Hi Mailmen & Mailwomen,
I'm an open-source butterfly, flitting from project to project. I ask questions here, contribute patches there, and report bugs elsewhere. As you can probably imagine, subscribe-to-post seriously annoys me. I can't tell you how many times I've done the "subscribe, disable delivery, ask for CC on replies" mambo, and it's getting to the point where I just won't bother unless I've got a serious issue.
The thing is, I don't blame the list maintainers for enabling subscribe-to-post -- it's just the only easily accessible solution to the spam crisis at this point -- but I would really like to see them have a better option. Since Mailman has already taken over the world you guys are in a great position to give it to them!
I brought this up on the Cairo mailing list recently <http://lists.freedesktop.org/archives/cairo/2006-November/008345.html> and Carl Worth brought up the idea of a simple option to accept any post that's cryptographically signed, regardless of subscriber status. I liked this idea for several reasons.
- I've never seen signed spam
- Most mail programs have some way to sign mails
- When spammers do start signing spam it allows a straightforward transition to a real web-of-trust style model.
After a bit of searching I found RFE 893870 <https://sourceforge.net/tracker/?func=detail&atid=350103&aid=893870&group_id=103>, which seems to have been dismissed on a technicality. Are there serious technical or philosophical problems with the idea, or is this just a matter of finding somebody with the time and talent to do an implementation?
Thanks, -n8
--
-- Nathaniel Gray -- Caltech Computer Science ------> -- Mojave Project -- http://mojave.cs.caltech.edu -->
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 3, 2006, at 7:18 PM, Nathaniel Gray wrote:
As you can probably imagine, subscribe-to-post seriously annoys me. I can't tell you how many times I've done the "subscribe, disable delivery, ask for CC on replies" mambo, and it's getting to the point where I just won't bother unless I've got a serious issue.
I'm with you.
I brought this up on the Cairo mailing list recently <http://lists.freedesktop.org/archives/cairo/2006-November/ 008345.html> and Carl Worth brought up the idea of a simple option to accept any
post that's cryptographically signed, regardless of subscriber status. I liked this idea for several reasons.
- I've never seen signed spam
- Most mail programs have some way to sign mails
- When spammers do start signing spam it allows a straightforward transition to a real web-of-trust style model.
After a bit of searching I found RFE 893870 <https://sourceforge.net/tracker/? func=detail&atid=350103&aid=893870&group_id=103>, which seems to have been dismissed on a technicality. Are there
serious technical or philosophical problems with the idea, or is this just a matter of finding somebody with the time and talent to do an
implementation?
Given that this could be a posting option that list admins could
choose or not, I'm all for it. I'd like to augment the "who can post
to this list" options with at least one other workflow: self-
verification. IOW, even if you're not a member of the list, you
would get a confirmation message, which when replied to would enable
your posts to the list, without you having to subscribe.
This is clearly a Mailman 2.2 feature though, so if you decide to
whip something up, please do so against the trunk.
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRUzcsnEjvBPtnXfVAQLQbAQAiDZi0bkxiwysgnWYwZkobn+6K7961ssz yJ/Vu+QPeipBDSToqOw00htXErpUv+XwPW5NIE/VZyi4HHdJ0IRVuNBm34nxtuqG vSBaBHNdQ+IelrjykuDKlcnJpNRt1gyIQvsT+jhuQAtM8L3K2H6s+fYxU0ssRI1M AOKxK6IKueg= =kTI3 -----END PGP SIGNATURE-----
Barry Warsaw wrote:
On Nov 3, 2006, at 7:18 PM, Nathaniel Gray wrote:
As you can probably imagine, subscribe-to-post seriously annoys me. I can't tell you how many times I've done the "subscribe, disable delivery, ask for CC on replies" mambo, and it's getting to the point where I just won't bother unless I've got a serious issue.
I'm with you.
Glad to hear it!
I brought this up on the Cairo mailing list recently <http://lists.freedesktop.org/archives/cairo/2006-November/008345.html> and Carl Worth brought up the idea of a simple option to accept any post that's cryptographically signed, regardless of subscriber status. I liked this idea for several reasons.
