Mailman 3 August 2012 - Mailman-Developers

before next release: disable backscatter in default installation
by Jo Rhett Nov. 7, 2022

Nov. 7, 2022

Hi. There's a fairly simple problem here that needs to be addressed. And it's mostly a documentation/install problem. I'm hoping we can get this resolved before the next release. PROBLEM: Mailman comes out of the box ready to backscatter spam people. Yes, it's easy enough to fix. But because it comes stock this way, and is documented to install this way, most people install it to do this. Those of us who work in abuse departments are tired of hearing "well that's how Mailman works". We also object to having to teach people how to fix their mailman installations because it's not documented in the current manual. This is *exactly* like Sendmail 14 years ago. We didn't accept it then, and Sendmail fixed the problem. RESOLUTION: Mailman default installation should not backscatter in a default configuration. 1. Don't create backscatter aliases for subscribe/unsubscribe/etc by default. Nearly everyone uses web based signup. 2. Discard or hold messages from non-subscribers by default. I would think that it would be perfectly reasonable to have documentation on how to enable the 1980s-style -request / -subscribe etc aliases. However this documentation should have a note that this is against the AUP of nearly every network provider, and enabling it will likely cause them to get listed in various blacklists as a backscatter source. FYI: I know that this goes against the instincts of many old-time mailing list advocates here. But after dealing with a 10k/hour backscatter DoS my tolerance for this problem is understandably limited. Yes, it was a sweet day back in the 1980s. I was running a mailing list server and several UUCP gateways at the time, so I remember them well. But those days are past, and we need to deal with the reality of today. -- Jo Rhett Net Consonance : consonant endings by net philanthropy, open source and other randomness

21 168

Re: [Mailman-Developers] [Mailman-i18n] translation of mail templates
by Federico Leva (Nemo) Aug. 27, 2012

Aug. 27, 2012

Christopher Meng, 27/08/2012 12:03: > Hi. > > What about transifex? I've never used it, but a developer and translator for an OpenStreetMap piece of software recently said: «We ended up with Transifex, which might look cooler but certainly is an inferior tool for the translator I can say now after having used for some hours». <https://translatewiki.net/wiki/Thread:Support/Request_for_comment_on_feasab…> Nemo

1 0

translation of mail templates
by Peter Holzer Aug. 27, 2012

Aug. 27, 2012

Hi I started to translate the templates into german, resulting in some nasty unicode errors. Is there a howto on how the translation for other languages has to be done? Peter

7 14

Re: [Mailman-Developers] status of mailman 3.0 web stuff
by Terri Oda Aug. 23, 2012

Aug. 23, 2012

Yeay! In addition to what Barry said (join Postorious!) I just want to say I'm really excited to see you back. :) More specifically, though, I think a good first step with Postorious for you would be to take a look at the current roadmap for alpha2: https://launchpad.net/postorius/+milestone/1.0.0a2 As you can tell, it's pretty short, but I'm guessing we're missing things, and it'd be really helpful to have fresh eyes look at it. The instructions for setting up the interface so you can see what's already there are here: http://wiki.list.org/display/DEV/A+5+minute+guide+to+get+the+Mailman+web+UI… (And I tested the instructions a week or two ago, so if you have any trouble with them let me know.) Terri On 12-08-21 3:08 AM, Ethan Fremen wrote: > Hi! > > I (failed) to help provide a new UI in the 2006 summer of code sprint. It > seems like now a framework is acceptable :) which makes me happy. > > I now have a job where I will be coding python again, and I was wondering > if I could help push this forward? the > http://wiki.list.org/display/DEV/Web+Interface+Status page says that a > basic UI is being set up. > > Is there a way I can jump in and help? > > Thanks, > > ~ethan fremen > _______________________________________________ > Mailman-Developers mailing list > Mailman-Developers(a)python.org > http://mail.python.org/mailman/listinfo/mailman-developers > Mailman FAQ: http://wiki.list.org/x/AgA3 > Searchable Archives: http://www.mail-archive.com/mailman-developers%40python.org/ > Unsubscribe: http://mail.python.org/mailman/options/mailman-developers/terri%40zone12.com > > Security Policy: http://wiki.list.org/x/QIA9 >

