Re: mailing list changes

[Dirk Hohndel via subsurface]

That's because any sane mailing list by default does NOT send responses back to 
the mailing list.
Otherwise you get the all time favorite "personal message sent to the list" 
effect. I am sadly on a couple of mailing lists that are mis-configured like 
that, and it is very annoying.
This was my biggest fear when switching, but clearly the mailman authors had 
that already handled.

/D

> On Mar 7, 2020, at 5:39 AM, tormento via subsurface 
>  wrote:
> 
> When I reply from Gmail I always have to change the address or the mail will 
> be apparently sent to the person, not to the mailing list.

___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Dirk Hohndel via subsurface]

Please have bike shedding festivities about communication mechanisms in the 
Telegram group of your choice.

And please feel free to start a Telegram group for Subsurface. But please don't 
expect any of the main developers to ever show up there.

This development mailing list is and will be on email. If you would rather not 
be on email, that is certainly your choice.

Thanks

/D

> On Mar 7, 2020, at 1:33 AM, tormento via subsurface 
>  wrote:
> 
> Unless you use a SECURE VPN, IP is included in the header or anyway traceable.
> 
> It’s more than enough to have some agency knocking at your door.
> 
> Il giorno sab 7 mar 2020 alle 10:30 Benjamin  > ha scritto:
> Email is not really personally identifiable. Anyone can use a given account 
> at any time. Telegram, Signal, WhatsApp and their ilk are all linked to a 
> telephone number. So that already limits who can use it concurrently. Which 
> means that fingers can be pointed at people more easily. Which tends to make 
> certain people slightly nervous ;)
> 
> On Sat, 7 Mar 2020, 11:26 tormento via subsurface, 
>  > wrote:
> Are you all really talking about crypto when emails travel as plain text? XD
> 
> Il giorno sab 7 mar 2020 alle 09:47 Benjamin  > ha scritto:
> The cryptography in Telegram has already been compromised, as seen in that 
> case in Brazil a short while ago. 
> 
> On Sat, 7 Mar 2020, 10:12 Robert C. Helling via subsurface, 
>  > wrote:
> Hi,
> 
> > Am 07.03.2020 um 00:06 schrieb tormento via subsurface 
> >  > >:
> > 
> > Ever thought about creating a Telegram group?
> 
> Please don’t. Email as a mature technology is far superior to any messenger 
> in terms of archiving, searching, sorting and automated processing. 
> 
> Just my $.02
> Robert
> 
> Ps: wrt telegram: please convince yourself you can trust the people behind 
> telegram before relying on the cryptography they offer. 
> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org 
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface 
> 
> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org 
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface 
> 
> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[tormento via subsurface]

When I reply from Gmail I always have to change the address or the mail
will be apparently sent to the person, not to the mailing list.

Il giorno sab 7 mar 2020 alle 14:31 Jef Driesen via subsurface <
subsurface@subsurface-divelog.org> ha scritto:

> On 7/03/2020 13:50, Christof Arnosti via subsurface wrote:
> > Can you explain this a bit more?
> >
> > I think that DKIM / DMARC does exactly what it should: preventing
> modification
> > of mails with "MailFrom" from my domain on-the-fly.
> >
> > I also have SPF configured, which should in theory also lead to a reject
> when my
> > domain is used as MailFrom.
> >
> > With DMARC, if I understand correctly, the mail should only be threated
> as
> > boguous when both of these mechanisms fail at once. This is the case
> when the
> > subsurface-divelog.org list server modifies my mail (breaks DKIM) and
> sends it
> > from it own server (breaks SPF) with MailFrom ~= *@charno.ch.
> >
> > I understand that this leads to problems with mailing lists, but on the
> other
> > hand I would think that replacing the sender address by the mailing list
> > software (like done now on subsurface-divelog.org) should be the right
> way to
> > deal with this problem. Honestly, I'm more curious about why your mail
> client
> > only displays the sender mail-address (but not always? The mail you
> directly
> > received from Benjamin seems fine?) instead of the name in the
> MailFrom-Header.
> >
> > I think that DMARC / DKIM / SPF are a quite important tool in the fight
> against
> > mail spoofing, so I would hate to weaken or disable it.
> >
> > Can you give me some recommendation on how I should configure DMARC /
> DKIM / SPF
> > without breaking spoof-save mailing, but still working with mailinglists
> > configured like subsurface was before?
> There is an import difference between the "From" email header (which is
> displayed by the mail client), and the sender/recipient address ("mail
> from" and
> "rcpt to") used during the smtp communication. For SPF only the latter is
> relevant. So it would be perfectly possible to leave the From header
> intact:
>
> From: Christof Arnosti <...@charno.ch>
>
> and send the mail from the subsurface domain:
>
> MAIL FROM: 
> RCPT TO: 
>
> For SPF everything should be fine because the mail originates from the
> subsurface mail server, and the mail client will show the correct name. Or
> am I
> missing something? I'm certainly not an expert on mail server
> configuration, but
> I do run one too.
>
> For DKIM/DMARC I don't really know.
>
> Jef
> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface
>
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Jef Driesen via subsurface]

On 7/03/2020 13:50, Christof Arnosti via subsurface wrote:

Can you explain this a bit more?