- I've never seen signed spam
- Most mail programs have some way to sign mails
- When spammers do start signing spam it allows a straightforward transition to a real web-of-trust style model.
After a bit of searching I found RFE 893870 <https://sourceforge.net/tracker/?func=detail&atid=350103&aid=893870&group_id=103>,
which seems to have been dismissed on a technicality. Are there serious technical or philosophical problems with the idea, or is this just a matter of finding somebody with the time and talent to do an implementation?
Given that this could be a posting option that list admins could choose or not, I'm all for it. I'd like to augment the "who can post to this list" options with at least one other workflow: self-verification. IOW, even if you're not a member of the list, you would get a confirmation message, which when replied to would enable your posts to the list, without you having to subscribe.
That would help as well. It would also be nice if Mailman would auto-CC replies to the sender if they aren't subscribed.
This is clearly a Mailman 2.2 feature though, so if you decide to whip something up, please do so against the trunk.
Sadly, I don't think I can volunteer for this. I don't think it would be too tough to implement for somebody with the proper expertise but I don't have any serious experience with either mail, crypto, or the Mailman code base. My hope is that somebody on this list does and perhaps understands the improvement this feature could offer. At the very least I'm happy to hear that you're thinking about the subcribe-to-post problem.
Thanks, -Nathan
--
-- Nathaniel Gray -- Caltech Computer Science ------> -- Mojave Project -- http://mojave.cs.caltech.edu -->
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/4/06 1:32 PM, Barry Warsaw wrote:
Given that this could be a posting option that list admins could
choose or not, I'm all for it.
I'd like to add my $.02 as well. I think this would be a great feature, and since admins could choose to use it or not I think it might be helpful to have it on by default. But since many list readers (and possibly owners) might not understand exactly how it works, here's my thought.
Have it turned on by default, but when Mailman sends out the message it adds a header to the mail; as Nathan later suggested, having it automatically set the "Reply-To" to include the sender so they get copies of replies would be good - better would be for Mailman to do it automagically, but that would require a bit more work to keep track of who submitted what mail, etc (things which MM isn't currently stateful enough to track, though I don't know what other 2.2 plans are in the works). The other would be a "header" in the body of the message, perhaps something like:
[This sender is not subscribed to the list, but their email is being sent through because it is cryptographically signed - replies to the email should be CC'd to the original sender]
Having it on by default might be seen as a "back door" to some, but off by default means people would have to see the benefits of turning it on before they'd do so. Since signed mails are likely to only be done by people who know what they're doing, and I'll guess are also less likely to be the type to post nonsense to mailing lists only to add to clutter, I'd think it would be safe to leave on. And by having the header there, it would probably alleviate those readers/admins that would wonder, "How the hell did they post on here when they're not subscribed..."
Steve Huston - W2SRH - Unix Sysadmin, Dept. of Astrophysical Sciences Princeton University | ICBM Address: 40.346525 -74.651285 126 Peyton Hall |"On my ship, the Rocinante, wheeling through Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus, (609) 258-7375 | headlong into mystery." -Rush, 'Cygnus X-1' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFTie8CCKCCLIg8RMRAoUgAJ9Lhu7V3rH8j5ayIhoMoPEd24H8AwCeJnyN 0aRAWpvuhzu1wP8jezEBLXk= =lc5i -----END PGP SIGNATURE-----
I think Barry's idea that non-subscribers could ack their own messages is excellent. I'm not sure that simply having a signed message enter the system is a good thing to default to being on though... In fact, I can think of a few lists wherein that behaviour would be disasterous, and if it were defaulted to ON and was a new feature that the admins weren't aware of, some stuff would definitely hit the fan.
