Feature Request: Selective Mass Subscription
Please let me know if I should post this elsewhere too.
The Mass Subscribe feature has two settings: on and off. Although Mailman was designed for users to self-install, and presumably they can trust themselves not to abuse it, the truth is that an awful lot of Mailman list owners do not have access to the full software, just the web interface.
My use of Mailman is through my ISP, but there are other users who use software installed by a business group, university, or other entity. My ISP has chosen to turn off Mass Subscribe. Only the invite feature is left.
I completely understand why they have done this and I have to concur. They have thousands of users and hundreds of mailing lists. The potential for abuse is great. They did a mass subscribe for me when I transfered my lists from another provider, but they're not going to do one or two subscribers here, three or four there, and so on.
It's a huge pain in the neck for users not to be able to add subscribers directly. For my larger lists, I prefer subscribers to do it themselves, but I have the occasional person who just can't manage it. But I also run smaller lists, including several for a nonprofit, and it's just embararssing that I can't add the board members and others who ask me to.
My request is for an intermediate step that the provider can set. Something like subscribing one name at a time (so it's too much of a pain for a spammer to put in a thousand names) or up to 10 a day, or something that will make a large provider feel more comfortable but not completely remove the feature from the users.
Thanks, Cyndi @ sonic.net
Cyndi Norwitz wrote:
Please let me know if I should post this elsewhere too.
The Mass Subscribe feature has two settings: on and off.
No it doesn't.
My ISP has chosen to turn off Mass Subscribe. Only the invite feature is left.
This is not a setting. It is a code modification done somewhere downstream of the Mailman project.
My request is for an intermediate step that the provider can set. Something like subscribing one name at a time (so it's too much of a pain for a spammer to put in a thousand names) or up to 10 a day, or something that will make a large provider feel more comfortable but not completely remove the feature from the users.
Turning off mass subscribe and leaving only mass invite is a modification not done by us. This request might better be directed to whoever made this modification.
We fully sympathize with the difficulty and frustration of dealing with users who can't manage to successfully accept an invitation, and the problem of explaining to the VIP that the software doesn't allow this.
I can see that actual site settings something like
MAXIMUM_LIST_OWNER_SUBSCRIBES = 10 LIST_OWNER_SUBSCRIBE_WINDOW = days(7)
to allow at most 10 subscribes in any 7 day period, might be an alternative that ISPs would use, but OTOH, I think that an ISP that choses to disable mass subscribe has likely done this in response to large ISP/email services that demand that lists be fully confirmed opt-in in order to be whitelisted, so they may not be willing to allow even that.
Before I invest any effort in implementing such an option, I'd be interested in an opinion from your ISP as to whether they would use it.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Date: Tue, 24 Jun 2008 11:51:02 -0700 From: Mark Sapiro <mark@msapiro.net>
I can see that actual site settings something like
MAXIMUM_LIST_OWNER_SUBSCRIBES = 10 LIST_OWNER_SUBSCRIBE_WINDOW = days(7)
to allow at most 10 subscribes in any 7 day period, might be an alternative that ISPs would use, but OTOH, I think that an ISP that choses to disable mass subscribe has likely done this in response to large ISP/email services that demand that lists be fully confirmed opt-in in order to be whitelisted, so they may not be willing to allow even that.
Before I invest any effort in implementing such an option, I'd be interested in an opinion from your ISP as to whether they would use it.
Thank you, Mark. Something like this would be perfect. I just posted to my ISP's usenet group where they have discussions like this. I will let you know what they say.
Cyndi
Cyndi Norwitz wrote:
Please let me know if I should post this elsewhere too.
This is kind of an edge case. You're getting close to territory that would probably be better handled over on the mailman-developers list, although you're not really discussing any particular specific code changes that you've come up with.
If nothing else, I know a lot of Mailman developers are on that list exclusively, and there are only a few developers on this list.
I don't see a problem with having this discussion continue on the mailman-users list for now (at least you'll get the opportunity for some feedback from other mailman list/site admins who are not on the mailman-developers list), but if you get deeper into the development issues then you will probably want to consider moving the discussion to the other list.
I'll leave that decision to you, as to whether or not you want to focus on involving more Mailman developers in the discussion, or if you want to focus on involving more list/site admins.
-- Brad Knowles <brad@python.org> Member of the Python.org Postmaster Team & Co-Moderator of the mailman-users and mailman-developers mailing lists
(figures, apparently my mail program is one of those *broken* ones so apologies, this originally sent off list)
Hello Cyndi,
I do see where you are coming from, but abuse issues can go the opposite direction from your description, and usually does.
The host I work for does NOT turn off mass subscription capability (but also only provides the web interface). With that said, our abuse policy states that all users must be double-opt in. Whether this is done via Mailman or they're own script and database is up to the user, but they had better be able to provide proof that the subscriber was double-opt in.
