Mark is right. The spamming process was to scrape the listinfo page and locate the "list is run by" line and then de-obfuscate the "j.knight at keele.ac.uk" into " [email protected]". Then an email was faked using [email protected] as the sender to see if the list is either unmoderated or whether the administrator had set their own email address as unmoderated on a moderated list.
There's not a lot that can be done to protect against that other than changing the "list is run by" so that the administrators real email address isn't obvious. Jon. On 15 May 2017 at 23:19, Barry Warsaw <[email protected]> wrote: > On May 15, 2017, at 11:03 AM, Mark Sapiro wrote: > > >It's not done in Mailman 3. > > > >For mailman 2.1, the administrator email addresses are a mailto: link the > >goes to the LISTNAME-owner address, but the email addresses are exposed > and > >only mildly obfuscated ('@' -> ' at '). > > > >I would consider adding a configuration option to either obfuscate the > >addresses further (e.g. drop the domain entirely) or replace the text with > >something like "Listname list run by [email protected]". > > I'm a little confused by the OP. Is it: > > 1) A message to the posting address From: [email protected] is > not > being moderated? I would expect it to be since that address is not a > member > of the list. > > 2) Emailing To: [email protected] directly which would end up > spamming the list owners? > > MM3 doesn't currently moderate messages sent to the list owners, but it > could. Messages to -owners flows through a different, shorter chain of > rules > and pipeline, but I've always thought that that would be configurable. > > -Barry > _______________________________________________ > Mailman-Developers mailing list > [email protected] > https://mail.python.org/mailman/listinfo/mailman-developers > Mailman FAQ: http://wiki.list.org/x/AgA3 > Searchable Archives: http://www.mail-archive.com/ > mailman-developers%40python.org/ > Unsubscribe: https://mail.python.org/mailman/options/mailman- > developers/j.knight%40keele.ac.uk > > Security Policy: http://wiki.list.org/x/QIA9 > -- Jonathan Knight IT Services Keele University _______________________________________________ Mailman-Developers mailing list [email protected] https://mail.python.org/mailman/listinfo/mailman-developers Mailman FAQ: http://wiki.list.org/x/AgA3 Searchable Archives: http://www.mail-archive.com/mailman-developers%40python.org/ Unsubscribe: https://mail.python.org/mailman/options/mailman-developers/archive%40jab.org Security Policy: http://wiki.list.org/x/QIA9