Bob
---------- Original Message ----------- From: Steve Huston <huston@astro.princeton.edu> To: mailman-developers@python.org Sent: Sun, 05 Nov 2006 13:04:44 -0500 Subject: Re: [Mailman-Developers] Crypto-sign to post
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/4/06 1:32 PM, Barry Warsaw wrote:
Given that this could be a posting option that list admins could
choose or not, I'm all for it.I'd like to add my $.02 as well. I think this would be a great feature, and since admins could choose to use it or not I think it might be helpful to have it on by default. But since many list readers (and possibly owners) might not understand exactly how it works, here's my thought.
Have it turned on by default, but when Mailman sends out the message it adds a header to the mail; as Nathan later suggested, having it automatically set the "Reply-To" to include the sender so they get copies of replies would be good - better would be for Mailman to do it automagically, but that would require a bit more work to keep track of who submitted what mail, etc (things which MM isn't currently stateful enough to track, though I don't know what other 2.2 plans are in the works). The other would be a "header" in the body of the message, perhaps something like:
[This sender is not subscribed to the list, but their email is being sent through because it is cryptographically signed - replies to the email should be CC'd to the original sender]
Having it on by default might be seen as a "back door" to some, but off by default means people would have to see the benefits of turning it on before they'd do so. Since signed mails are likely to only be done by people who know what they're doing, and I'll guess are also less likely to be the type to post nonsense to mailing lists only to add to clutter, I'd think it would be safe to leave on. And by having the header there, it would probably alleviate those readers/admins that would wonder, "How the hell did they post on here when they're not subscribed..."
Steve Huston - W2SRH - Unix Sysadmin, Dept. of Astrophysical Sciences Princeton University | ICBM Address: 40.346525 -74.651285 126 Peyton Hall |"On my ship, the Rocinante, wheeling through Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus, (609) 258-7375 | headlong into mystery." -Rush, 'Cygnus X-1' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFTie8CCKCCLIg8RMRAoUgAJ9Lhu7V3rH8j5ayIhoMoPEd24H8AwCeJnyN 0aRAWpvuhzu1wP8jezEBLXk= =lc5i -----END PGP SIGNATURE-----
Mailman-Developers mailing list Mailman-Developers@python.org http://mail.python.org/mailman/listinfo/mailman-developers Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py Searchable Archives: http://www.mail-archive.com/mailman-developers%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-developers/bob%40nleaudio.com
Security Policy: http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq01.027.htp ------- End of Original Message -------
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 5, 2006, at 1:04 PM, Steve Huston wrote:
Having it on by default might be seen as a "back door" to some, but
off by default means people would have to see the benefits of turning
it on before they'd do so. Since signed mails are likely to only be done by people who know what they're doing, and I'll guess are also less
likely to be the type to post nonsense to mailing lists only to add to
clutter, I'd think it would be safe to leave on. And by having the header
there, it would probably alleviate those readers/admins that would wonder,
"How the hell did they post on here when they're not subscribed..."
OTOH, you could argue that any list where a significant population of
non-subscribers would be expected to post signed messages would be
tech-savvy enough to have an admin that could enable the feature. My
initial gut feeling is that it should be disabled by default, but I
am planning on implementing 'list styles' for 2.2 so it should be
easy to set that once and have all your new lists automatically pick
that up (I'm not planning on letting styles change existing lists).
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRU+DD3EjvBPtnXfVAQLHoAP6A9N89zoScMuwZErdz4tc3RSrT4K46TLG iSd+i4SE4QXzMKSRamPRyg6iagnGHdpbOZZ+7jft/W369tj2iCH7xcweYsUN+4Hc EC7YUZ+FQOlOaC505XBLGVgsN72lOvwMht8RllbrQGXPF6ZfKcMTkuQLxu1LAco2 JZh2rbkLvIs= =CGN3 -----END PGP SIGNATURE-----
--On 4 November 2006 13:32:13 -0500 Barry Warsaw <barry@python.org> wrote:
Given that this could be a posting option that list admins could choose or not, I'm all for it. I'd like to augment the "who can post to this list" options with at least one other workflow: self- verification. IOW, even if you're not a member of the list, you would get a confirmation message, which when replied to would enable your posts to the list, without you having to subscribe.