The reason for this is simple. Most hosts providing Mailman (or similar package) do so on shared servers (our servers have up to 2000 lists per server). If *for any reason what-so-ever* a user's list causes an ISP to take notice, the ISP will most likely take notice by blocking that shared server affecting all 1999 other lists on that server. Most ISP's will then specifically request proof that the message was requested and not unsolicited, and the best (and yes, legal way) to prove that is if you have proof that the user was opted into the list TWICE.
In our eyes, the problem has nothing to do with some spammer mass subscribing users (we have NEVER had this problem, actually... unless the admin gets they're password compromised). It has everything to do with covering our customers butts. :-)
Just offering the other side of the issue.
Krystal
Cyndi Norwitz wrote:
Please let me know if I should post this elsewhere too.
The Mass Subscribe feature has two settings: on and off. Although Mailman was designed for users to self-install, and presumably they can trust themselves not to abuse it, the truth is that an awful lot of Mailman list owners do not have access to the full software, just the web interface.
My use of Mailman is through my ISP, but there are other users who use software installed by a business group, university, or other entity. My ISP has chosen to turn off Mass Subscribe. Only the invite feature is left.
I completely understand why they have done this and I have to concur. They have thousands of users and hundreds of mailing lists. The potential for abuse is great. They did a mass subscribe for me when I transfered my lists from another provider, but they're not going to do one or two subscribers here, three or four there, and so on.
It's a huge pain in the neck for users not to be able to add subscribers directly. For my larger lists, I prefer subscribers to do it themselves, but I have the occasional person who just can't manage it. But I also run smaller lists, including several for a nonprofit, and it's just embararssing that I can't add the board members and others who ask me to.
My request is for an intermediate step that the provider can set. Something like subscribing one name at a time (so it's too much of a pain for a spammer to put in a thousand names) or up to 10 a day, or something that will make a large provider feel more comfortable but not completely remove the feature from the users.
Thanks, Cyndi @ sonic.net
Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/zipfel%40greenacrestech...
Security Policy: http://www.python.org/cgi-bin/faqw-mm.py?req=show&file=faq01.027.htp
Brad Knowles writes:
I don't see a problem with having this discussion continue on the mailman-users list for now (at least you'll get the opportunity for some feedback from other mailman list/site admins who are not on the mailman-developers list),
I think the very "political" nature of this proposal means it should be on Mailman-Users. Mailman developers tend to have shell (if not root) on their hosts. Mailman-Users is a better place to get people to discuss this with their ISPs. Note that people whose ISPs permit mass-subscribe might want to get their opinions about this, too. Such an option might make a lot of ISPs happier with Mailman, even if those like Cyndi's decide to continue draconian policies. But we need to find out what they want/find acceptable!
Hi Krystal,
I'd be interested to know what you call "double opt-in". Is it a web subscription + email reply with the cookie, or double-that (and in that case, what is the scenario).
FWIW I don't think the option Cindy proposes passes Occam's razor. For the moment it looks like lots of complexity for a need that is not well defined and certainly not generic. If the ISP has deliberately crippled Mailman's interface up to the point it's not usable any more, they should probably try and come up with a solution; or at least try to explain (to the devs or the users) why and how.
-- Fil
Fil wrote:
I'd be interested to know what you call "double opt-in". Is it a web subscription + email reply with the cookie, or double-that (and in that case, what is the scenario).
My understanding of this is that "double opt-in" and what I call "confirmed opt-in" are the same thing and that they mean
User requests to be on the list via a web form, email, etc. This is the first opt-in. Note that strictly speaking, this probably precludes unsolicited invitations, although an invitation in response to any show of interest such as even checking a box on a paper form would be OK.
An email with confirmation instructions is sent to the users address to be subscribed to verify that the person who receives mail at that address really wants to be on the list.
Only after the user follows the confirmation process of step 2 does the user get added to the list. That's the second opt-in.
The key idea in this process is that the user's email address is only added to the list after an affirmative response to an email sent to that address.
I expect Krystal will correct me if I'm mistaken.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Hello,
Let me first say I was in no way competing with Cyndi's suggestion, I should probably have prefaced by saying I think the option provided is a good one. And again, we have no modifications to Mailman that is not built in to modify (we have turned off personalization for example, but no code modifications).
Double Opt-In is simply that the user stated twice that they want to subscribe to the list. In Mailman's option, Double Opt-In would be 'Confirm'. Basically, it forces the subscriber to say "yes I want on this list", and then say "yes, I really really really do want to be on this list".
This way, if someone like say, Spam Arrest contacts us and says "we have X spam complaint", we can contact the user and say "what's up", and they say "here's when the user subscribed, here's when they said yea I really want that", and now Spam Arrest leaves us alone and the list is not blacklisted.
