-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Those of you who have been watching the commit messages can see I've
been making some good progress. I'm actually hoping to have a
Mailman 3.0 alpha some time RSN which will almost allow you to run
the system from the command line, but without a web u/i.
So one of the things I'm looking at is the MM2.1 concept of an
Approved header. If a message comes into a list with an Approved
header (or an Approved line at the start of the message body), and
that header has a password that matches the list admin or moderator
password, the message is pre-approved and short-circuits the posting
tests.
The concept doesn't translate well in a Mailman 3 world where there
is no shared admin or moderator password. Web access will be control
via roles and protected by user authentication much like any modern
web application.
So the question is, what do we do about the Approved header?
We can drop the concept altogether. This means there'd be no way
to post a message as coming from an approved source, with a bypass of
the posting filters. Maybe because few people have MUAs that support
adding custom headers, this feature just isn't used much in the real
world these days. You'd still have the moderation bit for announce- only lists though.Replace the concept with some other email authentication
mechanism, e.g. something more secure like a signature check. The
problem with this is that I still don't think message signing is
common practice outside our small community of geeks.Allow an owner or moderator to use their own password in the
Approved header. I'm not crazy about this because it has to be sent
in the clear and if (when?) it gets compromised, their account is
compromised, and this includes their administration of the mailing list.Add a new shared password just for this purpose. You'd still have
to communicate it to all your moderators, probably via the web page,
but at least this password wouldn't have any other purpose so if
(when?) it gets compromised, the only asset it protects is approved
postings. Bad yes, if a spammer gets it, but easily changed and
hopefully fairly limited in the damage it can do.Your suggestion.
Comments? I think my preference would be for #1 with future support
for #2 and just accepting the fact that message signatures are for
power users. Maybe that set is pretty close to the set of people
currently using Approved anyway.
Cheers,
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin)
iD8DBQFHAwd62YZpQepbvXERAmMiAKCm3EyxA1CWxWyz4zWkzNwIDpCNKQCbBSXz hGqwpKEGmUScNjov68TUdgs= =gUiT -----END PGP SIGNATURE-----
--On 2 October 2007 23:07:37 -0400 Barry Warsaw barry@list.org wrote:
- We can drop the concept altogether. This means there'd be no way to post a message as coming from an approved source, with a bypass of the posting filters. Maybe because few people have MUAs that support adding custom headers, this feature just isn't used much in the real world these days. You'd still have the moderation bit for announce- only lists though.
Sounds reasonable to me. I don't use this feature, and I don't think we've documented it for our users. I don't even recall being aware of it before.
- Replace the concept with some other email authentication mechanism, e.g. something more secure like a signature check. The problem with this is that I still don't think message signing is common practice outside our small community of geeks.
No, but it could be useful for some. I doubt that this is urgent though.
- Allow an owner or moderator to use their own password in the Approved header. I'm not crazy about this because it has to be sent in the clear and if (when?) it gets compromised, their account is compromised, and this includes their administration of the mailing list.
No, no, no. Or, at least let me disable it for my site. We're likely to want local people to authenticate with passwords that are shared with services other than Mailman. I think this proposal would be very dangerous in any corporate or educational site.
- Add a new shared password just for this purpose. You'd still have to communicate it to all your moderators, probably via the web page, but at least this password wouldn't have any other purpose so if (when?) it gets compromised, the only asset it protects is approved postings. Bad yes, if a spammer gets it, but easily changed and hopefully fairly limited in the damage it can do.
Erm, no thanks. We really are looking forward to being able to identify our Mailman admins!
- Your suggestion.
Comments? I think my preference would be for #1 with future support for #2 and just accepting the fact that message signatures are for power users. Maybe that set is pretty close to the set of people currently using Approved anyway.
I agree.
-- Ian Eiloart IT Services, University of Sussex x3148
On 10/3/07, Ian Eiloart iane@sussex.ac.uk wrote:
- We can drop the concept altogether.
Sounds reasonable to me.
I've used it before as a site admin to mail lists saying that the list will be closed for whatever reason (since it supports using the site password to approve stuff).