This is clearly a Mailman 2.2 feature though, so if you decide to whip something up, please do so against the trunk.
- -Barry
This can be useful if enabled for specific domains - for example, we'd use it for our own domain. However, if you blindly respond to spam with confirmation messages, you'll be generating collateral spam. That'll already get you blacklisted with spamcop. So, I'm in favour if it's implemented carefully.
-- Ian Eiloart IT Services, University of Sussex
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 6, 2006, at 6:59 AM, Ian Eiloart wrote:
This can be useful if enabled for specific domains - for example,
we'd use it for our own domain. However, if you blindly respond to spam with confirmation messages, you'll be generating collateral spam. That'll already get you blacklisted with spamcop. So, I'm in favour if it's implemented carefully.
This is a much more general problem with replybots. Mailman already
tries to be very careful about when and how it auto-responds to
unsolicited queries. We're probably not doing the best job we can
here, so my plan is to build in a more general "governor" subsystem
and route all autoresponses through that. I agree that we need to be
very very careful about the balance between helpfulness and spamminess.
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRU+DrHEjvBPtnXfVAQLswwQAh1FIRetkBya1LqNvro+99+5a0e4L2v/l ZN3Jwkg+XaJ6cB1jxrdcvtaRHTJAt0wbxYFg8S+drkMGHhn+5+8peQ1aWGAdhOVX NKt3nCXY3wpTCAgBSqGgCbgozV+AB6rfmUiPaCeyk4ehAP+jrBgEHmgJZbGj3ECt QSvCvHdKw1U= =yAiE -----END PGP SIGNATURE-----
Ian Eiloart writes:
This can be useful if enabled for specific domains - for example, we'd use it for our own domain. However, if you blindly respond to spam with confirmation messages, you'll be generating collateral spam. That'll already get you blacklisted with spamcop.
What "blindly"? As far as I can tell, any autoreponse to spam puts you at risk from spamcop, no matter how much care you put into inbound filtering.
On Tue, Nov 07, 2006 at 12:40:56PM +0900, stephen@xemacs.org wrote:
What "blindly"? As far as I can tell, any autoreponse to spam puts you at risk from spamcop, no matter how much care you put into inbound filtering.
As does operating any mailing list or website. From my personal experience.
-- Dan Wilder <wilder@eskimo.com>
--On 7 November 2006 12:40:56 +0900 stephen@xemacs.org wrote:
Ian Eiloart writes:
This can be useful if enabled for specific domains - for example, we'd use > it for our own domain. However, if you blindly respond to spam with > confirmation messages, you'll be generating collateral spam. That'll > already get you blacklisted with spamcop.
What "blindly"? As far as I can tell, any autoreponse to spam puts you at risk from spamcop, no matter how much care you put into inbound filtering.
"blindly respond to spam" - respond to email without knowing whether it's spam.
"blindly walk off a cliff" - take a step forward without knowing the ground level ahead.
-- Ian Eiloart IT Services, University of Sussex
Ian Eiloart writes:
"blindly respond to spam" - respond to email without knowing whether it's spam.
Since I specified "careful filtering", I guess what you're saying is that all mail one wishes to reply to must be read by the responsible human (unless the replybot is owned by the recipient's boss, and therefore by definition is not spam for the recipient)?
I thought the whole point of Mailman was to avoid that. That's certainly why my project uses Mailman!
On Fri, Nov 03, 2006 at 04:18:59PM -0800, Nathaniel Gray wrote:
I can't tell you how many times I've done the "subscribe, disable delivery, ask for CC on replies" mambo, and it's getting to the point where I just won't bother unless I've got a serious issue.
The thing is, I don't blame the list maintainers for enabling subscribe-to-post -- it's just the only easily accessible solution to the spam crisis at this point --
Carl Worth brought up the idea of a simple option to accept any post that's cryptographically signed, regardless of subscriber status. I liked this idea for several reasons.
- I've never seen signed spam
- Most mail programs have some way to sign mails
- When spammers do start signing spam it allows a straightforward transition to a real web-of-trust style model.
