Mailman 3 January 2018 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

3.1.x REST API enhancements around preferred email address
by Scott Koranda March 8, 2018

March 8, 2018

Hello, I am interested in contributing enhancements around preferred address to the REST API for version 3.1.x. To prove out my use case(s) and familiarize myself with the code I have made changes already. Here are some example curl command line invocations and output to illustrate: 1) Create an address for an existing user and mark that address as the user's preferred address: curl -u restadmin:restpass \ -X POST \ -d email=skoranda(a)example.nil \ -d preferred=1 \ http://mytestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8/addres… This returns a '201 Created'. 2) Return the preferred address, if set, for a user: curl -u restadmin:restpass \ -X GET \ http://mystestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8 | python -m json.tool { "created_on": "2017-11-11T22:20:45.950949", "display_name": "Scott Koranda", "http_etag": "\"26bc0d9f21eb145248884aedae4c1ffd00b608d2\"", "is_server_owner": false, "password": "$6$rounds=656000$gWGfwpajfZ7rVn5O$Sl559B2TgtpJWXA2i67G5ukjzkV6iTp4NgP.6FJpMFMUTDdDXULAmwdN8YW92w87EdctgqFqAUkUqS6.EOTCz/", "preferred_address": "skoranda(a)example.nil", "self_link": "http://mytestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8", "user_id": "e57ecfd0c0c74a319ac958b18882a6d8" } 3) Update/patch a user to set a preferred address: curl -u restadmin:restpass \ -X PATCH \ -d preferred_address=skoranda(a)example.nil \ http://mytestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8 This returns a '204 No Content'. 4) Get all addresses for a user with the preferred address (if set) having the attribute 'preferred' set to 'true': curl -u restadmin:restpass \ -X GET \ http://mytestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8/addres… | python -m json.tool { "entries": [ { "email": "skoranda(a)example.nil", "http_etag": "\"492824d150f9f11e32d530d3cad0f76422bddb48\"", "original_email": "skoranda01(a)example.nil", "preferred": true, "registered_on": "2017-11-13T22:35:17.232180", "self_link": "http://mytestbed.com:8001/3.1/addresses/skoranda@example.nil", "user": "http://mytestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8", "verified_on": "2017-11-20T16:48:51.738145" }, { "email": "skoranda01(a)example.nil", "http_etag": "\"f0f28c1c6a925a595269d3fe21ef7fc1515d7670\"", "original_email": "skoranda01(a)example.nil", "registered_on": "2017-11-20T16:46:20.941262", "self_link": "http://mytestbed.com:8001/3.1/addresses/skoranda01@example.nil", "user": "http://mytestbed.com:8001/3.1/users/e57ecfd0c0c74a319ac958b18882a6d8", "verified_on": "2017-11-20T16:46:20.941595" }, ], "http_etag": "\"89c46bd312c6f1a344e6e6180aed6f11b62e6048\"", "start": 0, "total_size": 2 } Before I submit a pull request I would be grateful for any comments or feedback on the functionality as illustrated above, or any other comments or feedback. I will also begin the "copyright assignment" paperwork as explained at https://wiki.list.org/DEV/Home Thank you for your consideration. Sincerely, Scott Koranda

2 3

Mailman 2.1.26 Security release Feb 4, 2018
by Mark Sapiro Feb. 8, 2018

Feb. 8, 2018

An XSS vulnerability in the Mailman 2.1 web UI has been reported and assigned CVE-2018-5950 which is not yet public. I plan to release Mailman 2.1.26 along with a patch for older releases to fix this issue on Feb 4, 2018. At that time, full details of the vulnerability will be public. This is advance notice of the upcoming release and patch for those that need a week or two to prepare. The patch will be small and only affect one module. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 6

opportunistically encrypted mailman lists with Autocrypt
by holger krekel Jan. 31, 2018