3 2

NNTP Archive - final report
by Alexander Sulfrian Aug. 22, 2012

Aug. 22, 2012

Hi, reaching the end of google summer of code, here is my final report. I have pushed all code to my bzr repository and have a running demo of the NNTP archive under mailman3.animux.de port 119 and 563. (The postorius web interface under mailman3.animux.de is not working completly correctly since I merged the mailman trunk back into my code) Features that are working: * NNTP Daemon could be started via the runner interface. It could be listen on two ports. The first one is a plain tcp connection supporting STARTTLS and the second allows nntps connections. (Please notice, that thunderbird currently does only support nntps connections and does not ask if it should accept the certificate. To test the nntps connections you first have to add the CACert root certificate to the list of trusted certificate authorities.) * The nntp daemon supports all mandatory commands and most of the commands of the READER capability. Additional to that it supports the AUTHINFO extension. The nntp daemon authenticates the user against the user information stored by mailman core. Because it has only access to the crypt passwords, it could only support authentiaction mechanism that uses plain text passwords. Therefor it supports and requires the STARTTLS extension (or the plain SSL connection) for authentication. * The nntp daemon provides access to all public list archives without authentication. If a user is logged in, the user has also access to its subscribed mailing lists, that has private archives. Currently the nntp archive uses a slightly patched version of kittystore (to allow access to mails based on its id in the mailing list). There is also a module that fills the kittystore if sending a mail via the lists. I currently imported some messages from an mbox into bla(a)mailman3.animux.de and feed some real messages into test(a)mailman3.animux.de. Although gsoc is over now, I would like to continue to work for mailman3. Next steps for the NNTP archive and archives in general could be: * Currently the nntp archive uses a slightly patches version of kittystore (allowing to access mails based on their database id). The IArchiver implementation uses the SqlAlchemy interface to feed data into the store. It would be much nicer not require a second ORM mapper. On solution could be to convert the SqlAlchemy interface to Storm models. But I think, before that the whole message store infrastructure should be reconsidered. Currently it works but their might be the same problems like with the user information mentioned earlier on this mailing list. kittystore currently stores a superset of all properties all archives need. Maybe here (in contrast to the user information) it would be a good idea to split it into private information of the archives and simply commonly stored mails. (I wrote some thoughts about that on my blog[1].) * Because of the current architecture of the kittystore the NNTP archive could not search for message ids over all known mailing lists. This is a feature of the commands ARTICLE, BODY, HEAD and STAT. I do not know if there are many news clients out there supporting it, but it should be supported in any way. * The NNTP protocols requires multiline responses to several commands. Currently the responses are build as a list and then send as whole to the client. For some commands it would be better to use a generator and to steam the line as they are generated. Even now (with only a few test lists) I noticed that the querying of the database about the count of the articles in the different lists slow down the LIST command. Streaming the lines it would be much convenient for the user. * (optional) Currently it is not possible to POST articles to a mailing list via the NNTP archive. It was stated that most of the news clients could send a mail as answer. Currently that is okay, but I think that it would be not so hard to implement it later as addition. For reference: the current code is available at launchpad[2]. I am open for improvements and as I said, although gsoc is over now, I would like to continue to work with mailman. (even though I do not like bazaar as much as git) Thanks, Alex 1: http://blog.animux.de/message-stores-and-mailman-archivers.html 2: https://code.launchpad.net/~alexander-sd4c/mailman/mailman

2 2

Re: [Mailman-Developers] status of mailman 3.0 web stuff
by Barry Warsaw Aug. 21, 2012

