hi mailman people, terri,

i looked for information regarding archtocnombox.html relating to the problem of a full raw mbox archive being non-antispammed, but couldn't find any discussion. It's clear somebody has thought about it, since the file exists.

Are there any plans (or any options already present) to have the full raw mbox archive, but corrected for "@" -> " at " (maybe other obvious corrections too), to be made available like the raw spammable version is available if the archtocnombox.html template is not chosen?

It seems to me that this should be made an obvious option - or else that the default should be that the full raw archive .mbox is *not* available.

At least, could info on this be added to the FAQ somewhere, so that people can easily find out what has already been done? E.g.

11.2 What does Mailman do to help protect me from unsolicited bulk email (spam)?
http://www.list.org/mailman-member/node40.html

i've added a comment on barry warsaw's wiki pages: http://zope.org/Members/bwarsaw/MailmanDesignNotes/MailmanProblems

and below is my own analysis.

thanks boud (convert from sympa to mailman ;)

PS: Sorry if this should be to mailman-users rather than mailman-developers, but it seems to me like a developers' issue.

SPAM PROBLEM: HYPOTHESIS SOLUTION 2.1.4

HACK SOLUTION 2.0.11 (AND PROBABLY 2.1.1) (1) remove link to *.mbox in /var/lib/mailman/Mailman/Archiver/HyperArch.py (2) remove compiled versions HyperArch.py[oc] (3) test on an archive (e.g. imc-pl-tech ;) (4) make the *.mbox/*.mbox files inaccessible (since google links remain) (5) think about newlist s (maybe nothing needs doing)

SPAM PROBLEM:

i think this is a known spam problem - by default, it looks like the archive files linked under "download the full raw archive" like the following etc are NOT antispammed:

http://lists.mydomain.org/mailman/public/mylist.mbox/mylist.mbox

It seems to be present in 2.0.11 and 2.1.1

HYPOTHESIS

IMHO the reason why this is probably not easy to solve is that this is where mail is automatically saved when it's received. If this is filtered by " at " -> "@" then it means that overall there are typically 4 copies of the entire mailbox (e.g. html version, monthly archives, true mailbox with @ hidden from external access, and " at " version for web access).

i couldn't find if this has been discussed, but it looks like there's a simple solution in 2.1.4.

SOLUTION 2.1.4

It looks like the solution in mailman-2.1.4 is to offer different templates:

mailman-2.1.4/templates/en/archtoc.html mailman-2.1.4/templates/en/archtocentry.html mailman-2.1.4/templates/en/archtocnombox.html -> this one has no mbox

e.g. http://mail.python.org/pipermail/mailman-announce/ has no *.mbox/*.mbox In fact, http://mail.python.org/pipermail/mailman-announce.mbox/ exists but nothing in it is accessible.

HACK SOLUTION 2.0.11 (AND PROBABLY 2.1.1)

In 2.0.11, the line pointing to the .mbox is in

/var/lib/mailman/Mailman/Archiver/HyperArch.py (for Debian anyway ;)

  You can get <a href="%(listinfo)s">more information about this list</a>
  or you can <a href="%(fullarch)s">download the full raw archive</a>
  (%(size)s).
 </p>

solution:

(1) remove the link to the full .mbox in /var/lib/mailman/Mailman/Archiver/HyperArch.py

To do this,

replace

  You can get <a href="%(listinfo)s">more information about this list</a>
  or you can <a href="%(fullarch)s">download the full raw archive</a>
  (%(size)s).
 </p>

by

  You can get <a href="%(listinfo)s">more information about this list.</a>
 </p>

(2) remove compiled versions (in my case the .pyc gets automatically recompiled)

rm /var/lib/mailman/Mailman/Archiver/HyperArch.py[co]

(3) test this

cd /var/lib/mailman/archives/public/ /usr/lib/mailman/bin/arch mylist

Then check out: http://lists.mydomain.org/pipermail/mylist/

Hopefully there will be no link to the .mbox and even direct access will be impossible.

(4) make the .mbox files inaccessible - since google links will still hang around for some time chmod go-rw /var/lib/mailman/archives/private/*.mbox/*.mbox

(5) probably nothing needed when running newlist for new lists.

Making new lists will, by default, write *.mbox/*.mbox which are web accessible, but nobody is going to link to them (unless paranoid, deliberately wants to subject indymedia users to spam, ...)

anti-spam solidarity boud