Mailman 3 September 2006 - Mailman-Users

Re: [Mailman-Users] Hijacking threads and netiquette (was: e: Obscure addresses problem)
by David Dyer-Bennet 05 Sep '06

05 Sep '06

On 9/5/06, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > At 11:55 AM -0500 2006-09-05, David Dyer-Bennet wrote: > > > Okay. And I've now checked through > > the Wizard-driven FAQ and also find nothing relevant. > > Did you search for "reauthentication"? Or "saving my changes"? No; I searched for "password" and "firefox", I believe. Obviously there were a number of entries mentioning passwords, but none about saving them. > What did you search for? Maybe we need to update the subject lines > or the content of the FAQ Wizard. I'd suggest making sure "password" is in the index for that FAQ, yes. If there *is* such a FAQ; you haven't yet exhibited one that has anything to do with the issue I'm raising. I don't see where "saving my changes" would come in; definitely not something I'd search for when the issue is that browsers aren't recognizing a password field. > > Why doesn't Firefox (or other browsers, I think I've seen the same > > behavior in Opera) offer me the chance to remember the Administrative > > password for my site? > > I'm not yet convinced that there is anything here that is not > answered in the FAQs. I'm not convinced there's anything about this in the FAQ. 4.65 is not about the issue I'm raising; that's about cookie issues, whereas my case is that the password field isn't recognized in the first place. -- David Dyer-Bennet, <mailto:dd-b@dd-b.net>, <http://www.dd-b.net/dd-b/> RKBA: <http://www.dd-b.net/carry/> Pics: <http://www.dd-b.net/dd-b/SnapshotAlbum/> Dragaera/Steven Brust: <http://dragaera.info/>

4 9

Re: [Mailman-Users] Hijacking threads and netiquette (was: e: Obscure addresses problem)
by David Dyer-Bennet 05 Sep '06