Aug. 21, 2012

On Aug 21, 2012, at 11:08 AM, Ethan Fremen wrote: >I now have a job where I will be coding python again, and I was wondering >if I could help push this forward? the >http://wiki.list.org/display/DEV/Web+Interface+Status page says that a >basic UI is being set up. This is being driven forward in the Postorius project https://launchpad.net/postorius which can still be discussed here on mailman-developers. Florian, perhaps you can update the above wiki page to provide some more updated information about Postorius? Cheers, -Barry

2 1

status of mailman 3.0 web stuff
by Ethan Fremen Aug. 21, 2012

Aug. 21, 2012

Hi! I (failed) to help provide a new UI in the 2006 summer of code sprint. It seems like now a framework is acceptable :) which makes me happy. I now have a job where I will be coding python again, and I was wondering if I could help push this forward? the http://wiki.list.org/display/DEV/Web+Interface+Status page says that a basic UI is being set up. Is there a way I can jump in and help? Thanks, ~ethan fremen

1 0

translation of mail templates
by Peter Holzer Aug. 20, 2012

Aug. 20, 2012

Hi I started to translate the templates into german, resulting in some nasty unicode errors. Is there a howto on how the translation for other languages has to be done? Peter

1 0

Re: [Mailman-Developers] MM3 - preventing command summary by email
by Peter Holzer Aug. 20, 2012

Aug. 20, 2012

Hi I'm working with Robert on a newsletter project where we want to use Mailman 3 Therefore we'll use a moderated list to send out content to the subscribers. In my opinion or at least for our usecase it doesn't make much sense to send 2 mails to the subscriber, one that tells the user "Confirmation email sent" and sending a mail to the user that he should confirm his email address. If the command is successful, at least when there is only one command executed, it should be enough to send the actual result of the command. Would that be reasonable to make that configurable? Where would be the right place to hook in and at least prevent such "double" send outs? One other thing, I think it would be nice to have the actual list name in the subject of the action mails, for example "MyMailinglist confirm 66c0886...." instead of confirm 66c0886...." and it wouldn't interfere with the actual commands being executed as far as i could test it. How about adding this to mailman3 core and where to add it? Peter -------------------------------- agitator - weblösungen Peter Holzer Sumatrastrasse 25 CH-8006 Zürich Tel. +41 43 544 08 85 http://www.agitator.com > Fri, 03 Aug 2012 10:48:46 -0700 > > On Aug 03, 2012, at 04:55 PM, Robert Niederreiter wrote: > > >Is there a way to disable command summary sent by mail? e.g. after > >subscription and subscription confirmation. > > Not currently. Why do you want to suppress the results? > > -Barry

3 4

Re: [Mailman-Developers] Implementing the IArchiver
by Barry Warsaw Aug. 16, 2012

Aug. 16, 2012

Hi George. Sorry I was on vacation and mostly off-line. On Aug 06, 2012, at 08:28 PM, George Chatzisofroniou wrote: >I was wondering what is the best way to test an IArchive >implementation. Are there any built in test modes that will allow me >to send sample messages? I only care about the processing of the >messages through my IArchive implementation rather than actually >sending them out. There is an existing test in src/mailman/archiving/tests/test_prototype.py which tests the prototype archiver. It probably does way more than you need though, since it interfaces with the file system. But it should give you a fairly decent idea of how to set up a test for an IArchiver implementation. A few important things to notice. You'll need to set a layer in the test class. ConfigLayer ensures that the entire ZCA and configuration subsystem is initialized before the test is run; you'll need at least that. If you do want to send out a sample message, you can use SMTPLayer, which sets up a fake SMTP server and ensures that any email you send through Mailman's delivery system will get delivered to this fake server. Your test can then check that the message arrived and has the contents you expect. If you grep for SMTPLayer, you should find useful examples of that. See src/mailman/testing/layers.py for the set of existing layers. Their use is a bit funky because of the weird zope.testing semantics (something I want to get rid of eventually). In particular, normal inheritance rules don't apply, which is why you never see upcalls to super(). But that may be detail you don't care about. I hope that helps. I'm back from vacation now and happy to answer anything else if I can. Cheers, -Barry

1 0