Mailman 3 June 2021 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 08 Nov '22

08 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Core new release?
by Danil Smirnov 06 Jul '21

06 Jul '21

Hi, As per public Gitlab stats for Mailman Core repo, 25 issues have been closed in April so far, which is the record of the last 12 months and beats the previous four months total. From a merge requests perspective, it is the record too, and the merged requests number pace is growing by ~15% over the last four months, reaching a quarter of a hundred in April. I know that it's just a month from the previous Mailman Core release, but given the stats above should the next release be planned earlier than usual? Best regards, Danil Smirnov

3 6

#mailman irc channel moving to libera.chat
by Abhilash Raj 16 Jun '21

16 Jun '21

Hey Everyone, As some of you might already know that Freenode IRC server now has new owners and most of the volunteer staff have decided to move away from it to create a new IRC server libera.chat[1] due to the policies of the new owners. Along with many other open source projects, we have also decided to move away from freenode to use libera.chat instead. We have registered #mailman there and will be using that as primary IRC channel for Mailman things. Freenode has also decided to drop all registrations, so, #mailman channel there is no longer registered to any member of Mailman Core team as of some time earlier today (Tue June 15th). [1]: https://libera.chat/ -- thanks, Abhilash Raj (maxking)

1 0

tox(ic).ini ;-)
by Stephen J. Turnbull 11 Jun '21

11 Jun '21

I'm fiddling with my Python installations and noticed this: steve Mailman/pristine 1:19 % grep envlist */tox.ini django-mailman3/tox.ini:envlist = py{37,38,39}-django{21,22,30,31},lint hyperkitty/tox.ini:envlist = py{36,37,38,39}-django{22,30,31},docs,lint mailman-hyperkitty/tox.ini:envlist = {py35,py36,py37}{,-coverage},lint mailman-web/tox.ini:envlist = docs mailman/tox.ini:envlist = {py35,py36,py37}-{nocov,cov,diffcov}{,-mysql,-pg},qa mailmanclient/tox.ini:envlist = py{35,36,37,38},lint postorius/tox.ini:envlist = py{35,36,37}-django{111,20,latest},pep8 We should do something about coordinating on supported versions, no? Also, coordinating common factors (cov vs coverage, pep8 vs lint vs qa)? Also, the djangolatest environment for postorius looks broken (but I don't understand tox that well): django-latest: https://github.com/django/django/archive/main.tar.gz Also, shouldn't every subproject support docs? Steve

2 4