Jan. 31, 2018

Hi all, maybe some of you know me for my works on pypy, tox or pytest but this mail will be about something else ... In the last year i co-instigated a new opportunistic mail encryption effort called Autocrypt (https://autocrypt.org). With Autocrypt Level 1, mail clients (e.g. enigmail, K-9 mail, Delta.chat, ...) send and parse public keys in "Autocrypt" e-mail headers and offer single-click encryption. Releases are upcoming in spring 2018, we have been doing fun and well-received user-testing sessions already with in-development versions. In 2018, I'd like to tackle basic integration of Mailman and Autocrypt, to achieve opportunistically encrypted mailing lists. The main idea is to grow a mailman mode/plugin to: 1) have mailman lists maintain a public pgp identity that is added through Autocrypt headers to outgoing mails. 2) have mailman keep track of "incoming" autocrypt keys and decrypt incoming mails if they are encrypted. 3) encrypt to those subscribers where we have a proper Autocrypt key Code wise, i'd like to tackle this based on the the new and evolving (and quite unpublic so far) "muacrypt" project: https://muacrypt.readthedocs.io >From looking at archives and the GSOC idea page i see there were related efforts and ideas. Are there pointers to draft implementations that are still somewhat up to date (with mm3)? Also, i am considering to submit a project proposal for the Mozilla Mission Partners program which would include a few more things ... OnionMX routing for postfix, and documentation on how to setup a best-practise MM3 mail instance, and maybe organizing a sprint around the mentioned topics. collaboration welcome'ly yours, holger P.S.: i had discussed mm-encryption with Barry 2-3 years ago and feel now, with Autocrypt getting out the door, it's all becoming more feasible.

4 8

Re: [Mailman-Developers] [Merge] lp:~dsieborger/mailman/recaptcha into lp:mailman/2.1
by Mark Sapiro Jan. 30, 2018

Jan. 30, 2018

On 01/29/2018 07:09 AM, David Siebörger wrote: > David Siebörger has proposed merging lp:~dsieborger/mailman/recaptcha into lp:mailman/2.1. FYI, I have made additional changes to your merged code. See <https://bugs.launchpad.net/mailman/+bug/1746189> and <http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/revision/1740/Mailm…>. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Issues with SQLAlchemy >= 1.2 All CI fails.
by Mark Sapiro Jan. 22, 2018

Jan. 22, 2018

One specific test is failing when run with SQLAlchemy >= 1.2. The test test_absorb_memberships in mailman.model.tests.test_user.TestUser throws sqlalchemy.orm.exc.StaleDataError. I have a small MR I'm working on. I'm going to push that and require sqlalchemy < 1.2 for the time being. I still haven't figured out whether we have a real incompatibility or if it's just a problem with the test. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 1

Firefox loves us! Leftmost "top site"!
by Stephen J. Turnbull Jan. 17, 2018

Jan. 17, 2018

>From the Silly but Encouraging Fact of the Day Department http://turnbull.sk.tsukuba.ac.jp/MailmanFTW.png Note the empty "Highlights" box: I haven't used Firefox in a long time, just checking that another browser isn't broken on one of my employer's sites. So this *isn't* because I visit Mailman a lot. <wink/> Steve

1 0

Small contrib script
by Lindsay Haisley Jan. 10, 2018

Jan. 10, 2018

I have a small script which may be appropriate for the contrib section in Mailman 2. Basically, it simply assembles a few build-time options, including the option string given to the configure script, and spits them out to stdout when the script is executed. Modifications to configure.in are accomplished using a patch file, and autoconf needs to be run to regenerate the configure script. In what form and fashion should I submit this contribution, which consists of about 3 files. I can put these in a tarball and attach them, attach them seprately, put them on my public server and post the URL to this list, or upload them, whatever's appropriate. This is a small package, less than 3K. Let me know. -- Lindsay Haisley | "The first casualty when FMP Computer Services | war comes is truth." 512-259-1190 | http://www.fmp.com | -- Hiram W Johnson

3 14