Mailman 3 August 2016 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Translation
by Simon Hanna Jan. 10, 2017

Jan. 10, 2017

Hi, I just completed setting up the Mailman 3 projects on zanata.org They can be found here: https://translate.zanata.org/project/view/mailman https://translate.zanata.org/project/view/postorius https://translate.zanata.org/project/view/hyperkitty I'm hesitating to ask people to translate because zanata is really slow and I'm afraid of scaring people away from translating mailman in the future :D Anyhow, I'm writing to ask for your opinions. What do you think about zanata? Maybe you can try translating a couple of things and report how you feel about it. I stumbled across a few other open source solutions: https://translatewiki.net http://pootle.locamotion.org/ https://demo.weblate.org/ This mediagoblin issue discussed some alternatives when they switched away from transifex. https://issues.mediagoblin.org/ticket/913 There seems to be a pootle server run by gnu itself. https://chapters.gnu.org/pootle/ What do you think? Simon

4 9

Docker files for mailman
by Simon Hanna Nov. 18, 2016

Nov. 18, 2016

Hi, I started working on docker files for Mailman. I created three repositories: - https://github.com/simonsmiley/postorius-docker Holds the files needed to create a postorius container - https://github.com/simonsmiley/mailman-docker Holds the files needed to create a core container - https://github.com/simonsmiley/mailman-compose Holds docker-compose files that greatly simply the process of running the containers * The mailman repo currently lacks documentation * Currently no emails can be sent. I still have to figure out what the best way is... * Hyperkitty will be added next (together with a complete "bundler" install) I pushed two images to the docker hub. Their names are thelinuxguy/postorius and thelinuxguy/mailman I created two organizations mailman on docker hub and gnu-mailman on github https://github.com/gnu-mailman https://hub.docker.com/u/mailman/ I know we shouldn't use github, but there is no way around github/bitbucket for automated builds on docker hub. I post here to inform you about the docker images and I also to ask if I'm allowed to keep these two organizations and move my images/repos there. I'll happily give push/owner access to additional people if requested. The repositories could be mirrored to the gitlab mailman group, sadly the process doesn't work the other way round just yet. In case this request gets denied, I'll just remove the organizations and let the images be "unofficial". cheers, Simon

2 1

Sequence of steps?
by Roy Harvey Aug. 30, 2016

Aug. 30, 2016

I manage a Mailman list. I believe the situation I describe is not one that can be corrected by changing the configuration, but would require coding changes. (I would love to be wrong!) As such I don't expect anything to be changed, but perhaps it can end up on someone's list of requested features for eventual consideration. So here is the situation. 1) The list is text-only, so messages with fancy formatting are converted to simple text. Attachments such as photos are discarded. 2) The maximum message size is set to 10KB.* 3) Messages with elaborate formatting, but little text are often larger than 10KB, so they are held for review. That means the test for size comes BEFORE the message is "cleaned up" and reduced to simple text. My suggestion is to change the sequence of steps, so that the size filter is applied AFTER the message has been converted to plain text. I hope that is clear enough. Yes, I understand changing the order of things is No Small Thing. I figure it can't hurt to put it out there. Thanks for listening! Roy Harvey Beacon Falls, CT * (Because subscribers replying to Digest messages regularly fail to remove the text of the Digest message they are replying to, the maximum message size is set to 10KB. This also blocks messages with attached photos, which will be removed anyway because the list is text-only. I review messages held because of size. The ones with a full Digest are rejected with an explanation about removing the Digest being replied to. The ones with photos attached are rejected with an explanation about putting them on the web and posting a link. The ones that are blocked because they are long messages, or short messages with too much formatting, are approved.)

3 3

Re: [Mailman-Developers] [Mailman-Users] Mailman 2.1.23 release and fix for CVE-2016-6893
by Mark Sapiro Aug. 27, 2016

Aug. 27, 2016

On 08/27/2016 07:03 AM, Jim Popovitch wrote: > I'm not seeing the CVE-2016-6893 fix in bazzar at > https://code.launchpad.net/~mailman-coders/mailman/2.1, shouldn't it > be there now too? It's there now. Thanks for the reminder. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Mailman 2.1.23 release and fix for CVE-2016-6893
by Mark Sapiro Aug. 27, 2016

Aug. 27, 2016

I am pleased to announce the release of Mailman 2.1.23. Python 2.4 is the minimum supported, but Python 2.7 is strongly recommended. This release contains a fix for CVE-2016-6893 which is also attached here as a patch. It also has new features, a few i18n updates and some bug fixes. See the attached README for details. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org http://www.gnu.org/software/mailman http://mailman.sourceforge.net/ http://mirror.list.org/ Mailman 2.1.23 can be downloaded from https://launchpad.net/mailman/2.1/ http://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

wiki.list.org theme
by Jim Tittsler Aug. 26, 2016

Aug. 26, 2016

In February, 2015 I changed the wiki.list.org theme to match the then current Mailman site theme. Since then, list.org got a much needed makeover. I've been trying to avoid volunteering to update the wiki theme, but you've cleverly out-waited me. May I have access to the wiki machine so that I can change the theme with access to the current content? Or, would someone be willing to archive up the current content/config and send it to me? The last time I overlooked some of the corner cases because I was working with my standard MoinMoin rather than the wiki.list.org content and configuration. Jim -- Jim Tittsler, Tokyo irc.freenode.net

3 8

Re: [Mailman-Developers] Remediation for fake member creation
by Franck Martin Aug. 24, 2016

Aug. 24, 2016

----- Original Message ----- > From: "Stephen J. Turnbull" <turnbull.stephen.fw(a)u.tsukuba.ac.jp> > To: "Franck Martin" <franck(a)peachymango.org> > Cc: "Barry Warsaw" <barry(a)list.org>, "mailman-developers" <mailman-developers(a)python.org> > Sent: Monday, August 22, 2016 9:06:31 PM > Subject: Re: [Mailman-Developers] Remediation for fake member creation > Franck Martin writes: > > > May be a captcha? Or some more modern techniques... > > Captchas aren't applicable to email requests. It will be harder than > that. yes but protecting the web form from non-human subscription is a good step to take > > WDOT? Can't you send the email subscription request to moderation before the email confirmation is sent? Not ideal, but it is kind of like emergency moderation.

2 1

Re: [Mailman-Developers] Remediation for fake member creation
by Franck Martin Aug. 23, 2016

Aug. 23, 2016

----- Original Message ----- > From: "Barry Warsaw" <barry(a)list.org> > To: "mailman-developers" <mailman-developers(a)python.org> > Sent: Monday, August 22, 2016 2:43:06 PM > Subject: Re: [Mailman-Developers] Remediation for fake member creation > On Aug 22, 2016, at 01:03 PM, Franck Martin wrote: > >>While mailman does double opt-in, one can still fill a mailbox with account >>confirmations, what are the methods to stop a bot submitting email addresses >>for registration across several lists? > > Mailman 3 will not pend a registration request more than once for an > email/mailing list combination. It's possible to spam every list at least > once though, and I'm not sure what you could do about that. May be a captcha? Or some more modern techniques...

2 1

Re: [Mailman-Developers] Remediation for fake member creation
by Barry Warsaw Aug. 22, 2016

Aug. 22, 2016

On Aug 22, 2016, at 01:03 PM, Franck Martin wrote: >While mailman does double opt-in, one can still fill a mailbox with account >confirmations, what are the methods to stop a bot submitting email addresses >for registration across several lists? Mailman 3 will not pend a registration request more than once for an email/mailing list combination. It's possible to spam every list at least once though, and I'm not sure what you could do about that. Cheers, -Barry

1 0