05 Sep '06

On 9/5/06, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > At 1:14 PM -0500 2006-09-05, David Dyer-Bennet wrote: > > >> Did you search for "reauthentication"? Or "saving my changes"? > > > > No; I searched for "password" and "firefox", I believe. Obviously > > there were a number of entries mentioning passwords, but none about > > saving them. > > Correct, there are a number of entries that mention "password", which > is why this isn't the best search term. Nevertheless, I have gone > ahead and modified the subject lines of the two most relevant FAQ > entries to also include the term "password". While I agree it's not a wonderful search term by virtue of being relevant to a lot of different FAQs, it's the one people will be looking for in this case; the problem is that their browser doesn't offer to remember their password. > > If there *is* such a FAQ; you haven't yet exhibited one that has > > anything to do with the issue I'm raising. > > You apparently did not take the hint that I gave you previously. You > really should search for the term "reauthentication", which will come > back with one and only one FAQ entry, which I believe is relevant to > your query. You should also search for the phrase "saving my > changes", which will come back with one and only one FAQ entry (which > is different from the other one), which might also be relevant. Could you *please* drop your condescending tone about 10 decibels? I *did* search for "reauthentication", it's how I got to FAQ 4.65, which I mention below. ***THAT IS NOT RELEVANT TO MY PROBLEM.*** I have said this before, several times. I'm getting tired of not being listened to. Also FAW 4.45 is not relevant to my problem. They're about a different set of symptoms entirely. My problem, as I have said from the beginning, is that browsers (specifically Firefox, though I note the same problem reported against Safari in feature request 966157) do not recognize the password field on the mailing list administrator login page as a password field, and hence do not offer to save it for me, and hence make it much, much harder to deal with mailing list administration than it needs to be. > > I don't see where "saving my changes" would come in; definitely not > > something I'd search for when the issue is that browsers aren't > > recognizing a password field. > > Try reading the two FAQ entries in question. If you can come up with > some suggested improvements to the wording, please go ahead and do > so. After all, this is a community supported document, and all the > information you need for making changes to any of the FAQ entries is > already present on the page. I HAVE read the FAQ entries in question. I don't want to change those two, becaues they're not relevant to this issue (and presumably *are* relevant to the issues they are addressing, so I shouldn't hijack them). > >> > Why doesn't Firefox (or other browsers, I think I've seen the same > >> > behavior in Opera) offer me the chance to remember the Administrative > >> > password for my site? > >> > >> I'm not yet convinced that there is anything here that is not > >> answered in the FAQs. > > > > I'm not convinced there's anything about this in the FAQ. > > That's possible. If this really is a browser-specific issue with > Firefox, then it would be the very first time I've ever heard of this > kind of thing, and I frequently use Firefox myself. It's probably not specific to Firefox. I reported it against Firefox because that's where I've actually seen it happen. I seem to remember seeing it in Opera as well. And as I mentioned above, another user has reported it in Safari. > > 4.65 is not about the issue I'm raising; that's about cookie issues, > > whereas my case is that the password field isn't recognized in the > > first place. > > Maybe I'm wrong, but you should at least look at the other FAQ entry as well. > > If I am wrong, then this is the very first time I've ever heard of > such problems with Firefox, and will require a new FAQ entry. > > While this wouldn't be the first application-specific FAQ entry, it > would be the first one that is specific to Firefox, and I believe it > would also be the first one that is specific to a particular web > browser -- all other application-specific FAQ entries I know of have > to do with other types of programs, and web browsers appear to have > acted more or less the same with regards to these kinds of things. I wrote what would have been 3.67, only to then be told that it wasn't actually open to anybody to post after all; so to keep that work from going to waste I post it here, and propose it be included (or improved and then included): Summary: Some browsers do not recognize the password on the list administrator authentication page Firefox and Safari, and quite possibly other browsers, do not recognize the password entry field on the administrator list authentication web page as a password field, and hence do not offer to remember it for you. The password field is named "adminpw" in the form rather than "password", and the browsers may also be set up to look for a pair of "username" and "password" rather than a bare password field. No workaround is known for this problem. At least one of Mailman and the browsers will have to change for this behavior to change. You should of course be very careful how and where you store your passwords; if you store them on a computer connected to the net (in the browser or otherwise) you should *at least* make sure they're well encrypted (using, in Firefox, the "master password" feature). Feature request 966157 (from 2004) was filed to get this fixed, but as of 2006-09-05 nothing appears to have been done about it yet. --------------- I'm sure it could be refined and improved, but there's a starting point. > "Those who would give up essential Liberty, to purchase a little > temporary Safety, deserve neither Liberty nor Safety." > > -- Benjamin Franklin (1706-1790), reply of the Pennsylvania > Assembly to the Governor, November 11, 1755 I'm reading Franklin's autobiography right now (thanks Gutenberg!), and right about that date, though he doesn't choose to repeat that phrase in the autobio. It's one of my favorites, though. -- David Dyer-Bennet, <mailto:dd-b@dd-b.net>, <http://www.dd-b.net/dd-b/> RKBA: <http://www.dd-b.net/carry/> Pics: <http://www.dd-b.net/dd-b/SnapshotAlbum/> Dragaera/Steven Brust: <http://dragaera.info/>

4 7

Re: [Mailman-Users] Hijacking threads and netiquette (was: e: Obscure addresses problem)
by Dragon 05 Sep '06

05 Sep '06

David Dyer-Bennet sent the message below at 12:58 9/5/2006: >I find I have mis-described the problem; Firefox *does* recognize the >password and save it, I can see it in the list of saved passwords. >What it doesn't do is *offer it back* when I return to the page. Same >net result, I have to look it up and put it in each time, but >different path to get there. ---------------- End original message. --------------------- Mailman is not broken just because it does not work the way you want it to with the browser you have chosen to use. If you can show how the implementation mailman uses is fundamentally wrong with a reference to an applicable RFC, I think then it would be appropriate for the mailman developers to address the issue. Until then, this is a problem with your browser and the browser developer is the appropriate organization to deal with the problem. Even if you did come up with such a reference and mailman is fundamentally broken, there are other issues that are likely to take priority over what is really just a minor annoyance. This list, being a support list for mailman, is thus not the appropriate place to address this issue. Filing a bug report or feature request with the developers of Firefox (or any other similarly affected browser) is the right course of action. Dragon ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Venimus, Saltavimus, Bibimus (et naribus canium capti sumus) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Firefox password issue (was Re: Hijacking threads and netiquette)
by Dragon 05 Sep '06

