Re: [Mailman-Developers] SUBMIT and OpenID, was Two more DMARC mitigations

2014-06-16 Thread Stephen J. Turnbull
John Levine writes: > After digging through a festival of acronyms, I ended up at RFC > 6616. Thank you! > There are certainly OpenID libraries, but I don't know to what extent > anyone has written the code to splice them into SASL. Were we (on dmarc@ietf) talking all along about OpenID whe

Re: [Mailman-Developers] SUBMIT and OpenID, was Two more DMARC mitigations

2014-06-16 Thread John Levine
>>> At least one of the large providers has told me they plan to do OAUTH >>> submission, presumably with long lived tokens, which would greatly >>> mitigate the security issues. > >I'm trying to track down what's actually going on here. It's SUBMIT >either way, so everything in the code except t

[Mailman-Developers] [CLI Project] Describe instance and Subscription features

2014-06-16 Thread Rajeev S
Hi, I have completed the describe instance feature and the subscription features for the CLI. I have pushed the changes as r58.[1] The describe feature is implemented as an extension to the `show` command. This feature adds 3 new usages for the `./mmclient show` action, apart from the previ

Re: [Mailman-Developers] Two more DMARC mitigations

2014-06-16 Thread John R Levine
Mailman has always been about adhering to standards, preferably RFCs, but de facto standards are acceptable when it makes sense. OAUTH submission could make sense, but I'm not in favor of a supporting a proliferation of incompatible hacks. If this is going to be A Thing, then these webmail provi

Re: [Mailman-Developers] Two more DMARC mitigations

2014-06-16 Thread Barry Warsaw
On Jun 14, 2014, at 10:15 PM, John Levine wrote: >AOL and Yahoo both have OAUTH APIs, but they are not the same, and I >see no likelihood that the APIs will converge, or that the next large >webmail provider to DMARC us will be compatible with either. But >everyone has a SUBMIT server. Mailman h

Re: [Mailman-Developers] GnuPG support - PGP - GPG encrypted mailing list

2014-06-16 Thread Sylvain Viart
Le 15/06/2014 11:18, Stephen J. Turnbull a écrit : > [distributing encrypted email to an unknown number subscribers…] > True, but this is out of scope for this list. Just to emphasis that the goal of keeping information private that way could be wrong, if done the wrong way. (For example, you may