I think that DKIM / DMARC does exactly what it should: preventing modification 
of mails with "MailFrom" from my domain on-the-fly.


I also have SPF configured, which should in theory also lead to a reject when my 
domain is used as MailFrom.


With DMARC, if I understand correctly, the mail should only be threated as 
boguous when both of these mechanisms fail at once. This is the case when the 
subsurface-divelog.org list server modifies my mail (breaks DKIM) and sends it 
from it own server (breaks SPF) with MailFrom ~= *@charno.ch.


I understand that this leads to problems with mailing lists, but on the other 
hand I would think that replacing the sender address by the mailing list 
software (like done now on subsurface-divelog.org) should be the right way to 
deal with this problem. Honestly, I'm more curious about why your mail client 
only displays the sender mail-address (but not always? The mail you directly 
received from Benjamin seems fine?) instead of the name in the MailFrom-Header.


I think that DMARC / DKIM / SPF are a quite important tool in the fight against 
mail spoofing, so I would hate to weaken or disable it.


Can you give me some recommendation on how I should configure DMARC / DKIM / SPF 
without breaking spoof-save mailing, but still working with mailinglists 
configured like subsurface was before?
There is an import difference between the "From" email header (which is 
displayed by the mail client), and the sender/recipient address ("mail from" and 
"rcpt to") used during the smtp communication. For SPF only the latter is 
relevant. So it would be perfectly possible to leave the From header intact:


   From: Christof Arnosti <...@charno.ch>

and send the mail from the subsurface domain:

   MAIL FROM: 
   RCPT TO: 

For SPF everything should be fine because the mail originates from the 
subsurface mail server, and the mail client will show the correct name. Or am I 
missing something? I'm certainly not an expert on mail server configuration, but 
I do run one too.


For DKIM/DMARC I don't really know.

Jef
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Robert Helling via subsurface]

Hi,

> On 7. Mar 2020, at 10:25, tormento via subsurface 
>  > wrote:
> 
> Are you all really talking about crypto when emails travel as plain text? XD

sorry, my response was too short. I meant: Messengers are not a good 
replacement for email since they lack features like archiving, sorting, etc.

Messengers have a place (but not as email replacements), in particular if you 
want encrypted in the moment communication. If you want to use and rely on 
encryption, choose your tools wisely.

Best
Robert


signature.asc
Description: Message signed with OpenPGP
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Benjamin via subsurface]

Email is not really personally identifiable. Anyone can use a given account
at any time. Telegram, Signal, WhatsApp and their ilk are all linked to a
telephone number. So that already limits who can use it concurrently. Which
means that fingers can be pointed at people more easily. Which tends to
make certain people slightly nervous ;)

On Sat, 7 Mar 2020, 11:26 tormento via subsurface, <
subsurface@subsurface-divelog.org> wrote:

> Are you all really talking about crypto when emails travel as plain text?
> XD
>
> Il giorno sab 7 mar 2020 alle 09:47 Benjamin  ha
> scritto:
>
>> The cryptography in Telegram has already been compromised, as seen in
>> that case in Brazil a short while ago.
>>
>> On Sat, 7 Mar 2020, 10:12 Robert C. Helling via subsurface, <
>> subsurface@subsurface-divelog.org> wrote:
>>
>>> Hi,
>>>
>>> > Am 07.03.2020 um 00:06 schrieb tormento via subsurface <
>>> subsurface@subsurface-divelog.org>:
>>> >
>>> > Ever thought about creating a Telegram group?
>>>
>>> Please don’t. Email as a mature technology is far superior to any
>>> messenger in terms of archiving, searching, sorting and automated
>>> processing.
>>>
>>> Just my $.02
>>> Robert
>>>
>>> Ps: wrt telegram: please convince yourself you can trust the people
>>> behind telegram before relying on the cryptography they offer.
>>> ___
>>> subsurface mailing list
>>> subsurface@subsurface-divelog.org
>>> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface
>>>
>> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface
>
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[tormento via subsurface]

Are you all really talking about crypto when emails travel as plain text? XD

Il giorno sab 7 mar 2020 alle 09:47 Benjamin  ha scritto:

> The cryptography in Telegram has already been compromised, as seen in that
> case in Brazil a short while ago.
>
> On Sat, 7 Mar 2020, 10:12 Robert C. Helling via subsurface, <
> subsurface@subsurface-divelog.org> wrote:
>
>> Hi,
>>
>> > Am 07.03.2020 um 00:06 schrieb tormento via subsurface <
>> subsurface@subsurface-divelog.org>:
>> >
>> > Ever thought about creating a Telegram group?
>>
>> Please don’t. Email as a mature technology is far superior to any
>> messenger in terms of archiving, searching, sorting and automated
>> processing.
>>
>> Just my $.02
>> Robert
>>
>> Ps: wrt telegram: please convince yourself you can trust the people
>> behind telegram before relying on the cryptography they offer.
>> ___
>> subsurface mailing list
>> subsurface@subsurface-divelog.org
>> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface
>>
>
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Benjamin via subsurface]

The cryptography in Telegram has already been compromised, as seen in that
case in Brazil a short while ago.