05 Sep '06

David Dyer-Bennet sent the message below at 09:55 9/5/2006: >Why doesn't Firefox (or other browsers, I think I've seen the same >behavior in Opera) offer me the chance to remember the Administrative >password for my site? ---------------- End original message. --------------------- It is very simple. It is because these browsers that do this sort of thing are looking for an HTML input field named "password" (and maybe a few other similar names). If they do not find one with the name they expect, they do not save the password. The field on the login page is named "adminpw" and is thus not recognized. What these browsers SHOULD be looking for is the TYPE of the input and not the name. But then again, I think this feature of some browsers is a security breach waiting to happen. If you look at the source for the login page you will see something like this: <INPUT TYPE="password" NAME="adminpw" SIZE="30"> You could modify your copy of mailman to change the name of that field if you wanted, I am not sure exactly how much of a change it would be and exactly which files are involved but I can't imagine it would take more than a handful of lines. However, I personally see nothing wrong with the way it is done now, in fact, I think it is a good practice. The reason I say this is that I believe saving passwords on your computer is generally a bad idea as it is a risky practice. All computers connected to the Internet and not physically secured from unauthorized access are vulnerable to attack. Dragon ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Venimus, Saltavimus, Bibimus (et naribus canium capti sumus) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: [Mailman-Users] Hijacking threads and netiquette (was: e: Obscure addresses problem)
by David Dyer-Bennet 05 Sep '06

05 Sep '06

On 9/5/06, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > At 11:17 AM -0500 2006-09-05, David Dyer-Bennet wrote: > > >> First off, please don't hijack existing threads and leave the subject > >> line the same. If you have a new topic, please create a new message > >> with a new subject. > > > > Sorry about this ending up attached to the thread. I don't see how it > > did, and it wasn't my intention. > > When you "reply" to a previous message, this is what happens. > > If you have a new topic, please don't "reply" to a previous message > and then continue on discussing whatever unrelated questions you may > have. I suppose that could be what happened. Look, I've been participating on Arpanet and Internet email lists since 1981, but every now and then the fingers don't quite do it right, and we're all just going to have to live with that; the perfect error-free human being has not yet been invented. > >> Secondly, your wording of this question suggests that you have not > >> yet searched the FAQ or the archives before posting -- see FAQ 1.22. > > > > I can find nothing in the FAQ relating to this. However, the copy of > > the FAQ I have found doesn't have numbers (list.org, documentation, > > FAQ), so I'm not sure I've looked at the exact item you think > > addresses it. Where is this FAQ 1.22? > > The Mailman "docs" page at <http://www.list.org/docs.html> actually > links to two different FAQs. One is the old developer-maintained > page at <http://www.list.org/faq.html>, and one links to the newer > community-driven Mailman FAQ Wizard at > <http://www.python.org/cgi-bin/faqw-mm.py>. Ah, they have different content. Okay. And I've now checked through the Wizard-driven FAQ and also find nothing relevant. > In addition, if you look at the footer of every single post to this > list, you will see the following information: Oops, my fault again; gmail was hiding it. I'm not used to these stupid MUAs that muck about so much with the messages. So, now I've checked both FAQs (I had already checked the official FAQ before my first post, which I thought was fairly obvious from what I wrote) and there's nothing relevant to this that I can find. I hope you've had a good time picking on the minor mistake I made (where my message ended up attached to an existing thread), but could you perhaps take a second or two to consider *my actual question*? Why doesn't Firefox (or other browsers, I think I've seen the same behavior in Opera) offer me the chance to remember the Administrative password for my site? -- David Dyer-Bennet, <mailto:dd-b@dd-b.net>, <http://www.dd-b.net/dd-b/> RKBA: <http://www.dd-b.net/carry/> Pics: <http://www.dd-b.net/dd-b/SnapshotAlbum/> Dragaera/Steven Brust: <http://dragaera.info/>

2 1

Re: [Mailman-Users] Hijacking threads and netiquette (was: e: Obscure addresses problem)
by David Dyer-Bennet 05 Sep '06

05 Sep '06

On 9/5/06, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > At 10:30 AM -0500 2006-09-05, David Dyer-Bennet wrote: > > > At least on Mailman 2.1.6, something about how the page where you > > enter the administrative password is designed prevents Firefox from > > remembering that password for me. It's extremely annoying, I have to > > go look that one up in Passwordsafe each time I use it, which is > > nearly daily. Anybody have any ideas? > > First off, please don't hijack existing threads and leave the subject > line the same. If you have a new topic, please create a new message > with a new subject. Sorry about this ending up attached to the thread. I don't see how it did, and it wasn't my intention. > Secondly, your wording of this question suggests that you have not > yet searched the FAQ or the archives before posting -- see FAQ 1.22. I can find nothing in the FAQ relating to this. However, the copy of the FAQ I have found doesn't have numbers (list.org, documentation, FAQ), so I'm not sure I've looked at the exact item you think addresses it. Where is this FAQ 1.22? -- David Dyer-Bennet, <mailto:dd-b@dd-b.net>, <http://www.dd-b.net/dd-b/> RKBA: <http://www.dd-b.net/carry/> Pics: <http://www.dd-b.net/dd-b/SnapshotAlbum/> Dragaera/Steven Brust: <http://dragaera.info/>

