Mailman 3 July 2018 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

GDPR disclaimers and redaction in mailman 2
by John Levine Aug. 1, 2018

Aug. 1, 2018

Someone has asked me about some adjustments mailman 2 related to what they think they have to do for GDPR compliance. One is to add some checkbox stuff to agree at subscription time that you understand what info you're providing. I expect this could be spliced in the same way CAPTCHAs are. Another is to provide different views of what lists exist depending on what IP address you're connecting from, so internal lists are only visible on the internal network. Has anyone done stuff like this? I think they're running 2.15, probably possible to update to more recent versions of 2.x but 3.x is not in the cards. Tnx. R's, John PS: I am definitely not looking for arguments about whether the GDPR needs this. It's their money, they get to say what they want.

3 3

Mailman Suite 3.2 with screen readers
by Andrew Hodgson July 28, 2018

July 28, 2018

Hi, A couple of points after upgrading to the Mailman 3.2 suite this morning: * Links start with spaces to make it difficult for screen readers to use links list with first key letter navigation. For example on the home page it is not possible to use the links list feature in the screen reader then choose the log in option because that link has spaces before the Log In text; * Since 3.2 it is no longer possible to navigate between the tabs on the administration screen using a screen reader. The only way I was able to switch tabs to different sections of the interface was by using a simulated mouse click on the text. In the prior version I was able to do this by just pressing enter on the relevant option (for example Held Messages). Anyone else seeing this? Thanks, Andrew.

1 0

Container Images for Mailman 3.2 release
by Abhilash Raj July 27, 2018

July 27, 2018

Hi All, I have updated and pushed releases for Container Images with 3.2 release of the suite. They are available at: docker.io/maxking/mailman-web:0.2 docker.io/maxking/mailman-core:0.2 A similar copy of both is also available at quay: quay.io/maxking/mailman-web:0.2 quay.io/maxking/mailman-core:0.2 The releases contain the following versions of components: mailman-core: - Mailman Core 3.2.0 - Mailman-hyperkitty 1.1.0 mailman-web: - Postorius 1.2.1 - Hyperkitty 1.2.0 - Django-mailman3 1.2.0 - MailmanClient 3.2.0 The upgrade process from 0.1 release should be relative painless, except for the full-text index, which needs to be rebuilt due to the migration from Python 2 to 3 of the full-text indexing library whoosh. You can run the following commands to do so, after the upgrade: $ docker exec -it mailman-web bash bash # python manage.py rebuild_index If you are not using the default docker-compose.yaml file provided in the repo, you need to add an extra environment variable for mailman-web container, POSTORIUS_TEMPLATE_BASE_URL, which defaults to `http://mailman-web:8000`. It should be the URL where your mailman-web container is listening on with HTTP (port 8000 by default). The rolling releases are not being rolled out right everyday now, because of broken build scripts. I'd recommend everyone use the new stable releases that I mentioned above. Going forward, I'll try to release stable versions more often, so that there isn't any need for rolling version, but fixing the rolling releases is on my TODO. Documentation for these images is available at: https://github.com/maxking/docker-mailman -- thanks, Abhilash Raj (maxking)

2 2

Exception when trying to send mail to list
by Kamran Soomro July 26, 2018

July 26, 2018

Hi, Recently I’ve started seeing some weird exceptions when trying to send emails to a list with mailman 3 running in docker: From mailman core logs: sqlalchemy.exc.DataError: (pymysql.err.DataError) (1406, "Data too long for column 'value' at row 1") [SQL: 'INSERT INTO pendedkeyvalue (`key`, value, pended_id) VALUES (%(key)s, %(value)s, %(pended_id)s)'] [parameters: {'key': '_pck_rule_misses', 'value': '"\\u0080\\u0003]q\\u0000(X\\u0010\\u0000\\u0000\\u0000dmarc-mitigationq\\u0001X\\n\\u0000\\u0000\\u0000no-sendersq\\u0002X\\b\\u0000\\u0000\\u0000app ... (382 characters truncated) ... \\u000bX\\b\\u0000\\u0000\\u0000max-sizeq\\fX\\u000f\\u0000\\u0000\\u0000news-moderationq\\rX\\u0011\\u0000\\u0000\\u0000suspicious-headerq\\u000ee."', 'pended_id': 12}] (Background on this error at: http://sqlalche.me/e/9h9h) Jul 25 07:33:28 2018 (32) SHUNTING: 1532504008.7233553+2ca45fec09fa01b9dd31ed584a06b04302ea155b From mailman web logs: TypeError: ord() expected a character, but string of length 0 found ERROR 2018-07-25 07:42:41,098 22515 hyperkitty.lib.utils Failed to update the fulltext index: ord() expected a character, but string of length 0 found Traceback (most recent call last): File "/usr/local/lib/python2.7/site-packages/hyperkitty/lib/utils.py", line 186, in run_with_lock fn(*args, **kwargs) File "/usr/local/lib/python2.7/site-packages/hyperkitty/search_indexes.py", line 87, in update_index update_cmd.update_backend("hyperkitty", "default") File "/usr/local/lib/python2.7/site-packages/haystack/management/commands/update_index.py", line 257, in update_backend commit=self.commit, max_retries=self.max_retries) File "/usr/local/lib/python2.7/site-packages/haystack/management/commands/update_index.py", line 84, in do_update backend.update(index, current_qs, commit=commit) File "/usr/local/lib/python2.7/site-packages/haystack/backends/whoosh_backend.py", line 178, in update self.setup() File "/usr/local/lib/python2.7/site-packages/haystack/backends/whoosh_backend.py", line 126, in setup self.index = self.storage.open_index(schema=self.schema) File "/usr/local/lib/python2.7/site-packages/whoosh/filedb/filestore.py", line 176, in open_index return indexclass(self, schema=schema, indexname=indexname) File "/usr/local/lib/python2.7/site-packages/whoosh/index.py", line 421, in __init__ TOC.read(self.storage, self.indexname, schema=self._schema) File "/usr/local/lib/python2.7/site-packages/whoosh/index.py", line 632, in read check_size("int", _INT_SIZE) File "/usr/local/lib/python2.7/site-packages/whoosh/index.py", line 626, in check_size sz = stream.read_varint() File "/usr/local/lib/python2.7/site-packages/whoosh/filedb/structfile.py", line 191, in read_varint return read_varint(self.read) File "/usr/local/lib/python2.7/site-packages/whoosh/util/varints.py", line 102, in read_varint b = ord(readfn(1)) TypeError: ord() expected a character, but string of length 0 found Could anybody guide me as to what’s wrong? –Kamran

