[Mailman-Users] Now that Python 2 is dead in 2020 what are people's plans with mailman2?

[Stephen J. Turnbull]

Carl Zwanzig writes:

 > On 4/10/2019 11:36 AM, Dimitri Maziuk via Mailman-Users wrote:

 > > (That said, given the history of python, my question would be if there
 > > are any plans to port MM2 to golang or maybe gnat.)

Not within the Mailman project.

It seems pointless to me.  If you want something that's never going to
change, Python 2.7 is as good as anything else.  Python 2 will still
be alive in 2030, I'll bet.  The security issues ... if Mailman 2
running on Python 2 in a VM is a security problem for you, Mailman is
the least of your security problems.  #opsec #apt  And I'm sure
somebody (though not the Python project itself) will still be doing
patches and backports, which for most of the security issues I've seen
(I'm NOT an expert yet) seem to be more straightforward backports than
dealing with text (ie, you don't have to worry about charsets and
anything unexpected may be considered hostile and quarantine is the
right thing to do).

 > Or rust, or python3 (which might be the easiest). I'm not
 > sufficiently up on the python differences, but..... it can't be
 > -that- difficult.....

Yes, it can.  For about 10 years, the most popular kind of bug in
Mailman 2 was a UnicodeError that bubbled up to the top, resulting in
a message shunt at best.  Porting from Python 2 to Python 3 will
almost certainly open that window again.  I suspect the same is true
of porting to any language with the internal string encoding being
Unicode, but I don't have experience with rust or golang.

This wasn't a problem in Mailman 3 because we simply rebuilt
everything from the ground up, and it's much easier to do things right
(ie robust and resilient handling of fuzzbombs from spammers and
Japanese highschool students who write their own MTAs).

 > The main thing is that from appearances MM3 is large
 > enterprise-grade list manager,

So is MM2.  MM3 just tried to make it much easier to "have it your
way" on admin and archiving.  This did not work out as planned.  It
turned out that many of the "volunteers" who wrote Postorius and
HyperKitty were actually working for Red Hat who needed enterprise-
grade features.  On the other hand, most SMEs and social groups trying
Mailman 3 seem fine with the industrial-strength architecture, and
have neither tried to build their own front ends, nor asked that we do
it.

 > but many of us don't need that, we need something for a few (<100?) 
 > lists with a few (<500?) members. I can run that on a small BSD
 > box;

If reducing heavy dependencies is the goal, it shouldn't be that hard
to write a MM2 clone web interface, reusing most of the screens.  So I
don't think a port of the MM2 admin interface to talk REST to MM3 core
would be hard.  And as Mark says, if your users are old enough, they
can use the mail admin interface a la majordomo. :-)  I'm pretty sure
there was some work done on porting Pipermail to MM3 (it would still
run on Python 2 though, but that port shouldn't be terribly hard).

 > Maybe there's a place for a community-driven port of MM2 onto
 > python3.

I don't think that's a good idea.  I'll be happy to kibbitz if
somebody wants to try it -- it's not a *terrible* idea.  But I think
coming up with downsized web admin and archive applications is a
better one.

Steve