Someone started talking about the risk of having their names and email addresses archived in a publicly accessible mailing list. So I thought I'd ask. In short, the proposal provided for completely removing such data, to protect privacy. See here for more: https://mailarchive.ietf.org/arch/msg/dmarc/fEi0-1NFP-rkrx70Ne1t7fPzldA (There are more threads there mentioning Mailman, in case your ears are burning.)
As an additional bonus, that would also "solve" any DMARC problem.
Is there a FAQ entry for this?
Best Ale
On 9/14/20 11:03 AM, vesely@tana.it wrote:
Someone started talking about the risk of having their names and email addresses archived in a publicly accessible mailing list. So I thought I'd ask. In short, the proposal provided for completely removing such data, to protect privacy. See here for more: https://mailarchive.ietf.org/arch/msg/dmarc/fEi0-1NFP-rkrx70Ne1t7fPzldA (There are more threads there mentioning Mailman, in case your ears are burning.)
As an additional bonus, that would also "solve" any DMARC problem.
Is there a FAQ entry for this?
I don't think there is a FAQ on it, but it is a configuration option.
In Mailman 2.1 set General Options -> anonymous_list to Yes in the web admin UI. In MM3 Postorius set Settings -> Alter Messages -> Anonymous list to Yes.
The descriptions say this removes From: Sender: and Reply-To: headers and this is true, It also replaces From: and Reply-To: with the list address. Both MM2.1 and MM3 also remove X-Originating-Email:
Mailman 2.1 is more aggressive. It also removes all Received: and X-Envelope-From: headers and replaces Message-ID:. Additionally, it remove all headers that don't match patterns in the mm_cfg.py/Defaults.py setting ANONYMOUS_LIST_KEEP_HEADERS. By default, this removes all X-* headers except X-Mailman-*, X-Content-Filtered-By:, X-Topics:, X-Ack:, X-Beenthere:, X-List-Administrivia: and X-Spam-*.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
vesely@tana.it writes:
Someone started talking about the risk of having their names and email addresses archived in a publicly accessible mailing list. So I thought I'd ask. In short, the proposal provided for completely removing such data, to protect privacy.
Mark provides the practical stuff. Here's some theory.
"Completely" is a really hard problem given that some people obfuscate their addresses in .signatures and in text, and the difficulty of recognizing personal names.
There's also the fact that an anonymous list is a flag that you've got people who want to be anonymous. A big bullseye for troublemakers (and the FBI, the MSS, and the GRU).
As an additional bonus, that would also "solve" any DMARC problem.
Sure, but the cost is extremely high. I like to know who's posting.
Steve
On Tue 15/Sep/2020 13:58:24 +0200 Stephen J. Turnbull wrote:
vesely@tana.it writes:
Someone started talking about the risk of having their names and email addresses archived in a publicly accessible mailing list. So I thought I'd ask. In short, the proposal provided for completely removing such data, to protect privacy.
Mark provides the practical stuff. Here's some theory.
"Completely" is a really hard problem given that some people obfuscate their addresses in .signatures and in text, and the difficulty of recognizing personal names.
There's also the fact that an anonymous list is a flag that you've got people who want to be anonymous. A big bullseye for troublemakers (and the FBI, the MSS, and the GRU).
So, in practice, you say that anonymity as a list option is not provided because users don't need/ want it. Correct?
As an additional bonus, that would also "solve" any DMARC problem.
Sure, but the cost is extremely high. I like to know who's posting.
me too.
There are other possible DMARC workarounds. I'll be back soon...
Best Ale
On 9/15/20 7:17 AM, Alessandro Vesely wrote:
So, in practice, you say that anonymity as a list option is not provided because users don't need/ want it. Correct?
Steve is not saying the option is not provided. It is provided in both Mailman 2.1 and Mailman 3. He is giving reasons why you might not want to use it.
-- Mark Sapiro mark@msapiro.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Mark Sapiro writes:
Steve is not saying the option is not provided. It is provided in both Mailman 2.1 and Mailman 3. He is giving reasons why you might not want to use it.
Also, I think Mailman 3 provides Pretty Good Anonymity[tm], but we welcome further suggestions. No promises about inclusion or timing if accepted, of course, but suggestions are welcome and will be taken seriously vs. resources available.
participants (4)
-
Alessandro Vesely -
Mark Sapiro -
Stephen J. Turnbull -
vesely＠tana.it