You may want to have a look at http://www.non-gnu.uvt.nl/mailman-ssls/ If it cannot do it already, at least it brings a GnuPG-integration framework that will make it less work to implement what you want.
-- Lionel
Re-hi,
I brought this up on the Cairo mailing list recently <http://lists.freedesktop.org/archives/cairo/2006-November/008345.html> and Carl Worth brought up the idea of a simple option to accept any post that's cryptographically signed, regardless of subscriber status. I liked this idea for several reasons.
- I've never seen signed spam
- Most mail programs have some way to sign mails
- When spammers do start signing spam it allows a straightforward transition to a real web-of-trust style model.
I already received some spam messages including GPG markings. They were fake, of course; they were used to fool simple scoring systems (e.g. if message contains "BEGIN PGP SIGNED MESSAGE", it is most likely no spam).
As you mentioned, signing of a message is easy; so it is easy to sign a spam message, too. The problem is: Which key is used to sign the message, and how do you determine whether a key belongs to a spammer or to an ordinary user? The signature alone does not solve your problem.
The (only?) way to tell the mailing list that your key is to be trusted is the same procedure as usual: Register before post. The advantage you'll gain by verifying signatures is independence of the sender's address:
- Sender spoofing becomes impossible (the signature cannot be forged)
- No more hassle with different mail accounts (as long as the signature verifies, the ml will deliver the mail regardless of the sender's address)
Follow-up problem (or implementation detail, call it as you like it): Message freshness and partially signed messages. A spammer could capture a signed mail and repost it to a list; the spam message could be inserted at an unsigned part. If the list checks if some part is signed, the spam will be delivered; if the list verifies that the whole message is signed, you might have a lot of trouble with users using a buggy mail client.
Another possible problem: Verifying a cryptographic signature is a rather "expensive" operations (in terms of CPU time), on a high traffic server this will have a severe impact.
Please don't get me wrong: I think using signatures (and probably encryption, too) is a good idea - I'm just pointing out thoughts we made up when trying to hack gpg and/or s/mime support into mailman. In course of that project, we tried to implement a "post if signature verifies", too. If you want to have a look at it, see: http://non-gnu.uvt.nl/mailman-ssls/ My initial efforts for an encrypted mailing list are at: http://stefan.ploing.de/linux/gpg-mailman
Stefan.
On 11/9/06 5:54 AM, Stefan Schlott wrote:
As you mentioned, signing of a message is easy; so it is easy to sign a spam message, too. The problem is: Which key is used to sign the message, and how do you determine whether a key belongs to a spammer or to an ordinary user? The signature alone does not solve your problem.
This would be for a project other than Mailman, however there already exists various blacklists and such which MTAs can use to determine if a host is likely to be a spammer. Likewise, I'm sure it wouldn't take very much to setup a daemon that contains a list of "known spammy keys", and populate ones GPG keyring with those keys and flagged as untrusted. Then it would be a matter of allowing any signed mail from a non-untrusted key (so either trusted, or unknown).
-- Steve Huston - W2SRH - Unix Sysadmin, Dept. of Astrophysical Sciences Princeton University | ICBM Address: 40.346525 -74.651285 126 Peyton Hall |"On my ship, the Rocinante, wheeling through Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus, (609) 258-7375 | headlong into mystery." -Rush, 'Cygnus X-1'
On 11/9/06 2:54 AM, "Stefan Schlott" <stefan.schlott@ulm.ccc.de> wrote:
Another possible problem:
And yet another problem: the proliferation of different ways to create signed messages, and recognizing them successfully.
I could sign messages at least three ways just using Apple's Mail.app: GPG with a suitable plug-in (what I do) in SMIME form BEGIN SIGNED MESSAGE form Whatever is native to Mail.app (involves getting a [free] personal certificate from Thawte, and putting it into the keychain. Signing is automatic at that point). I don't know what format that produces--I've been meaning to find out.
(No, you won't find me on the public key servers--we use this inhouse only.)
I think all traces of the signature need to be stripped after it is used for verification (but I could be wrong).
