Mailman 3 October 2022 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett 07 Nov '22

07 Nov '22

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Code formatting tools for Mailman project
by Abhilash Raj 31 Oct '22

31 Oct '22

Hey Everyone, I am trying out some of the code formatting tools on Mailman repos to help reduce some efforts in development. The tools I am trying out is blue[1] and isort[2] to format code and imports. We've been using isort on some repos, but am planning to expand that to all projects. I am also adding a new tox command `tox -e format` that should run the appropriate commands locally for users to run. The choice of tool, blue in this case, was mostly motivated by the design choices that align closest with Mailman's as Barry is a co-owner of the tool and authored Mailman's style guide as well. If there are any issues with these tools, please let me know or feel free to open an issue on the project and ping me there. I've started off with Postorius[3], but will expand further to other projects. Core will probably be updated towards the last. [1]: https://blue.readthedocs.io/en/latest/# [2]: https://pycqa.github.io/isort/index.html [3]: https://gitlab.com/mailman/postorius/-/merge_requests/734 -- thanks, Abhilash Raj (maxking)

2 5

New Mailman Releases
by Abhilash Raj 25 Oct '22

25 Oct '22

Hi, I am pleased to announce several new releases for GNU Mailman project. 1. Mailman Core 3.3.6 [1] 2. Postorius 1.3.7 [2] 3. Hyperkitty 1.3.6 [3] 4. Mailmanclient 3.3.4 [4] 5. Django-mailman3 1.3.8 [5] All the releases are published to PyPI and you can find links to all the PyPI projects: https://docs.mailman3.org/en/latest/ A full list of changelogs are available below: [1]: https://docs.mailman3.org/projects/mailman/en/latest/src/mailman/docs/NEWS.… [2]: https://docs.mailman3.org/projects/postorius/en/latest/news.html#section-2 -- Something weird is going on with the page missing the bullets. [3]: https://docs.mailman3.org/projects/hyperkitty/en/latest/news.html#news-1-3-6 [4]: https://docs.mailman3.org/projects/mailmanclient/en/latest/src/mailmanclien… [5]: https://gitlab.com/mailman/django-mailman3/-/blob/master/README.rst Finally, the minimum Python version required is 3.7 although, 3.9 is recommended if you are doing a new install for longest support. 3.10 is supported for Django apps, but Mailman Core is missing that due to one of the core dependencies not support 3.10 yet (aiosmtpd). Thanks to all the contributors for making this release possible and apologies on my end for delayed releases. If you find any issues, you can report them at the respective bug tracker for the projects. The links to issue trackers are available here: https://docs.mailman3.org/en/latest/ -- thanks, Abhilash Raj (maxking)

1 0

Bug in 2.1.29 when hitting one button and then another in the confirm page
by Andrea Monaco 20 Oct '22

20 Oct '22

I visited the confirm page to leave a mailing list, then by mistake I clicked "Cancel and discard", I pressed ESC almost immediately and then "Unsubscribe". A page appeared saying that I hit a bug. Maybe the software state becomes inconsistent in that case? Andrea Monaco

2 1