On Sat, 7 Mar 2020, 10:12 Robert C. Helling via subsurface, <
subsurface@subsurface-divelog.org> wrote:

> Hi,
>
> > Am 07.03.2020 um 00:06 schrieb tormento via subsurface <
> subsurface@subsurface-divelog.org>:
> >
> > Ever thought about creating a Telegram group?
>
> Please don’t. Email as a mature technology is far superior to any
> messenger in terms of archiving, searching, sorting and automated
> processing.
>
> Just my $.02
> Robert
>
> Ps: wrt telegram: please convince yourself you can trust the people behind
> telegram before relying on the cryptography they offer.
> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface
>
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Robert C. Helling via subsurface]

Hi,

> Am 07.03.2020 um 00:06 schrieb tormento via subsurface 
> :
> 
> Ever thought about creating a Telegram group?

Please don’t. Email as a mature technology is far superior to any messenger in 
terms of archiving, searching, sorting and automated processing. 

Just my $.02
Robert

Ps: wrt telegram: please convince yourself you can trust the people behind 
telegram before relying on the cryptography they offer. 
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Dirk Hohndel via subsurface]

> On Mar 6, 2020, at 3:05 PM, tormento via subsurface 
>  wrote:
> 
> Ever thought about creating a Telegram group?

I have never used Telegram.
I don't think the lack of developer participation has anything to do with email 
vs. 
GitHub vs. some other medium.
I think it is that for most of the former developers Subsurface does what they 
are looking for. And quite a few simply have moved on. Had kids, changed jobs,
etc.

/D

___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[tormento via subsurface]

Ever thought about creating a Telegram group?

Just my 2 cents.

Alberto

Il giorno ven 6 mar 2020 alle 23:53 Dirk Hohndel via subsurface <
subsurface@subsurface-divelog.org> ha scritto:

>
> Given that apparently more and more people run into issues with mailing
> list emails being marked as spam (because of DMARC and DKIM issues),
> I changed the list setting to munge the from address.
>
> Frankly, the list is fairly dead and we are down to just a handful of
> people
> actually working on Subsurface at all, but hey, every once in a while we
> do get a few emails, and hopefully this change will be an improvement.
>
> The biggest difference is, of course, that a simple 'reply' is no longer
> going
> to the author of the email that you are responding to, but to the whole
> list...
>
> /D
> ___
> subsurface mailing list
> subsurface@subsurface-divelog.org
> http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface
>
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Linus Torvalds via subsurface]

On Fri, Mar 6, 2020 at 4:54 PM Dirk Hohndel via subsurface
 wrote:
>
> Ugh. Apparently wrong. Turns out that Mailman defaults to adding a Reply-To
> header now, so the net effect might be pretty much "no change".

This looks good to me. "Reply" does the right thing, and replies to
both the list and the original author.

And because it says that the "From" is the mailing list, it shouldn't
trigger the DKIM issues, since subsurface-divelog.org doesn't require
it.

So at least from a quick header reading it all looks good. Of course,
let's see what happens when Christof sends the next email to the
list..

  Linus
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

Re: mailing list changes

[Dirk Hohndel via subsurface]

> On Mar 6, 2020, at 2:52 PM, Dirk Hohndel via subsurface 
>  wrote:
> 
> Given that apparently more and more people run into issues with mailing 
> list emails being marked as spam (because of DMARC and DKIM issues),
> I changed the list setting to munge the from address.
> 
> Frankly, the list is fairly dead and we are down to just a handful of people
> actually working on Subsurface at all, but hey, every once in a while we
> do get a few emails, and hopefully this change will be an improvement.
> 
> The biggest difference is, of course, that a simple 'reply' is no longer going
> to the author of the email that you are responding to, but to the whole
> list...

Ugh. Apparently wrong. Turns out that Mailman defaults to adding a Reply-To
header now, so the net effect might be pretty much "no change".

/D
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface

mailing list changes

[Dirk Hohndel via subsurface]

Given that apparently more and more people run into issues with mailing 
list emails being marked as spam (because of DMARC and DKIM issues),
I changed the list setting to munge the from address.

Frankly, the list is fairly dead and we are down to just a handful of people
actually working on Subsurface at all, but hey, every once in a while we
do get a few emails, and hopefully this change will be an improvement.

The biggest difference is, of course, that a simple 'reply' is no longer going
to the author of the email that you are responding to, but to the whole
list...

/D
___
subsurface mailing list
subsurface@subsurface-divelog.org
http://lists.subsurface-divelog.org/cgi-bin/mailman/listinfo/subsurface