Mailman 3 November 2018 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Django Allauth dependency of HyperKitty and Postorius
by Robin Vanhove 08 Dec '18

08 Dec '18

Hello all, I have noticed that HyperKitty and Postorius are both dependent on the allauth app of which they only use the EmailAddress model. It is understandable to use this because the wheel should not be reinvented, but this does make it more difficult to add these to an existing django project that does not use allauth. Would it be possible to make this dependency optional if the email field of the default user model can be trusted? I would be willing to do some work on this myself if I can find the time and someone is willing to point me in the right direction. Thanks -- Robin Vanhove

2 1

Re: Using Exim: Getting bounce mail frozen due to no Message-Id header
by Mark Sapiro 15 Nov '18

15 Nov '18

On 11/15/18 9:29 AM, Andrew Hodgson wrote: > Hi, > > using Exim as MTA. Some of the NDRs to the -bounce address are coming in without Message-Id headers and Exim doesn't add one. When the bounce gets pushed via LMTP it gets spat out because of the lack of a Message-Id header and due to the Null return envelope Exim freezes the message. Has anyone seen this before and is there something that Mailman should be doing differently or should I configure Exim to generate a Message-Id before pushing via LMTP? See <https://gitlab.com/mailman/mailman/issues/448>. This probably should be fixed, but in the mean time, if you can configure Exim to generate a Message-Id before pushing via LMTP, that would be a suitable workaround. However, the larger issue is <https://gitlab.com/mailman/mailman/issues/343>. Until that is fixed, bounces aren't processed anyway. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

Using Exim: Getting bounce mail frozen due to no Message-Id header
by Andrew Hodgson 15 Nov '18

15 Nov '18

Hi, using Exim as MTA. Some of the NDRs to the -bounce address are coming in without Message-Id headers and Exim doesn't add one. When the bounce gets pushed via LMTP it gets spat out because of the lack of a Message-Id header and due to the Null return envelope Exim freezes the message. Has anyone seen this before and is there something that Mailman should be doing differently or should I configure Exim to generate a Message-Id before pushing via LMTP? Thanks. Andrew.

1 0