Personally, I think a combination of 2, 3 & 4 - each user can set a GPG/etc key or a password they use for approving messages. Then MM would check the signature and or the Approved psuedo/header against the key/pass of the users who have high enough privileges (site admins, site staff, list admins, list moderators, etc).
-- bye, pabs
http://wiki.debian.org/PaulWise http://docs.indymedia.org/view/Main/PaulWise
Barry Warsaw schrieb:
- Add a new shared password just for this purpose. [...]
I'd prefer that.
- We can drop the concept altogether. This means there'd be no way
to post a message as coming from an approved source, with a bypass of
the posting filters.
That would be bad, I think. It's not uncommon to send mails from "on the road"; in that case you want to "send and forget" the mail without having to visit a website to approve it afterwards. And you may want to send pre-approved mails that are automatically generated.
Maybe because few people have MUAs that support
adding custom headers, this feature just isn't used much in the real
world these days.
But you can add a Approved-line in the body, too.
-thh
Thomas Hochstein wrote:
Barry Warsaw schrieb:
[2... signed email]
- Add a new shared password just for this purpose. [...]
I'd prefer that.
+1 for ((2 || 4) || (2 && 4))
- We can drop the concept altogether. This means there'd be no way
to post a message as coming from an approved source, with a bypass of
the posting filters.That would be bad, I think. It's not uncommon to send mails from "on the road"; in that case you want to "send and forget" the mail without having to visit a website to approve it afterwards. And you may want to send pre-approved mails that are automatically generated.
Removing "Approved" makes mailman _require_ a functioning web UI. That's a bad thing. Right now I frequently approve blocked posts (crossposting, size, etc.) via email. If you remove this, I'd have to go to the web page to do so, which takes longer and requires that I be online (instead of working offline on an airplane, for example).
I'd actually prefer to sign the message with PGP, but an approve-only password works for me (and is both less work to implement and more likely to be implemented correctly).
-- Carson
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On Oct 4, 2007, at 9:14 AM, Carson Gaspar wrote:
I'd actually prefer to sign the message with PGP, but an approve-only password works for me (and is both less work to implement and more likely to be implemented correctly).
Thanks for the feedback everyone. I just pushed a change to
implement the shared moderator password, which will only be used for
that purpose. At some point it probably makes sense to add gpg
signature support, but it sounds like this will work well enough for
now.
Cheers,
- -Barry
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (Darwin)
iQCVAwUBRwfgb3EjvBPtnXfVAQJnJwQAgHBFopt6/5pW6LCLJZd6wjjN+UCumvOw 4L0rdh84RO56oR2eND+6ZqAPNs4IglwE2PWdpXeDH6u1HkKI2U5BfBmN98nf9f9v 7XxAIM6BVu21tSxC4tYOalMaAFGOx3ZByex9Cc15it7NeB4X8SQGkoB4X4W082hp V6hRnhI4gV4= =58u/ -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Barry Warsaw wrote:
So the question is, what do we do about the Approved header?
[...]
Comments? I think my preference would be for #1 with future support for #2 and just accepting the fact that message signatures are for power users. Maybe that set is pretty close to the set of people currently using Approved anyway.
I suspect it is close for people approving posts via email, but based on questions on the mailman-users list, there are some number of 'non-power users' using the Approved: header/body line for spoof-proof posting to announcement lists. I don't really know what the best mechanism is, but I think there needs to be some way for a user to post to an announcement list in a spoof-proof way without requiring a subsequent visit to the web interface to approve the post. I'm not sure that all the people who need to do this are comfortable with signing posts.
Mark Sapiro msapiro@value.net The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (MingW32)
iD8DBQFHBs9sVVuXXpU7hpMRAqW3AJ0WsYWFOKu1pQM+CQv4MZBk9QSVuwCeJp0X +yOt0sOeUf70xRSbnq9cB6Y= =SHnn -----END PGP SIGNATURE-----
participants (7)
-
Barry Warsaw -
Barry Warsaw -
Carson Gaspar -
Ian Eiloart -
Mark Sapiro -
Paul Wise -
Thomas Hochstein