Mailman 3 April 2015 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Re: [Mailman-Developers] mailman 3.0 roadmap, feature-parity with mailman 2.x and documentation
by Brian Carpenter May 4, 2015

May 4, 2015

> -----Original Message----- > From: Mailman-Developers [mailto:mailman-developers- > bounces+brian=emwd.com(a)python.org] On Behalf Of Danil Smirnov > Sent: Wednesday, April 29, 2015 4:24 PM > To: Mailman Developers > Subject: Re: [Mailman-Developers] mailman 3.0 roadmap, feature-parity > with mailman 2.x and documentation > > 2015-04-29 18:03 GMT+03:00 Brian Carpenter <brian(a)emwd.com>: > > Just to be clear, this is a stable fully working version of Mailman 3.0? I > > tried setting up Mailman 3 on a CentOS server about 2 weeks ago and had a > > number of issues including listinfo pages not working (404 errors), no clear > > directions on setting up users, various bugs such as internal server errors. > > The server admin that I had hired informed me there was a number of > python > > related bugs and he felt Mailman 3 was not ready for production use. > > > > I am ready to give this another try but I want to make sure that this > > version will be a full working version of Mailman 3. > > I had similar experience a week ago (after PyCon sprint) and there > were couple bugs in the installation process on Centos 7 including > hard one with bad virtualenv version which is still not reflected in > the installation manual: > https://bugs.launchpad.net/mailman/+bug/1445764/comments/19 > > I suppose anyone who try to install Mailman on Centos 7 will face this bug. > > Danil The OS was CentOS 6.5 in my case. Is there a recommended server environment to run Mailman 3? Brian

4 5

Congratulations to selected GSoCers
by Alangi Derick April 30, 2015

April 30, 2015

Hello, I just want to cease this opportunity and congratulate all selected GSoCers for this organisation this year 2015. Not with standing, i will like to contribute to this organisation, with or without GSoC. So i want to start from now so i can get myself familiar with the code base and start fixing bugs and writing patches. Regards Alangi Derick Ndimnain

1 0

mailman 3.0 roadmap, feature-parity with mailman 2.x and documentation
by shirish April 29, 2015

April 29, 2015

Hi all, Thank you for the unblemished service by Mailman. It is due to you that many FOSS projects continue to see the light of the day as email continues to hold its sway on developers rather than forums and mail management continues to be easier due to Mailman. Newbie here. I have been reading the Mailman wiki page specifically http://wiki.list.org/DEV/Mailman%203.0 Now from the wiki page :- "We aim to release Mailman 3.0rc1 in late April, 2015." - wiki entry While RC1 is hopefully round the corner there doesn't seem to be a roadmap at least within mailman. The launchpad series gives the following :- https://launchpad.net/mailman/+series What would be nice is if there is some ETA as to when 3.0 will be released to the general public. Are there going to be another 2-3-4 RC releases before 3.0 is ready ? Another query :- " It is not yet at full feature parity with Mailman 2.x, but we're working on that for 3.1. " - wiki entry on the same page. While this is good to know, is there a matrix of features somewhere which shows features of mailman 2.x vs mailman 3.0 . I am unable to find such a page in the wiki or perhaps I didn't search enough. In any case if there is a listing of features of both mailman 3.x and mailman 2.x would be helpful for both newbies as well as experienced users as it will look like a snapshot of the features integrated or used in the new release. It doesn't have to be finished today but if there is even some information about the existence of such a page with differences between 2.x and 3.x would be immensely helpful. Lastly, the documentation for 3.0.x seems to be a good way at http://gnu-mailman.readthedocs.org/en/latest/ would be nicer if there was a way to generate .pdf from the content therein. Look forward to trying out Mailman 3 soonish. -- Regards, Shirish Agarwal, Community Lead, Hamaralinux.org