2 1

Re: [Mailman-Users] Hijacking threads and netiquette (was: e: Obscure addresses problem)
by Dragon 05 Sep '06

05 Sep '06

David Dyer-Bennet sent the message below at 09:17 9/5/2006: >On 9/5/06, Brad Knowles <brad(a)stop.mail-abuse.org> wrote: > > At 10:30 AM -0500 2006-09-05, David Dyer-Bennet wrote: > > > > > At least on Mailman 2.1.6, something about how the page where you > > > enter the administrative password is designed prevents Firefox from > > > remembering that password for me. It's extremely annoying, I have to > > > go look that one up in Passwordsafe each time I use it, which is > > > nearly daily. Anybody have any ideas? > > > > First off, please don't hijack existing threads and leave the subject > > line the same. If you have a new topic, please create a new message > > with a new subject. > >Sorry about this ending up attached to the thread. I don't see how it >did, and it wasn't my intention. It is very likely that you simply hit Reply in your MUA which included the In-Reply-To: and/or References: header(s) in the e-mail. These are the headers that allow MUAs to do threading and are also used by Pipermail (Mailman's default archiver) to thread the messages in the archives. By just hitting Reply, you have attached the message to a particular thread which has no relevance to your question. By not changing the subject line, you have also not indicated anything about the actual subject of your inquiry. > > Secondly, your wording of this question suggests that you have not > > yet searched the FAQ or the archives before posting -- see FAQ 1.22. > >I can find nothing in the FAQ relating to this. However, the copy of >the FAQ I have found doesn't have numbers (list.org, documentation, >FAQ), so I'm not sure I've looked at the exact item you think >addresses it. Where is this FAQ 1.22? It is linked in the footer at the bottom of every single e-mail posted to this list. There is also a link there to a searchable version of the list archives. Look at the end of this post and you will find those links. There may even be an answer to your question in the FAQ or archives. Dragon ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Venimus, Saltavimus, Bibimus (et naribus canium capti sumus) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Obscure addresses problem
by Jack Stone 05 Sep '06

05 Sep '06

In the admin, I set the the "obscure address" to NO, but addresses are still shown as: "amember at somewhere.com" Setting from YES to NO had no effect. Radio button NO is still set. I run a separate searchable archive where the whole address is munged with "xxxx"s, but now without the "@" regular format, the address is more exposed than before. Anyone else have this issue -- or solution? Thanks! (^-^) Best regards, Jack L. Stone

5 19

Restricting list owner's admin rights
by Robert Bannocks 05 Sep '06

05 Sep '06

Is it possible to restrict the options that list owners can set. In particular I want to stop list administrator For all lists from setting up USENET news gateway-ing and stop some but not all list administrators from archiving messages. Regards

2 1

"bug" found when clicking sender filter privacy option
by Spyro Polymiadis 04 Sep '06

