Hi Barry,
While you're on this subject, I was intrigued by the password resetting script but was disappointed that there is no way to actually configure the password on the command-line. I was thinking this would enable integration of Mailman subscriptions into an existing user database (i.e. via a nightly cron). If you use a commonly used encryption, then doing this on the command line shouldn't pose any security issues. On Kabissa this would be a key aspect to making Mailman continue to work as our list manager of choice for e-mail newsletters and discussions in our CMS of choice, Mambo Open Source.
Then again, if you're thinking of rewriting how passwords are kept, perhaps it might be useful to think about using a different type of container anyway, one that works with other, more sophisticated user management systems like those that come with CMSs. I.e. LDAP or simply mysql.
And this, plus the CAN prefix to the patch name, reminds me: correct me if I'm wrong, but my understanding is that Mailman as it exists does not comply with the new (unfortunately named) CAN SPAM act. According to this act, a recipient of an email from a given site has to be able to opt out from receiving ANY MAIL from that site. Right now all mailman lists are treated completely separately, and nobody (not even the subscriber) can easily find out which lists subscribers are subscribed to. What I envision having in my Mailman/Mambo system is a single user database with one password per username for all services. Users can then go to a simple preferences page on Mambo and do basic things like change their email address or password, tick a box to opt in/out of various mailings, and in particular opt to receive no mail at all. Other Mambo components would handle reading forums and newsletters online and enable users to subscribe/unsubscribe to them.
If anybody's got any suggestions on how to achieve this or is interested in working with us to develop this functionality, let me know.
Cheers,
Tobias
On Feb 10, 2005, at 10:02 AM, Barry Warsaw wrote:
I think CAN-2005-0202 gives us the opportunity to finally implement what
we have long considered an embarrassing exposure in Mailman's config.pck
databases. Member passwords are kept in this database in the clear.
The obvious fix is to hash member passwords and keep only the hash in
the database.
We haven't changed this before now for two reasons:
1. We would have to regenerate all member passwords, which is an
administrative burden. We might also need to implement checks to see if
the passwords were cleartext or hashed and do the password comparison
accordingly.
2. This breaks all password reminders.
To fully address CAN-2005-0202 we're recommending sites regenerate their
member passwords anyway, so this gives us an opening to fix this
properly. And we have a better internal password generator now too.
As for #2, well, I think most people hate those password reminders anyway, and we've decided that they are going away for MM3. I don't think many people would shed too many tears if we killed off monthly password reminders for 2.1.6. Doing that would also eliminate the requirement for the site list, since its primary purpose is to function as the sender of the reminder messages.
To do this for 2.1.6, we'd have to change the "Email My Password To Me" feature in the options page and in the member login page. These would have to become a "create a new password for me" feature. Also, crontab.in should not call mailpasswds anymore, or that script should turn into a simple "here's the lists you are on" reminder, without the password information in it. This will require i18n updates too.
The downside to doing this now is that it's more coding work for 2.1.6
and I'd like to get the new version out asap. Still, this seems like an
opportunity that we shouldn't lightly dismiss.
What do you all think? Is anybody willing to take a crack at a patch for this?
-Barry
_______________________________________________
Mailman-Developers mailing list
Mailman-Developers@python.org
http://mail.python.org/mailman/listinfo/mailman-developers
Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py
Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/
Unsubscribe: http://mail.python.org/mailman/options/mailman-developers/ tobias%40kabissa.org
-- Tobias Eigen Executive Director
Kabissa - Space for Change in Africa http://www.kabissa.org
* Kabissa's vision is for a socially, economically, politically, and environmentally vibrant Africa, supported by a strong network of effective civil society organizations. *
_______________________________________________ Mailman-Developers mailing list Mailman-Developers@python.org http://mail.python.org/mailman/listinfo/mailman-developers Mailman FAQ: http://www.python.org/cgi-bin/faqw-mm.py Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-developers/archive%40jab.org
