
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Does anybody set USE_ENVELOPE_SENDER to Yes these days?
I'm considering removing the equivalent of this from Mailman 3.0 and
I'd like to know if that would be a hardship for anyone. If you don't
know what this value is (which in Mailman 2 lives in Defaults.py),
then you probably won't miss its demise in Mailman 3.
This flag controls whether the Sender: header is considered before the
From: header for purposes of trying to determine the email address of
the message's author. At one time in the distant past, this flag was
added because it was observed that some MTAs put the RFC 2821 MAIL
FROM value into this header, and this was considered less spoofable
than the From: header. I think these assumptions are outdated and
this workaround is either unnecessary or hurts more than it helps.
BTW, the default value is No, which tells Mailman to use the From:
header first. I propose hardwiring that default value.
Let me know if this would cause you pain.
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEYEARECAAYFAkmPZuIACgkQ2YZpQepbvXHsbQCgl78AxhkBTbATQbV7jab+P8a+ F10An3skXX9Am4+BOk8gCqNaNiiVU1Vg =Ddit -----END PGP SIGNATURE-----

Barry Warsaw wrote:
Does anybody set USE_ENVELOPE_SENDER to Yes these days?
There are potential issues with this with umbrella lists. Perhaps Mailman 3 will handle these differently, but here is the issue.
There are two message methods, get_sender() and get_senders(). USE_ENVELOPE_SENDER only affects get_sender(). With USE_ENVELOPE_SENDER false, get_sender() returns the first address found in From:, Sender: and unixfrom (envelope sender). With USE_ENVELOPE_SENDER true, the order is Sender:, From: and unixfrom, so it doesn't even really do what it claims.
get_senders() returns a list of addresses found in those headers defined in SENDER_HEADERS. The default searches From:, unixfrom, Reply-To: and Sender: in that order and returns all addresses found.
The Moderate handler first checks the get_senders() list to see if any address is a list member. The first hit determines whether the post is from a moderated member. If there are no hits, Moderate goes on the search *_these_nonmembers for the one address returned by get_sender()
The potential issue is if you want posts to the umbrella list to be accepted by the child lists without being held, one technique is to put the umbrella's listname-bounces address in accept_these_nonmembers of the children, and this requires USE_ENVELOPE_SENDER to be true in order to work.
There are other ways to accomplish this that don't require USE_ENVELOPE_SENDER. E.g. subscribing the umbrella's listname-bounces address to the child lists with delivery (and password reminders) disabled; using appropriate @listname entries in accept_these_nonmembers, or making the umbrella anonymous and putting the umbrella's posting address in the children's accept_these_nonmembers.
Some of this is in the FAQ at <http://wiki.list.org/x/boA9>.
I agree that the use of USE_ENVELOPE_SENDER as an anti-spoof is outdated, particularly because it doesn't even come into play for the member/nonmember decision.
I think it will impact some users with umbrella lists depending on how (or if) umbrella lists are handled in Mailman 3.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi Mark,
On Feb 8, 2009, at 6:49 PM, Mark Sapiro wrote:
MM3 should implement the functionality of umbrella lists quite
differently. My plan is to use roster composition instead.
Indeed. Strike one!
BTW, I am thinking about replacing get_sender() with a sender
attribute, which would return the first non-false value from the
senders
attribute. This latter is the new get_senders(). senders
takes its cue from a configurable list of headers (which can include
the envelope sender) and simply returns a list of all the email
addresses found in the specified headers.
Yep. It's very unfortunate that USE_ENVELOPE_SENDER is a system-wide
configuration. Strike two!
Strike three. :)
Cool, thanks for this message. The use case of composite mailing
lists is an important driver for separating out the concept of a
roster in MM3, and I expect that we'll have direct support for this
without all the nasty workarounds or problems described in the FAQ.
It's not there yet, but it is planned, and shouldn't need to rely on
the envelope sender for posting permissions and such.
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEYEARECAAYFAkmPdF8ACgkQ2YZpQepbvXEkrwCfYHJQjoWAN0GFNTkCi1da+TR7 IZUAn1oyosfUFg0e4GZkNwGRKsovclIn =/ls6 -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Feb 9, 2009, at 5:47 AM, Ian Eiloart wrote:
I think so too. How's that coming along?
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEYEARECAAYFAkmR640ACgkQ2YZpQepbvXGjOgCeKZyrV9XlzokN1X05OJ/gmNMf trgAoItdNYDwKHwMH10r5S6bfwdI3lZq =VnvI -----END PGP SIGNATURE-----

I'm not sure whether I do use it, but I think I should.
Most of our list users are in our own domain. That domain certainly is less spoofable in the envelope, because we don't accept mail from our domain unless it's been through our servers. We don't get spam with sussex.ac.uk in the envelope sender domain.
With SPF records now widely published, including by several large free email service providers, it's certainly within the power of sites to validate the envelope sender address of much of their inbound email. Losing this facility now would be a great shame.
I certainly don't see how having the option can do much harm.
It might be worth adding code to support BATV, if it isn't there already.
--On 8 February 2009 18:12:33 -0500 Barry Warsaw <barry@list.org> wrote:
-- Ian Eiloart IT Services, University of Sussex x3148

