Hello,
the web interface of mailman3 allows registering new accounts. During the registration these new account receive an email, and once the recipient confirms the possession of the email address, the account is created.
The problem is that this simplicity allows misuse: somebody can trigger via HTTP requests many account registrations for random email addresses. Recipients of the emails, who have not requested to register, can mark the received emails as spam. Then the servers of the recipients blacklist the mailman-server, who sent the registration request.
This misuse can be done in virtually unlimited volumes, and it is in practice done in this way.
To mitigate this misuse pattern, the procedure to create new accounts over web interface should be made more complex, e.g. by utilizing captcha.
Does somebody already have some patches, doing such things, which patches can be shared?
Kind regards // Дилян
