Re: [Mailman-Developers] MM3 DMARC mitigations

2016-11-07 Thread Stephen J. Turnbull 
Barry Warsaw writes:

 > It will probably make no difference, but if we can inform users as
 > to the real culprits in this mess, they can either complain to
 > their ISPs or vote with their feet and find a new provider.  That
 > won't happen if they continue to blame the list software or site.

Well, I'll be happy to create the patch just to make the statement,
but honestly, I doubt we can convince anybody who actually believes
that list software created this mess to believe otherwise.  Unlike
telephone numbers, email addresses are not portable, so the incentives
against moving (which weaken the effectiveness of complaints) are
really strong, too.

 > (If we're serious about this, we should likely have a locked down
 > wiki page with more detail, linked to from the default p=reject
 > rejection message.)

Agreed.  Maybe I'll sprint on this at PyConCA. :-)

The sad thing is the DMARC protocol is actually really well-designed
for two purposes: allowing mailbox providers to get information about
mal-use of their domain names, and allowing organizations that conduct
business transactions via direct email to prevent spoofing.  It
doesn't address the problem of spoofed indirect mail (like mailing
list posts) because that's just a really hard problem because there's
no known good way to inform users about the trustworthiness of
individual messages.  (I'd like to blame it on the popular MUAs, but
I'm afraid the problem is deeper than that.)

Steve

___
Mailman-Developers mailing list
Mailman-Developers@python.org
https://mail.python.org/mailman/listinfo/mailman-developers
Mailman FAQ: http://wiki.list.org/x/AgA3
Searchable Archives: 
http://www.mail-archive.com/mailman-developers%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-developers/archive%40jab.org

Security Policy: http://wiki.list.org/x/QIA9

Re: [Mailman-Developers] MM3 DMARC mitigations

2016-11-07 Thread Mark Sapiro 
On 11/07/2016 06:05 PM, Barry Warsaw wrote:
> 
> With some verbiage massaging perhaps, I am supportive of a "hammer" option
> such as this.  Maybe we can't enable it by default, but I don't think it's
> unreasonable for site/list admins to be able to be more proactive in their
> rejection of such messages.  It will probably make no difference, but if we
> can inform users as to the real culprits in this mess, they can either
> complain to their ISPs or vote with their feet and find a new provider.  That
> won't happen if they continue to blame the list software or site.


It's in MM 2.1 and it's in my dmarc branch MR
. The list has
dmarc_moderation_action with possible values none, munge_from,
wrap_message, reject or discard.

The default reason is not what Steve proposes. The default is in
mailman/rules/dmarc.py per

reason = (mlist.dmarc_moderation_notice or
  _('You are not allowed to post to this mailing '
'list From: a domain which publishes a DMARC '
'policy of reject or quarantine, and your message'
' has been automatically rejected.  If you think '
'that your messages are being rejected in error, '
'contact the mailing list owner at ${listowner}.'))
msgdata['moderation_reasons'] = [wrap(reason)]

As it is, the list can supply its own reason. The default could of
course be changed or made a configuration setting.

-- 
Mark Sapiro The highway is for gamblers,
San Francisco Bay Area, Californiabetter use your sense - B. Dylan
___
Mailman-Developers mailing list
Mailman-Developers@python.org
https://mail.python.org/mailman/listinfo/mailman-developers
Mailman FAQ: http://wiki.list.org/x/AgA3
Searchable Archives: 
http://www.mail-archive.com/mailman-developers%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-developers/archive%40jab.org

Security Policy: http://wiki.list.org/x/QIA9

Re: [Mailman-Developers] MM3 DMARC mitigations

2016-11-07 Thread Barry Warsaw 
On Nov 06, 2016, at 05:39 PM, Stephen J. Turnbull wrote:

>Maybe it's time to default to rejecting posts from p=reject domains,
>with the explanatory message:
>
>Your domain publishes a "p=reject" DMARC policy, which is a
>statement to recipients that they allow you to send only
>authenticated direct mail.  This is a mailing list which re-sends
>your mail after processing, and therefore you are not allowed to
>post according to your email provider's policy.  Please repost
>from an address which allows you to post to full service mailing
>lists.
>
>Note: A few large providers claim to permit posting to mailing
>lists, but publish "p=reject" anyway.  They privately acknowledge
>doing so to protect users from spammers and phishers who have
>stolen millions of address books and other private information of
>users from them.

With some verbiage massaging perhaps, I am supportive of a "hammer" option
such as this.  Maybe we can't enable it by default, but I don't think it's
unreasonable for site/list admins to be able to be more proactive in their
rejection of such messages.  It will probably make no difference, but if we
can inform users as to the real culprits in this mess, they can either
complain to their ISPs or vote with their feet and find a new provider.  That
won't happen if they continue to blame the list software or site.

(If we're serious about this, we should likely have a locked down wiki page
with more detail, linked to from the default p=reject rejection message.)

Cheers,
-Barry
___
Mailman-Developers mailing list
Mailman-Developers@python.org
https://mail.python.org/mailman/listinfo/mailman-developers
Mailman FAQ: http://wiki.list.org/x/AgA3
Searchable Archives: 
http://www.mail-archive.com/mailman-developers%40python.org/
Unsubscribe: 
https://mail.python.org/mailman/options/mailman-developers/archive%40jab.org

Security Policy: http://wiki.list.org/x/QIA9