All that (and the other problems cited in this thread) aside, I advocated this idea about 5 years ago, and still favor it.
--John
John W. Baxter writes:
I think all traces of the signature need to be stripped after it is used for verification (but I could be wrong).
This should be an option or at least there should be an easy way to work around it; suppose the message is something like a collection of checksums for a distro, or a signed patch for projects that use such things?
However, for general purposes I think that stripping the signature would be a good idea. Specifically, I would imagine that even if you sign "the whole message", this still leaves room for spammish use of the preamble and trailer (or even the Subject header), while the signed body of the message is used in a replay attack.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 9, 2006, at 5:54 AM, Stefan Schlott wrote:
I already received some spam messages including GPG markings. They
were fake, of course; they were used to fool simple scoring systems (e.g. if
message contains "BEGIN PGP SIGNED MESSAGE", it is most likely no spam).As you mentioned, signing of a message is easy; so it is easy to
sign a spam message, too. The problem is: Which key is used to sign the
message, and how do you determine whether a key belongs to a spammer or to an
ordinary user? The signature alone does not solve your problem.
I suppose you could also have each mailing list publish a pubkey and
require that messages be encrypted with that pubkey in order to get
posted. Of course that increases the cycles involved on both ends,
but it allows you to accept messages without requiring the
registration of each sender's key. Sure, spammers could use the same
key to sign spam, but I wonder if that wouldn't be more work than is
worthwhile for a botnet.
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRVadKHEjvBPtnXfVAQKeXAP/fvdpKqWbXWBubOkpzexyHQXha3EcJBlT xfV2BKmJkc0cPXiyXgG+V1kKtg3kp+6/tCqRQDXjmAgjjvGZEuB5cWi+ebmqMfcW ETC4Ma246yuYZNq/yoMu8+o7NlXaIlPQrqSZhzG5rV97BQ8gSa20BxJ+uQNufs4D /KTeGdA6C9s= =J1L6 -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/11/06 11:03 PM, Barry Warsaw wrote:
I suppose you could also have each mailing list publish a pubkey and
require that messages be encrypted with that pubkey in order to get
posted. Of course that increases the cycles involved on both ends,
but it allows you to accept messages without requiring the
registration of each sender's key. Sure, spammers could use the same
key to sign spam, but I wonder if that wouldn't be more work than is
worthwhile for a botnet.
Now there's something which I'm sure it's a small subset of people would be interested in, but it would definitely be nice.. the ability to run an entirely encrypted mailing list. You encrypt your message to the "list key", and Mailman decrypts it, inserts some bit in the message about the original signing key, and encrypts it to each recipient. Subscribers would have to either submit a key to Mailman, or at least a key ID which could be retrieved from a keyserver. With verp I would think that encrypting to individuals would be slightly simpler - but again, a lot of CPU cycles to make it work. And I'm not sure how many lists would take advantage of it. Would also make archiving an interesting proposition...
Sorry; thinking aloud again :>
Steve Huston - W2SRH - Unix Sysadmin, Dept. of Astrophysical Sciences Princeton University | ICBM Address: 40.346525 -74.651285 126 Peyton Hall |"On my ship, the Rocinante, wheeling through Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus, (609) 258-7375 | headlong into mystery." -Rush, 'Cygnus X-1' -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFV2oSCCKCCLIg8RMRAgCcAKDt8BY24u6lda2PtC0+jdxRNiqfcwCbB4dX +bj5fzpqp1sx5UbUnzrSUvg= =im3W -----END PGP SIGNATURE-----
Hi,
I suppose you could also have each mailing list publish a pubkey and
require that messages be encrypted with that pubkey in order to get
posted.
Now there's something which I'm sure it's a small subset of people would be interested in, but it would definitely be nice.. the ability to run an entirely encrypted mailing list.
This is exactly what my gpg-mailman hack does :-) Joost started with "authentication by signature" and s/mime, I wanted an gpg-encrypted mailinglist. Joost tried to merge both patches, the result is available as a darcs repository.
think that encrypting to individuals would be slightly simpler - but again, a lot of CPU cycles to make it work. And I'm not sure how many lists would take advantage of it.