It's one of those double edged swords. In our case, it's not that we don't trust our users (but have a TOS in place of course just in case), it's that we don't trust other ISP's and Spam blackholes. For this reason, the burden of proof is placed on the account holder.
If a user mass-subscribes say, 10,000 members from a list of addresses they bought somewhere else, that user has absolutely no way to provide proof that the subscriber ever opted in to that list SPECIFICALLY.
However, on the flip side, if a user is moving from another host, or has multiple lists, or they're own signup pages/database, etc... they still have they're own proof but are using the mass subscription option to use. Hence why I personally do not think removing it entirely is a grand idea, and why offering a way for hosts to control the subscription process to a point could be very helpful.
Krystal
Fil wrote:
Hi Krystal,
I'd be interested to know what you call "double opt-in". Is it a web subscription + email reply with the cookie, or double-that (and in that case, what is the scenario).
FWIW I don't think the option Cindy proposes passes Occam's razor. For the moment it looks like lots of complexity for a need that is not well defined and certainly not generic. If the ISP has deliberately crippled Mailman's interface up to the point it's not usable any more, they should probably try and come up with a solution; or at least try to explain (to the devs or the users) why and how.
-- Fil
That is EXACTLY right.
Mark Sapiro wrote:
My understanding of this is that "double opt-in" and what I call "confirmed opt-in" are the same thing and that they mean
User requests to be on the list via a web form, email, etc. This is the first opt-in. Note that strictly speaking, this probably precludes unsolicited invitations, although an invitation in response to any show of interest such as even checking a box on a paper form would be OK.
An email with confirmation instructions is sent to the users address to be subscribed to verify that the person who receives mail at that address really wants to be on the list.
Only after the user follows the confirmation process of step 2 does the user get added to the list. That's the second opt-in.
The key idea in this process is that the user's email address is only added to the list after an affirmative response to an email sent to that address.
I expect Krystal will correct me if I'm mistaken.
Hi all, I am finally doing a followup on this. Mark asked me to vet his proposed solution to my ISP and see what they said. They actually took it quite seriously and discussed it. I just got a phone call from the head guy in that department who wanted to speak to me directly about it. (Mark, I'm sending you some private email with his contact info.)
Basically, they are very concerned about spammers using their system. Their first response to my request was to wonder why I thought a spammer wouldn't be patient enough to add addresses to their lists slowly.
After talking more with me, what he said was that he would be interested in the feature and would use it *IF* it could be turned on per list or per user, as opposed to a global on or off. He said he'd want to "have a conversation" with each listowner to make sure they really understood how to keep documentation proving how someone signed up for the list (email trail, paper from a signup sheet at an event, etc). He said he'd gladly turn on the feature for my lists after hearing that I knew how to do this.
I pointed out to him that if it was per list, then I'd be bothering them every time I set up a new list (I have a lot of little ones). He agrees that per user would be much better, if it were possible. I said I'd heard hints (am I right?) that MM might be moving in that direction, allowing listowners to administer (or at least see) all their lists together. It would make life a lot easier if the ISP could simply say, "okay, any list that Cyndi runs can have this new feature."
So that's the feedback. Thanks for all your time with this.
Cyndi
Date: Tue, 24 Jun 2008 11:51:02 -0700 From: Mark Sapiro <mark@msapiro.net>
Cyndi Norwitz wrote:
Please let me know if I should post this elsewhere too.
The Mass Subscribe feature has two settings: on and off.
No it doesn't.
My ISP has chosen to turn off Mass Subscribe. Only the invite feature is left.
This is not a setting. It is a code modification done somewhere downstream of the Mailman project.
My request is for an intermediate step that the provider can set. Something like subscribing one name at a time (so it's too much of a pain for a spammer to put in a thousand names) or up to 10 a day, or something that will make a large provider feel more comfortable but not completely remove the feature from the users.
Turning off mass subscribe and leaving only mass invite is a modification not done by us. This request might better be directed to whoever made this modification.
We fully sympathize with the difficulty and frustration of dealing with users who can't manage to successfully accept an invitation, and the problem of explaining to the VIP that the software doesn't allow this.
I can see that actual site settings something like
MAXIMUM_LIST_OWNER_SUBSCRIBES = 10 LIST_OWNER_SUBSCRIBE_WINDOW = days(7)
to allow at most 10 subscribes in any 7 day period, might be an alternative that ISPs would use, but OTOH, I think that an ISP that choses to disable mass subscribe has likely done this in response to large ISP/email services that demand that lists be fully confirmed opt-in in order to be whitelisted, so they may not be willing to allow even that.
Before I invest any effort in implementing such an option, I'd be interested in an opinion from your ISP as to whether they would use it.
participants (6)
-
Brad Knowles -
Cyndi Norwitz -
Fil -
Krystal Zipfel -
Mark Sapiro -
Stephen J. Turnbull