Mailman 3 April 2019 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 08 Nov '22

08 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Re: How strict are the dependencies on the django-compressor related backends?
by Christian Ehrhardt 11 Jun '19

11 Jun '19

On Fri, Mar 15, 2019 at 10:19 AM Jonas Smedegaard <dr(a)jones.dk> wrote: > > Quoting Christian Ehrhardt (2019-03-15 06:39:08) > > On Fri, Mar 15, 2019 at 12:08 AM Abhilash Raj <maxking(a)asynchronous.in> wrote: > > > On Thu, Mar 14, 2019, at 1:42 PM, Jonas Meurer wrote: > > > Christian Ehrhardt: > > > > I was evaluating the Dependencies of mailman3 in Ubuntu and I was > > > > wondering if I could cut them down a bit. One thing that got my > > > > attention is the dependency from mailman3-web [1] to nodejs for > > > > less [2] and ruby-sass [3]. > > > > > > > > I was wondering if we could by default not install > > > > node-less/ruby-sass and what exactly that would imply. > > less is a reinvention of sass: It is often adaptable to sass with a > simple patch. > > Original sass processor was ruby-sass, but nowadays a better processor > is sassc. Or if you want to integrated processing with Python then > python3-libsass which uses same core library for its processing. > > I have not looked closely on mailman3, but I highly doubt there is a > real need for dynamic processing of less/sass during runtime. Yeah I doubt that as well. In the meantime I also found [1] which seems to have come to the same conclusion for the majority of default setups. For upstream to disable it by default it was mentioned that there is a need for a customize kit which seems fine [1]. There is a further argument to disable the live compressors, at least as I read COMPRESS_OFFLINE that seems helpful for production setups anyway to speed up and safe CPU load. So while upstream waits until a "customize kit" exists to switch defaults, as a downstream like Debian/Ubuntu I wonder if we already could: - drop sass/less compilers to a suggest - disable the live compression in the default config that we ship - keep the config commented-out to make it easy for admins that want to enable it later - pre-compress at build time and enable compress_offline for speed - maybe call `django_admin compress` [3][4] or similar at build time? - having sass/less as build dependencies seems much safer than pulling it in at runtime @Jonas M.: what do you think about [2] (again maybe after Buster)? Sorry to not know more of this yet, but I hope suggesting what I think might work helps to get us the right way. [1]: https://lists.mailman3.org/archives/list/mailman-users@mailman3.org/thread/… [2]: https://salsa.debian.org/paelzer-guest/mailman-suite/commits/make-sass-less… [3]: https://django-compressor.readthedocs.io/en/latest/usage/#offline-compressi… [4]: https://gitlab.com/mailman/django-mailman3/issues/17#note_81807465 > - Jonas > > -- > * Jonas Smedegaard - idealist & Internet-arkitekt > * Tlf.: +45 40843136 Website: http://dr.jones.dk/ > > [x] quote me freely [ ] ask before reusing [ ] keep private > -----BEGIN PGP SIGNATURE----- > > iQIzBAABCgAdFiEEn+Ppw2aRpp/1PMaELHwxRsGgASEFAlyLbfwACgkQLHwxRsGg > ASHlqw//Vkkke6aulFYeLkq7vQOIt08j+DMMDBpJ/vXapwtQJ2WbWEYsHbbFv75v > k80SILudsOyGMwQ0HKRGqDmhJw2Voi9mWoV2fBQeCQn5w/G9N2Ddw8hAMrzGsLxO > C2FOV8Db0irJ6FS6AO0YQpAselKnnX387AvyWBCpVcWWuydf46pMkPpYajVJTvZg > UZxtBh1epmv/VdQlw2OeLrV+bZJWfjULjr1qFPYdqFnEUnOA2cC44RMagxSV7kNh > JmCc7DvL/VjX/dkPHJCW/VvRrvfxzOR4bimVr7BeuvcjNljlUnKhRwP+PQZt80gp > CbOoVCeEOFJuHwqTlvasUpxo/aSZZPFeF8aQBtdyzefEx9QjjGwx8bYQFn+Zo0CX > TVsB7qWyCwMZIR0DP5+A8ityXQb+FwOTXjySMzO+Z/rA9+h1PHZrK+WJMB0O9z5r > hWYDk3jGSJIkwL+AemE06gUPuSaXZWhzoduI2Mbzs8a20qhrW08Ij338RVGalyhC > QHJT4JoI3bXylaK+IEpH9xxUEW0i8gOge32dBFiqg9/dGFm06Tf3z8dUuBFyXgG3 > BsNJaO6Cn3ghfNS/OfNN04nPS+luPqPQ1r9yZMztrIqwv8oOWyVj1YQpKW1vRN/v > BK/2IpBA+6O3OE2X4RCW8pouwPmsSgMmXpIsuFE61dox/8tOPmE= > =490O > -----END PGP SIGNATURE----- -- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd

3 4

Interested in Working on the Mailman Documentation for GSOD
by Ariessa N 03 May '19