If you want to do it properly witch out-of-the-box software (like gpg or s/mime), you have to create an individually encrypted mail for each recipient. Up to now, mailman was concerned with the number of "sendmail jobs" - mailman sends mails in "chunks" with a certain number of recipients and lets the mailserver multiply the mail on delivery. With public key encryption, this is no longer possible; but this wouldn't matter since the public key operations are horribly expensive (in terms of CPU cycles) - it would hardly make a difference :-)
For low traffic lists or lists with only a few members, public key encrpytion can be done without killing the ml server. For large lists, I doubt that this would work. Using specialized software, it would be possible, but special software for an encrypted list would bring the acceptance rate close to 0% :-(
Would also make archiving an interesting proposition...
Store the decrypted mails, allow https access only, require authentication by ml members - that would do it in most cases. If you have special requirements (e.g. members may only access the time interval of their own membership) would require special software, though.
Stefan.
Barry Warsaw writes:
I suppose you could also have each mailing list publish a pubkey and
require that messages be encrypted with that pubkey in order to get
posted.
Hey, that's great, we can update RFC 2369 with a List-Pubkey header! I bet Gmane learns to use it within a week after proposal!<wink>
Sure, spammers could use the same key to sign spam, but I wonder if that wouldn't be more work than is worthwhile for a botnet.
Don't bet on it. As Brad points out, a botnet has effectively unbounded resources per message. If this becomes a standard feature of any software as widely distributed as Mailman, some spammer will decide to exploit it, and there goes the neighborhood.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Nov 13, 2006, at 2:55 AM, stephen@xemacs.org wrote:
Barry Warsaw writes:
I suppose you could also have each mailing list publish a pubkey and require that messages be encrypted with that pubkey in order to get posted.
Hey, that's great, we can update RFC 2369 with a List-Pubkey header! I bet Gmane learns to use it within a week after proposal!<wink>
:)
Sure, spammers could use the same key to sign spam, but I wonder if that wouldn't be more work than is worthwhile for a botnet.
Don't bet on it. As Brad points out, a botnet has effectively unbounded resources per message. If this becomes a standard feature of any software as widely distributed as Mailman, some spammer will decide to exploit it, and there goes the neighborhood.
Sure, but then they've also got to distribute all the pubkeys for all
the lists they want to spam to all the bots. Yeah, you're probably
right that we're doomed anyway, at least until forced upgrades to
Real OSes for all pwned machines are mandated under threat of UN muscle.
- -B
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin)
iQCVAwUBRVhs1HEjvBPtnXfVAQIqfgP/SCZTN3C18ksCZsJzcJVqPIKQ6OlkKtNG XEaB1YQUd7mAlTlbPFkaOGmJTL3l4rZuqvfbraI849cO7J4WTXKLuxBXbtVBAxi9 jCP1JCH1DtIUH8JCEe/+f8QKMS5c+iik8MBH8C+aIL7+f5iE9PhkIRwWVFUBbk7p O/LSW3Q/Gys= =eFjI -----END PGP SIGNATURE-----
--On 11 November 2006 23:03:52 -0500 Barry Warsaw <barry@python.org> wrote:
I suppose you could also have each mailing list publish a pubkey and require that messages be encrypted with that pubkey in order to get posted. Of course that increases the cycles involved on both ends, but it allows you to accept messages without requiring the registration of each sender's key. Sure, spammers could use the same key to sign spam, but I wonder if that wouldn't be more work than is worthwhile for a botnet.
- -Barry
Wouldn't it be easier just to join the list?
-- Ian Eiloart IT Services, University of Sussex
participants (10)
-
Barry Warsaw -
Bob Puff -
Ian Eiloart -
John W. Baxter -
Lionel Elie Mamane -
Nathaniel Gray -
Stefan Schlott -
stephen＠xemacs.org -
Steve Huston -
wilder＠eskimo.com