Mailman 3 May 2017 - Mailman-Developers

Add information on first line of email
by Stephen J. Turnbull 20 May '17

20 May '17

David Terni writes: > Hi, > I need to use the text of "description or information filed" used to > describe the mailinglist and put this information in the firsts lines > e-mail. Like the credits but on head of email. > > How I can do it? You'll have to manually copy it to the "Header" options. There are two of them, one each for the "Digest options" and the other for "Non-digest options". If you want to do this programmatically across your site without the manual copy, you'll need to write a script. It would also be possible to patch the code to automatically pull in the "description" string, but I doubt we want to support that in Mailman 2. If you want help with those, just ask! (on list, there are several of us who can help -- note we're mostly at PyCon so responses may be delayed). Steve

1 0

Re: [Mailman-Developers] Mailing lists exploited
by Stephen J. Turnbull 20 May '17

20 May '17

Jonathan Knight writes: > I think the real name if its available and the list owner address if not. > If you use the local part (e.g. j.knight) would still make it possible to > guess the @keele.ac.uk if the mailing lists are all hosted on > maillists.keele.ac.uk. I agree with Barry. More precisely, I think we should more or less hard-code the $LIST-owner address in the mail-to URL, allow the display name (presented in the HTML) to be specified (defaulting to "$LIST-owner", maybe), and document that the list-owner address should NOT be given any special permissions (specifically, should not be subscribed to the list), and that a subscribed address should NOT be mentioned in that text. I believe the $LIST-owner address is handled by Mailman, so we can require that be configured when setting up the list. This setup is just a BCP anyway in the "modern" Internet. Steve

1 0

Re: [Mailman-Developers] Multiple REST servers
by Barry Warsaw 19 May '17

19 May '17

On May 18, 2017, at 07:01 PM, Aurelien Bompard wrote: >We now have enough lists and activity that Mailman's REST API is >becoming a bottleneck, since it only answers one request at a time. >Is there a way to start mutiple REST runners? Or to make the REST >runner multithreaded? Thanks for identifying this Aurelien. Could you open an issue on Core for this? Have you done any other analysis on where the bottlenecks are? Is it CPU, db, I/O? Currently the REST server uses Python's stdlib wsgiref WSGIServer which I'm positive is not performant enough for your lists. There are a couple of options that would be worth investigating. I played with trying to use gunicorn, but deleted the branch a while ago (IIRC, there were problems and I didn't have time to investigate further). At the very least, I want to look into asyncio-based REST server (e.g. aiohttp, uvloop), but maybe there are other parts of the stack we need to look at too. -Barry

2 1

Recent changes in HyperKitty
by Aurelien Bompard 19 May '17

19 May '17

Hey folks! I thought I'd keep you posted on a rather big change that landed in HyperKitty a couple weeks ago. It will be useful for those of you who run the master branch. If you updated and HyperKitty started requiring Redis or not updating some parts of the UI, that may be the reason. I have added support for asychronous tasks. They bring a huge performance boost but they need an additional step in the setup. The relevant part of the documentation is: http://hyperkitty.readthedocs.io/en/latest/install.html#asynchronous-tasks There are two changes to the setup: First, the configuration must be updated, there's one more line in the INSTALLED_APPS and there an additional variable that must be defined if you don't want to depend on Redis. Here's the diff proposed in the example project directory: https://gitlab.com/mailman/hyperkitty/commit/681170c6986b7bf3a2731845196f93…. If you do this change (and run the django migrate command), you don't need to install Redis. The task queue will be in Django's own database. Secondly, there is an additional command to run in the background: django-admin qcluster --pythonpath /path/to/project --settings settings or: /path/to/project/manage.py qcluster depending on how you choose to run Django commands This command will start the workers that will process the work queue. The work queue is (for now) mainly about updating the cache, that's why you may see those weird inconstitancies in the UI. Sorry for not communicating about this earlier. If you have any questions, feel free to ask me. Aurélien

1 0

Multiple REST servers
by Aurelien Bompard 18 May '17

18 May '17

Hey people! We now have enough lists and activity that Mailman's REST API is becoming a bottleneck, since it only answers one request at a time. Is there a way to start mutiple REST runners? Or to make the REST runner multithreaded? Thanks! Aurélien

1 0

Re: [Mailman-Developers] Mailing lists exploited
by Daniel Kahn Gillmor 17 May '17

17 May '17

On Wed 2017-05-17 09:20:21 +0100, Jonathan Knight wrote: > The attack we're trying to defend against is a scripted one which grabs a > list of all the mailing lists, then harvests the administrator email and > then tries to spam each list using the administrator as a sender address. > > If the archives are public then I guess you could write a reasonable > algorithm to try and guess an unmoderated address but I don't think its as > easy to hit thousands of mailing lists using that approach. i'm not convinced that these two scripts are significantly different in difficulty, though i acknowledge that the former is marginally easier. it sounds to me like the real underlying concern is about allowing submissions to bypass moderation based on forgeable data like the From: header. fixing it in the display side seems likely to trigger a game of whack-a-mole. --dkg

2 1

Re: [Mailman-Developers] Mailing lists exploited
by Daniel Kahn Gillmor 17 May '17

17 May '17

On Tue 2017-05-16 13:29:21 +0100, Jonathan Knight wrote: > I think the real name if its available and the list owner address if not. > If you use the local part (e.g. j.knight) would still make it possible to > guess the @keele.ac.uk if the mailing lists are all hosted on > maillists.keele.ac.uk. surely it's easy for an attacker to guess moderation-free sender addresses by a quick scan of the list archives as well. what attackers are we really trying to defend against here? --dkg

3 2

Re: [Mailman-Developers] Mailing lists exploited
by Barry Warsaw 16 May '17

16 May '17

On May 16, 2017, at 09:29 AM, Jonathan Knight wrote: >There's not a lot that can be done to protect against that other than >changing the "list is run by" so that the administrators real email address >isn't obvious. I suppose we should either use the moderator's real name, or just the local part of their address. -Barry

2 1

Add information on first line of email
by David Terni 16 May '17

16 May '17

Hi, I need to use the text of "description or information filed" used to describe the mailinglist and put this information in the firsts lines e-mail. Like the credits but on head of email. How I can do it? Thank's a lot

1 0

Re: [Mailman-Developers] Mailing lists exploited
by Mark Sapiro 16 May '17

16 May '17

On 05/12/2017 05:13 AM, Jonathan Knight wrote: > > Maybe listing administrator email addresses needs the be a thing of the > past. It's not done in Mailman 3. For mailman 2.1, the administrator email addresses are a mailto: link the goes to the LISTNAME-owner address, but the email addresses are exposed and only mildly obfuscated ('@' -> ' at '). I would consider adding a configuration option to either obfuscate the addresses further (e.g. drop the domain entirely) or replace the text with something like "Listname list run by listname-owner(a)example.com". WDOT? -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

3 3

Mailman-Developers May 2017