03 May '19

Hello everyone, I'm Ariessa Norramli, a 2nd year student in Software Engineering and freelance writer. Before I started college, I did a number of freelancing jobs on Upwork. I've written for diverse topics such as finance, technology, pop culture, weddings, and cryptocurrency. I'm interested in working on the Mailman documentation for GSOD because I love writing and programming. I taught myself coding at the age of 15. My favourite programming language is JavaScript because of ES6's short form syntax. So having the opportunity to combine both of my passion is definitely something that I'd love to try. As of now, I own a website <https://bitsized.me/> and personal blog <https://ariessa.github.io/>. I am really looking forward to hearing from you. Thank you in advance. Best Regards, Ariessa Norraml

4 5

Postorius now uses pytest for testing
by Abhilash Raj 26 Apr '19

26 Apr '19

Hello All, Postorius, as you all know, is the Web UI for Mailman 3 and is based on Django Web Framework. For some time now, we have been using VCRPy, a HTTP Stubbing library to record test interactions with Mailman Core' API so that the code can be tested in CI environments with the need to have Core. However, in the past, we have observed that it creates more problems than it solves. First, we test against the state of Mailman Core in past, since the interactions are recorded once and replayed all the time. There are tapes dating back years, which could in theory have changed (though, API's backward compatibility guarantees avoids breaking changes to happen without notice, but even with notice, tests would continue to pass). Other problem is that it creates friction when writing tests, which was the biggest pain point for myself. You have to write tests, record tapes and then make sure that you keep re-recording till the tests pass. It is not easy to explain to early stage developers either. Pytest is a new test runner and is pretty popular these days. I decided to use it mostly due to strong support for fixtures and plugins. I wrote a new fixture to make sure that Core's API is started before tests start and all data is erased before each test class. The changes are in this MR[1]. [1]: https://gitlab.com/mailman/postorius/merge_requests/406 I am also working on moving Core's tests to use pytest instead of nose2,but that process is going to be longer since I am going to have to rewrite some of the nose2 plugins we use there. Doctests also need some attention. Here is the WIP MR[2] for that. [2]: https://gitlab.com/mailman/mailman/merge_requests/500 -- thanks, Abhilash Raj (maxking)

1 0

Unique idea presentation
by kurian thomas (kk) 10 Apr '19

10 Apr '19

Respected sir/madam, I would like to propose (if not already there) an idea/feature regarding your mailing web app as a part of GSoC. Since it runs on python I would like to integrate NLP text summarisation using the nltk library. Sometimes when people are on the go they wouldn't want to read the whole email and maybe just summarise the relevant parts. This feature allows them to do that with a click of a button and see the result as a pop up or modal. I hope my idea has been conveyed properly. Let me know if it can be integrated into your web app and also whether I should add it as a proposal for GSoC selection process. Thanking you Kurian Thomas Pulimoottil

2 1

Gsoc proposal review "Support for multiple wsgi servers" .
by saumitra_Uchiha 07 Apr '19

07 Apr '19

https://docs.google.com/document/d/1VP7i6ISadRoGnbH_lq24LHSgIQ8PrFuUY5Kahx7… @maxking please review my application. Stephen reviewed it and told that it isn't suitable enough, but it was on the lsting of mailman proposed projects....comments?

1 0

Please review my Gsoc proposal regarding "Support for multiple wsgi servers "
by saumitra_Uchiha 07 Apr '19

07 Apr '19

https://docs.google.com/document/d/1VP7i6ISadRoGnbH_lq24LHSgIQ8PrFuUY5Kahx7… Also @maxking Stephen reviewed my proposal and stated that it ws more on the config part than coding . This was one proposed by you, please share your thoughts on the same.

1 0

Questions on GSoC
by kurian thomas (kk) 07 Apr '19

07 Apr '19

Respected sir/madam, I am a beginner to GSoC and I want to contribute to your amazing organisation. I have read all the docs surrounding how to setup the development environment and have a fair idea on what to do. I had a few questions I wanted to ask 1)If I have a unique idea to implement do I send it to a specific email address or add it as my proposal for GSoC? 2)In order to work on one sub project is is necessary to install the whole thing? If not how may I go about working on just the subproject? Thanking you Kurian Thomas pulimoottil

2 1

Regarding aquaintance with community and source code
by Satbir Singh Ghai 07 Apr '19

07 Apr '19

Hello, I am Satbir Singh, a sophomore pursuing B.Tech in Information and Communication Technology at DA-IICT. I am a full stack web developer proficient in Django Framework. I want to contribute to Mailman. I am aiming for GSoC 2019. I have previously contributed to open source organizations and really excited to contribute in this project. I am new to this organization please help me to get started! Thanking you Satbir Singh

2 2

GSoC full proposal regarding "Add support for bounce processing in Core"
by Aaryan Bhagat 03 Apr '19

03 Apr '19

First of all, I apologize for not being active in the Gitlab codebase and only on the mailing-lists. This is because my semester is ending and had a lot of tests, moreover I was focusing only on my proposal and its related work. Fornutaley, that is not a problem anymore. I do not have any other commitments this summer and my timeline in the proposal explains it all. Here is the full proposal. I have given commenting rights https://docs.google.com/document/d/1I3QuffTxzEAFj1I3N_B08538VISHUADDQjbbGBd… Abhilash it has some comments made by you which I had replied extensively and made the appropriate changes. If you find the time, please resolve them if you find them fine.

1 0

Mailman-Developers April 2019