Mailman 3 November 2020 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Mass subscriptions as a DoS attack
by Alessandro Vesely Nov. 29, 2020

Nov. 29, 2020

Trolls can wreak havoc by subscribing to one or more high volume mailing lists on behalf of a target one. For example, someone could subscribe this list to the Linux kernel mailing list. Everybody would see the confirmation message, but by the time someone realizes the need to unsubscribe, the list will have been flooded, thereby realizing the DoS. Are there mechanisms to prevent that? Best Ale --

3 2

Rewriting the Subject:
by Alessandro Vesely Nov. 26, 2020

Nov. 26, 2020

Hi all, I've installed my reverting DKIM verifier. Today it failed on a specific message which I also received directly. The reason it failed is the Subject: field was rewritten like so: ORIGINAL: Subject: RE: [dmarc-ietf] A policy for direct mail flows only, was ARC questions REWRITTEN: Subject: Re: [dmarc-ietf] A policy for direct mail flows only, was ARC questions The message is tagged X-Mailman-Version: 2.1.29. Is it Mailman doing that change? I found some code which may seem to be doing something like that in CookHeaders.py: rematch = re.match( '(\s*(RE|AW|SV|VS)\s*(\[\d+\])?\s*:\s*)+', subject, re.I) if rematch: subject = subject[rematch.end():] recolon = 'Re:' It seems I have to save the subject if it matches that string, correct? Best Ale --

2 1

Mailman Core 3.3.2 is now out
by Abhilash Raj Nov. 7, 2020

Nov. 7, 2020

Hi Everyone, I am pleased to announce that with a week long delay from the planned date, GNU Mailman Core 3.3.2 is now finally out. This release includes both bug fixes and some new features. Some notable changes include: - Support for inviting users to join mailing lists. - New adddmembers, delmembers and syncmembers command to manage membership from CLI. - Addition of new REST API endpoints that return the count of held messages and subscription requests of much faster page loads in Postorius. - Addition of support for filtering in some API endpoints like Members and Subscription requests. - Support for address= option in email join command to subscribe an address other then sending address. - Addition of who email command to lookup memberships. - Expose emergency field for MailingList resource in REST API. - Several bug fixes to support new major version of libraries like dnspython, flufl.* etc. You can install it using: $ pip install --upgrade mailman The tarball for the release is available at PyPI: https://pypi.org/project/mailman/ Finally, many thanks to all the contributors who have helped make this release a success! -- Abhilash Raj (maxking) on behalf of Mailman Core team

1 1