04 Sep '06

Hi All, apologies in advanced for the length of this post.... I have hit a "bug" when clicking on the sender filter privacy option... Would anyone be able to decipher the traceback and suggest what might be the problem and/or where I may be able to resolve it.. (mailman v 2.1.5) Thanks :) Spyro --Trace back from /var/log/mailman/error-- Sep 05 13:35:21 2006 admin(13171): @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ admin(13171): [----- Mailman Version: 2.1.5 -----] admin(13171): [----- Traceback ------] admin(13171): Traceback (most recent call last): admin(13171): File "/var/lib/mailman/scripts/driver", line 110, in run_main admin(13171): main() admin(13171): File "/usr/lib/mailman/Mailman/Cgi/admin.py", line 198, in main admin(13171): show_results(mlist, doc, category, subcat, cgidata) admin(13171): File "/usr/lib/mailman/Mailman/Cgi/admin.py", line 522, in show_results admin(13171): form.AddItem(show_variables(mlist, category, subcat, cgidata, doc)) admin(13171): File "/usr/lib/mailman/Mailman/Cgi/admin.py", line 571, in show_variables admin(13171): add_options_table_item(mlist, category, subcat, table, item) admin(13171): File "/usr/lib/mailman/Mailman/Cgi/admin.py", line 586, in add_options_table_item admin(13171): val = get_item_gui_value(mlist, category, kind, varname, params, extra) admin(13171): File "/usr/lib/mailman/Mailman/Cgi/admin.py", line 625, in get_item_gui_value admin(13171): value = getattr(mlist, varname) admin(13171): File "/usr/lib/mailman/Mailman/MailList.py", line 144, in __getattr__ admin(13171): raise AttributeError, name admin(13171): AttributeError: nonmember_rejection_notice admin(13171): [----- Python Information -----] admin(13171): sys.version = 2.3.5 (#2, Sep 4 2005, 22:01:42) [GCC 3.3.5 (Debian 1:3.3.5-13)] admin(13171): sys.executable = /usr/bin/python admin(13171): sys.prefix = /usr admin(13171): sys.exec_prefix = /usr admin(13171): sys.path = /usr admin(13171): sys.platform = linux2 admin(13171): [----- Environment Variables -----] admin(13171): HTTP_COOKIE: spyro+admin=28020000006948f0fc44732800000065656362343935333231383231653464316531653035386437623761653663356161366565373434 admin(13171): SERVER_SOFTWARE: Apache/2.0.54 (Debian GNU/Linux) mod_python/3.1.3 Python/2.3.5 PHP/4.3.10-16 mod_perl/1.999.21 Perl/v5.8.4 admin(13171): SCRIPT_NAME: /cgi-bin/mailman/admin admin(13171): SERVER_SIGNATURE: <address>Apache/2.0.54 (Debian GNU/Linux) mod_python/3.1.3 Python/2.3.5 PHP/4.3.10-16 mod_perl/1.999.21 Perl/v5.8.4 Server at mail.domain.com Port 80</address> admin(13171): admin(13171): REQUEST_METHOD: GET admin(13171): HTTP_KEEP_ALIVE: 300 admin(13171): SERVER_PROTOCOL: HTTP/1.1 admin(13171): QUERY_STRING: admin(13171): HTTP_ACCEPT_CHARSET: ISO-8859-1,utf-8;q=0.7,*;q=0.7 admin(13171): HTTP_USER_AGENT: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.6) Gecko/20060728 Firefox/1.5.0.6 admin(13171): HTTP_CONNECTION: keep-alive admin(13171): HTTP_REFERER: http://mail.domain.com/cgi-bin/mailman/admin/listname/privacy admin(13171): SERVER_NAME: mail.domain.com admin(13171): REMOTE_ADDR: 192.168.99.120 admin(13171): PATH_TRANSLATED: /var/www/listname/privacy/sender admin(13171): SERVER_PORT: 80 admin(13171): SERVER_ADDR: 192.168.99.201 admin(13171): DOCUMENT_ROOT: /var/www/ admin(13171): PYTHONPATH: /var/lib/mailman admin(13171): SCRIPT_FILENAME: /usr/lib/cgi-bin/mailman/admin admin(13171): SERVER_ADMIN: webmaster@localhost admin(13171): HTTP_HOST: mail.domain.com admin(13171): REQUEST_URI: /cgi-bin/mailman/admin/listname/privacy/sender admin(13171): HTTP_ACCEPT: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 admin(13171): GATEWAY_INTERFACE: CGI/1.1 admin(13171): REMOTE_PORT: 3564 admin(13171): HTTP_ACCEPT_LANGUAGE: en-us,en;q=0.5 admin(13171): HTTP_ACCEPT_ENCODING: gzip,deflate admin(13171): PATH_INFO: /listname/privacy/sender This message and its attachments may contain legally privileged or confidential information. This message is intended for the use of the individual or entity to which it is addressed. If you are not the addressee indicated in this message, or the employee or agent responsible for delivering the message to the intended recipient, you may not copy or deliver this message or its attachments to anyone. Rather, you should permanently delete this message and its attachments and kindly notify the sender by reply e-mail. Any content of this message and its attachments, which does not relate to the official business of the sending company must be taken not to have been sent or endorsed by the sending company or any of its related entities. No warranty is made that the e-mail or attachment(s) are free from computer virus or other defect.

1 0

Mailman-Users September 2006