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Feb 9, 2009, at 5:43 AM, Ian Eiloart wrote:
MM3 does not yet support this.
So, I've landed a branch that gets rid of the MM3 equivalent to
USE_ENVELOPE_SENDER, but it will still be possible to consider the
MAIL FROM or Sender addresses in preference to From, if you wanted
to. I've implemented a site admin definable header lookup scheme so
you can define the order that headers are considered. By default it's
From:, MAIL FROM, Reply-To, Sender. This is a global order just like
U_E_S was.
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEUEARECAAYFAkmR6p4ACgkQ2YZpQepbvXHMTgCWKRprqGSj2x2uMUvzVff+GwPa FACgsLbElDIgzCYExy/rsm92g/HG9wQ= =A0Ue -----END PGP SIGNATURE-----

Barry Warsaw wrote:
Does anybody set USE_ENVELOPE_SENDER to Yes these days?
There are potential issues with this with umbrella lists. Perhaps Mailman 3 will handle these differently, but here is the issue.
There are two message methods, get_sender() and get_senders(). USE_ENVELOPE_SENDER only affects get_sender(). With USE_ENVELOPE_SENDER false, get_sender() returns the first address found in From:, Sender: and unixfrom (envelope sender). With USE_ENVELOPE_SENDER true, the order is Sender:, From: and unixfrom, so it doesn't even really do what it claims.
get_senders() returns a list of addresses found in those headers defined in SENDER_HEADERS. The default searches From:, unixfrom, Reply-To: and Sender: in that order and returns all addresses found.
The Moderate handler first checks the get_senders() list to see if any address is a list member. The first hit determines whether the post is from a moderated member. If there are no hits, Moderate goes on the search *_these_nonmembers for the one address returned by get_sender()
The potential issue is if you want posts to the umbrella list to be accepted by the child lists without being held, one technique is to put the umbrella's listname-bounces address in accept_these_nonmembers of the children, and this requires USE_ENVELOPE_SENDER to be true in order to work.
There are other ways to accomplish this that don't require USE_ENVELOPE_SENDER. E.g. subscribing the umbrella's listname-bounces address to the child lists with delivery (and password reminders) disabled; using appropriate @listname entries in accept_these_nonmembers, or making the umbrella anonymous and putting the umbrella's posting address in the children's accept_these_nonmembers.
Some of this is in the FAQ at <http://wiki.list.org/x/boA9>.
I agree that the use of USE_ENVELOPE_SENDER as an anti-spoof is outdated, particularly because it doesn't even come into play for the member/nonmember decision.
I think it will impact some users with umbrella lists depending on how (or if) umbrella lists are handled in Mailman 3.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Hi Mark,
On Feb 8, 2009, at 6:49 PM, Mark Sapiro wrote:
MM3 should implement the functionality of umbrella lists quite
differently. My plan is to use roster composition instead.
Indeed. Strike one!
BTW, I am thinking about replacing get_sender() with a sender
attribute, which would return the first non-false value from the
senders
attribute. This latter is the new get_senders(). senders
takes its cue from a configurable list of headers (which can include
the envelope sender) and simply returns a list of all the email
addresses found in the specified headers.
Yep. It's very unfortunate that USE_ENVELOPE_SENDER is a system-wide
configuration. Strike two!
Strike three. :)
Cool, thanks for this message. The use case of composite mailing
lists is an important driver for separating out the concept of a
roster in MM3, and I expect that we'll have direct support for this
without all the nasty workarounds or problems described in the FAQ.
It's not there yet, but it is planned, and shouldn't need to rely on
the envelope sender for posting permissions and such.
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEYEARECAAYFAkmPdF8ACgkQ2YZpQepbvXEkrwCfYHJQjoWAN0GFNTkCi1da+TR7 IZUAn1oyosfUFg0e4GZkNwGRKsovclIn =/ls6 -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Feb 9, 2009, at 5:47 AM, Ian Eiloart wrote:
I think so too. How's that coming along?
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEYEARECAAYFAkmR640ACgkQ2YZpQepbvXGjOgCeKZyrV9XlzokN1X05OJ/gmNMf trgAoItdNYDwKHwMH10r5S6bfwdI3lZq =VnvI -----END PGP SIGNATURE-----

I'm not sure whether I do use it, but I think I should.
Most of our list users are in our own domain. That domain certainly is less spoofable in the envelope, because we don't accept mail from our domain unless it's been through our servers. We don't get spam with sussex.ac.uk in the envelope sender domain.
With SPF records now widely published, including by several large free email service providers, it's certainly within the power of sites to validate the envelope sender address of much of their inbound email. Losing this facility now would be a great shame.
I certainly don't see how having the option can do much harm.
It might be worth adding code to support BATV, if it isn't there already.
--On 8 February 2009 18:12:33 -0500 Barry Warsaw <barry@list.org> wrote:
-- Ian Eiloart IT Services, University of Sussex x3148

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Feb 9, 2009, at 5:43 AM, Ian Eiloart wrote:
MM3 does not yet support this.
So, I've landed a branch that gets rid of the MM3 equivalent to
USE_ENVELOPE_SENDER, but it will still be possible to consider the
MAIL FROM or Sender addresses in preference to From, if you wanted
to. I've implemented a site admin definable header lookup scheme so
you can define the order that headers are considered. By default it's
From:, MAIL FROM, Reply-To, Sender. This is a global order just like
U_E_S was.
Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin)
iEUEARECAAYFAkmR6p4ACgkQ2YZpQepbvXHMTgCWKRprqGSj2x2uMUvzVff+GwPa FACgsLbElDIgzCYExy/rsm92g/HG9wQ= =A0Ue -----END PGP SIGNATURE-----
participants (3)
-
Barry Warsaw
-
Ian Eiloart
-
Mark Sapiro