 Oct '15

08 Oct '15

I've hacked per-post AES encryption of subscriber addresses into Decorate.py so that I have a subscriber address identifier available for situations where subscribers have lost redirections in force and can't get headers to me. Everything works, and I can use the substitution %(user_skey)s in the footer, but I get a nasty warning on the Non-digest options page, "Warning: The following illegal substitution variables were found in the msg_footer string: user_skey". Where in the code can I list this substitution variable so that it doesn't throw this error on this page? -- Lindsay Haisley | "The only unchanging certainty FMP Computer Services | is the certainty of change" 512-259-1190 | http://www.fmp.com | - Ancient wisdom, all cultures

2 4