4 3

Re: [Mailman-Developers] Welcome to GSoC 2015
by Sneha Priscilla April 29, 2015

April 29, 2015

Hi everyone, Congratulations to all the GSoC students selected this year! Looking forward to working with you. I think Abhilash has covered almost everything in his welcome email so I would advise all the students to go through that. :) A brief introduction about myself since I haven't spoken to some of you earlier: While I have never directly been a GSoC student for GNU Mailman, I have worked on Mailman under the Systers organisation (Postorius mainly) and was a co-mentor for the previous Summer of Code. My experience with this organisation and the people here has been a wonderful, inspiring one and I have learnt a LOT. I only hope you feel the same way at the end of this summer program and have fun along the way! Best, Sneha IRC: stylistica On Tue, Apr 28, 2015 at 6:05 PM, Ankush Sharma < ankush.sharma.ece12(a)iitbhu.ac.in> wrote: > Congratulations everybody and thanks to all Mailman mentors for their > constant support. > > Thanks, > Ankush Sharma > http://github.com/black-perl > > On Tue, Apr 28, 2015 at 7:06 AM, Stephen J. Turnbull <stephen(a)xemacs.org> > wrote: > > > Florian Fuchs writes: > > > Fellow friends of Mailman, dear students, > > > > > > welcome to GSoC 2015 (the Mailman edition)! > > > > Congratulations to all of the applicants on the high quality of > > applications! > > > > For those who were not selected, I'd be happy to discuss your > > applications off-list (and by mail, not IRC, I'm still catching up on > > $DAYJOB so replies may take a few days). > > > > > But now, without further ado, let's welcome our three GSoC > > > students: > > > > Congratulations to the selected students! > > > > And a personal note: > > > > > Bhavesh Goyal - A Dashboard for Admins/Owners/Moderators > > > Mentors: Abhilash Raj, Sneha Priscilla Makini > > > > I've mentored a similar project in the past (Shanu Salunke's "Mailman > > Interface" for Systers), so feel free to include me in discussions. > > > > That said, speaking as an individual mentor, I would really like to > > see most technical discussions take place on this list, or at least be > > summarized here. I hope folks not participating in GSoC will bear > > with us (hi, Andrew! some of your older posts are in my queue, someday > > soon...). Besides wanting to see what students I'm *not* mentoring > > are up to, we've had issues in the past where a project went off in an > > unprofitable (ie, hard to integrate) direction when the mentor and > > student were communicating almost exclusively in personal mail and IRC > > direct messages. > > > > Although your mentor has a *responsibility* to answer you, the rest of > > us care and want to contribute, and that's easiest if you post to this > > list. > > > > Here's to a fun and productive summer for everyone! > > > > Steve > > > > > > _______________________________________________ > > Mailman-Developers mailing list > > Mailman-Developers(a)python.org > > https://mail.python.org/mailman/listinfo/mailman-developers > > Mailman FAQ: http://wiki.list.org/x/AgA3 > > Searchable Archives: > > http://www.mail-archive.com/mailman-developers%40python.org/ > > Unsubscribe: > > > https://mail.python.org/mailman/options/mailman-developers/ankush.sharma.ec… > > > > Security Policy: http://wiki.list.org/x/QIA9 > > > _______________________________________________ > Mailman-Developers mailing list > Mailman-Developers(a)python.org > https://mail.python.org/mailman/listinfo/mailman-developers > Mailman FAQ: http://wiki.list.org/x/AgA3 > Searchable Archives: > http://www.mail-archive.com/mailman-developers%40python.org/ > Unsubscribe: > https://mail.python.org/mailman/options/mailman-developers/24.sneha%40gmail… > > Security Policy: http://wiki.list.org/x/QIA9 >

1 0

ANNOUNCING: GNU Mailman 3.0
by Barry Warsaw April 28, 2015

April 28, 2015

Twenty years ago, I attended the first Python Workshop at NIST with about 20 other old school Pythonistas. Earlier this month I attended PyCon 2015 in Montreal. PyCon is always exhilarating, but this one was incredibly special for me personally, because my son was on spring break and joined me for the first half of the conference. Both the Python language and its community have grown a little bit <wink> in the intervening years, but what hasn't changed is our love of the language, and the truly amazing people we share that love with. The Python community really is one of the very best open source communities on the planet. The best community inside that great Python family has to be the GNU Mailman team. They're all smart and cool, fun to hang out with, and fun to hack with. With diverse backgrounds, each and every one are good friends and valued technical peers. As has been the case for the last few years, we've sprinted on Mailman 3, getting lots of great work done, but never quite getting something we were satisfied enough with to release. The first alpha of Mailman 3 was released a little over 7 years ago. And so I'm here --and on behalf of Abhilash, Aurélien, Florian, John, Mark, Stephen, Sumana, Terri, our GSoC students, and all the great people who have contributed over the years-- to proudly announce the official release of GNU Mailman 3.0, code named "Show Don't Tell". Mailman 3 is really a suite of 5 tools: * The core, which provides the mail delivery engine, the unified user model, moderation and modification of email messages, and interfaces to external archivers; * Postorius, our new Django-based web user interface for users and list administrators; * HyperKitty, our new Django-based web archiver, providing rich access to the historical record of mailing list traffic; * mailman.client, the official Python bindings to the core's REST API; * mailman-bundler, a set of scripts to make it easy to deploy the full suite inside Python virtual environments. What's new about Mailman 3? Well, lots! Some highlights include: * Backed by a relational database; * True support for multiple domains, with no cross-domain mailing list naming restrictions; * One user account to manage all your subscriptions on a site; * The core's functionality exposed through an administrative REST+JSON API; * All passwords hashed by default, and no monthly password reminders! * Users can post to lists via the web interface; * Built-in archive searching! and more. Tons more. There will be things you love about Mailman 3, and things you don't like. You'll glimpse great possibilities and glaring holes. You'll be excited and frustrated. Such is life with an all-volunteer free software project. For the things you like, and the exciting possibilities, we encourage you to experiment, to do wacky things we haven't thought of, integrate it with your own tools, or just carefully go about deploying a Mailman 3 system. Tell us how you're using it! For the things you don't like, we invite you to join us. Come to the mailing list <mailman-developers(a)python.org> and talk with us. Submit bug reports and pull requests. Help us close the gaps and make Mailman 3 better. Whether your interests are for Internet RFCs, web site development, operations, or you just want to find a fun Python project to hack on with cool people, as they say, contributions are welcome. See the release notes, as well as links to download each component: http://wiki.list.org/Mailman3 You probably want to start with the bundler and let it grab and install all the other parts. More information is available at: http://www.list.org http://wiki.list.org http://launchpad.net/mailman #mailman on freenode mailman-developers(a)python.org Happy Mailman Day, -Barry & the Mailman Cabal

