Re: [Mailman-Users] Fake Email
Barry Warsaw wrote: > On Oct 31, 2009, at 1:28 AM, Stephen J. Turnbull wrote: > >> A better way to do this would be to set up the MTA on Mailman's host >> to only deliver to the list address (ie, Mailman) if the sender has >> been authenticated (eg, with TLS). > > Or to use digital signatures for sender verification. This is not > something that Mailman currently supports. > > -Barry > I tried posting to the list several times now without success. I hope this this one finally gets through. Another way to deal with this is sender confirmation by email, where, like subscriber confirmation by email, a message is sent with a confirmation link. Mailman doesn't have this capability presently but it seems to me that since it already has subscriber confirmation, it should be possible to adapt that sender confirmation. This sender confirmation by email feature is available in L-Soft's LISTSERV, and it is an essential way to avoid fake email. In a post a few years ago Barry said that this feature was going to be in vers. 2.2, but that version never materialized. Will it be in vers. 3? -- \/\/\/ Conrad Richter /\/\/\ ti...@richters.org -- Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org
Re: [Mailman-Users] Fake Email
Barry Warsaw wrote: > On Oct 31, 2009, at 1:28 AM, Stephen J. Turnbull wrote: > >> A better way to do this would be to set up the MTA on Mailman's host >> to only deliver to the list address (ie, Mailman) if the sender has >> been authenticated (eg, with TLS). > > Or to use digital signatures for sender verification. This is not > something that Mailman currently supports. > > -Barry > I tried posting to the list several times now without success. I hope this this one finally gets through. Another way to deal with this is sender confirmation by email, where, like subscriber confirmation by email, a message is sent with a confirmation link. Mailman doesn't have this capability presently but it seems to me that since it already has subscriber confirmation, it should be possible to adapt that sender confirmation. This sender confirmation by email feature is available in L-Soft's LISTSERV, and it is an essential way to avoid fake email. In a post a few years ago Barry said that this feature was going to be in vers. 2.2, but that version never materialized. Will it be in vers. 3? -- \/\/\/ Conrad Richter /\/\/\ ti...@richters.org -- Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org
[Mailman-Users] Is There a Hack to Add Author Confirmation of Messages?
[Sorry if this post appears twice. My original post sent yesterday still does not seem to have made it to the list.] I need to move a LISTSERV list to a new listserver. The main hurdle to moving to Mailman is the fact that Mailman lacks the ability for authors to confirm their own messages. The principle is similar to the way Mailman confirms new subscribers, with a web-based message confirmation link emailed to the subscriber. Is there a hack somewhere for adding this confirmation feature for messages? The fact that Mailman already has an email confirmation ability for subscriptions built-in suggests to me that someone, somewhere has figured out a way to use that facility for message confirmation. For those who are interested, we implemented message confirmation on the LISTSERV list as a security measure. We did not want to use moderation because that tends to slow down the discussions and the dissemination of urgent information. But at the same time we wanted a way to prevent non-members from spoofing a list member and getting their offensive postings out to the list. The list is an invitation only list, so once a member is on the list, they are trusted enough to post freely to the list -- Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org
[Mailman-Users] Is There a Hack to Add Author Confirmation of Messages?
I need to move a LISTSERV list to a new listserver. The main hurdle to moving to Mailman is the fact that Mailman lacks the ability for authors to confirm their own messages. The principle is similar to the way Mailman confirms new subscribers, with a web-based message confirmation link emailed to the subscriber. Is there a hack somewhere for adding this confirmation feature for messages? The fact that Mailman already has an email confirmation ability for subscriptions built-in suggests to me that someone, somewhere has figured out a way to use that facility for message confirmation. For those who are interested, we implemented message confirmation on the LISTSERV list as a security measure. We did not want to use moderation because that tends to slow down the discussions and the dissemination of urgent information. But at the same time we wanted a way to prevent non-members from spoofing a list member and getting their offensive postings out to the list. The list is an invitation only list, so once a member is on the list, they are trusted enough to post freely to the list. -- Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org
Re: [Mailman-Users] Fake Email
Barry Warsaw wrote: > On Oct 31, 2009, at 1:28 AM, Stephen J. Turnbull wrote: > >> A better way to do this would be to set up the MTA on Mailman's host >> to only deliver to the list address (ie, Mailman) if the sender has >> been authenticated (eg, with TLS). > > Or to use digital signatures for sender verification. This is not > something that Mailman currently supports. > > -Barry > Another way to deal with this is sender confirmation by email, where, like subscriber confirmation by email, a message is sent with a confirmation link. Mailman doesn't have this capability presently but it seems to me that since it already has subscriber confirmation, it should be possible to adapt that sender confirmation. This sender confirmation by email feature is available in L-Soft's LISTSERV, and it is an essential way to avoid fake email. In a post a few years ago Barry said that this feature was going to be in vers. 2.2, but that version never materialized. Will it be in vers. 3? -- \_\ RICHTERS HERBS / / Goodwood, ON, L0C 1A0, Canada \_\ Tel +1.905.640.6677 Fax +1.905.640.6641 /_/ http://www.richters.com -- Mailman-Users mailing list Mailman-Users@python.org http://mail.python.org/mailman/listinfo/mailman-users Mailman FAQ: http://wiki.list.org/x/AgA3 Security Policy: http://wiki.list.org/x/QIA9 Searchable Archives: http://www.mail-archive.com/mailman-users%40python.org/ Unsubscribe: http://mail.python.org/mailman/options/mailman-users/archive%40jab.org