3 8

Mailman 2.1.29 Release
by Mark Sapiro July 24, 2018

July 24, 2018

I am not so pleased to announce the release of Mailman 2.1.29. It turned out there was a bug in the security fix in 2.1.28 that broke the web admin and listinfo overview pages. This is fixed in Mailman 2.1.29. The patch referred to below has been corrected to fix this bug. There is also a patch attached to <https://bugs.launchpad.net/mailman/+bug/1783417> which applies to 2.1.28 to fix this issue. Python 2.6 is the minimum supported, but Python 2.7 is strongly recommended. Mailman 2.1.28 was a minor security fix release. It also has some i18n updates and a couple of bug fixes and adds the ability to edit list specific templates through the web admin UI in a supported language other than the list's default. See the attached README.txt for details. For details of the security issue, see the report at <https://bugs.launchpad.net/mailman/+bug/1780874> which also includes a patch for those who want to fix this issue without upgrading. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ https://mirror.list.org/ Mailman 2.1.29 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

List Migrated to Mailman 3
by Mark Sapiro July 23, 2018

July 23, 2018

This list is now on Mailman 3. The HyperKitty archive is still a work in progress. The old pipermail archive is still available, but won't be updated going forward. -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 1

Mailman 2.1.28 Security Release
by Mark Sapiro July 23, 2018

July 23, 2018

I am pleased to announce the release of Mailman 2.1.28. Python 2.6 is the minimum supported, but Python 2.7 is strongly recommended. This is a minor security fix release. It also has some i18n updates and a couple of bug fixes and adds the ability to edit list specific templates through the web admin UI in a supported language other than the list's default. See the attached README.txt for details. For details of the security issue, see the report at <https://bugs.launchpad.net/mailman/+bug/1780874> which also includes a patch for those who want to fix this issue without upgrading. Mailman is free software for managing email mailing lists and e-newsletters. Mailman is used for all the python.org and SourceForge.net mailing lists, as well as at hundreds of other sites. For more information, please see our web site at one of: http://www.list.org https://www.gnu.org/software/mailman http://mailman.sourceforge.net/ https://mirror.list.org/ Mailman 2.1.28 can be downloaded from https://launchpad.net/mailman/2.1/ https://ftp.gnu.org/gnu/mailman/ https://sourceforge.net/projects/mailman/ -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

1 0

autocrypt/mailman MOSS proposal declined
by holger krekel July 14, 2018

July 14, 2018

Dear mailman devs, autocrypters, just heart back from Mehan from the Mozilla Mission partners programme that they declined the autocrypt/mailman proposal. Here is the quote: "At this stage, the committee is not convinced that your project is positioned to advance the Mozilla mission in a significant manner in the near-term. Specifically, it is not clear to the committee if Autocrypt + Mailman 3 is on track to encourage wider adoption or a broader set of use cases in the future." thanks everybody who helped with the application. Let's see if we can anyway advance the ideas of easy-to-use encrypted mailing lists ... holger

1 0

Re: [Mailman-Developers] [Mailman-Announce] Announcing Mailman Suite 3.2 release
by Mark Sapiro July 11, 2018

July 11, 2018

On 7/10/18 11:50 PM, Abhilash Raj wrote: > I am very pleased to announce the release of Mailman Suite 3.2. > > This includes Mailman Core 3.2.0, MailmanClient 3.2.0, Postorius 1.2.0, Django-Mailman3 1.2.0, Hyperkitty 1.2.0. We need to tag these releases in the gitlab branches. Do you want to do that? -- Mark Sapiro <mark(a)msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

2 1