2 1

Re: [Mailman-Developers] web-interface for site owner for mm 2.1.x
by Mark Sapiro April 28, 2015

April 28, 2015

On 04/28/2015 11:02 AM, Danil Smirnov wrote: > > Nope. She has serious reasons to avoid using cPanel's Mailman. > So it was disabled in favor of standard Mailman installation. > I can give more details but webpanel talk is irrelevant > to the topic of this discussion. Then if she is going to create lists and turn them over to others to admin and the others are going to change the admin password so she doesn't know it, there are two choices for removing the list short of writing your own CGI or WSGI process to do it: - there is the command line bin/rmlist tool - you could modify Mailman/Cgi/rmlist.py and remove the 10 lines of code starting with # Be sure the list owners are not sneaking around! if not mm_cfg.OWNERS_CAN_DELETE_THEIR_OWN_LISTS: and ending with return which would then allow anyone who knows the site admin, site list creator or list admin password to go to a URL like http://example.com/mailman/rmlist/LISTNAME and remove the list. If you wanted to limit it to only the site admin or site list creator passwords, further down in the code, find if mlist.Authenticate((mm_cfg.AuthCreator, mm_cfg.AuthListAdmin, mm_cfg.AuthSiteAdmin), password) == mm_cfg.UnAuthorized: and remove the mm_cfg.AuthListAdmin, line. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Re: [Mailman-Developers] web-interface for site owner for mm 2.1.x
by Mark Sapiro April 28, 2015

April 28, 2015

On 04/28/2015 09:59 AM, Danil Smirnov wrote: > > But I have the client who asked me to install Mailman for her and > intend to administer the installation by herself. > She is not familiar with ssh/Linux console and uses cPanel-based hosting. cPanel provides a version of Mailman and has it's own list creation and deletion cPanel interface outside of the Mailman web UI. It seems if you used that, it would solve your problem. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1

Re: [Mailman-Developers] web-interface for site owner for mm 2.1.x
by Mark Sapiro April 28, 2015

April 28, 2015

On 04/28/2015 09:33 AM, Danil Smirnov wrote: > > How do you think, should site owner have an ability to remove lists > from web interface also? This will be available in MM 3. If you are asking if a site admin can remove a list via the web UI if the OWNERS_CAN_DELETE_THEIR_OWN_LISTS setting is the default No, the answer for MM 2.1 is no and there is no plan to change that. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1

web-interface for site owner for mm 2.1.x
by Danil Smirnov April 28, 2015

April 28, 2015

2015-04-28 19:17 GMT+03:00 Mark Sapiro <mark(a)msapiro.net>: > If you set > > OWNERS_CAN_DELETE_THEIR_OWN_LISTS = Yes > > in mm_cfg.py, every page in Mailman's admin GUI will have a "Delete this > mailing list (requires confirmation)" link under "Other Administrative > Activities". Without this setting, the link is not there and attempts to > remove a list via the http(s)://example.com/mailman/rmlist/LISTNAME CGI > will fail. Hi everybody! How do you think, should site owner have an ability to remove lists from web interface also? We have separate password for list creation which can be set different from site owner password. We have special email alias "mailman-owner(a)domain.tld" which belongs to whole installation admin. So we already have credentials for site owner to let him/her log in. Probably we also need full administration web interface for all mm_cfg.py amendments to avoid using console for the administration of Mailman installation at all. I wonder if nobody interested in this? Danil

1 0