Greetings,
for those of you who want to tweak their subscription settings: it's not
possible at the moment and we're working on a solution. Why? Read on…
Digest Mode: There are about 550 accounts that had digest mode enabled.
The MM3 mass subription interface does not allow to set digest mode on
import. We're working on a script that will set digest mode for all
subscriptions previously in digest mode. Please allow for some time. We
want to avoid side effects. I expect this to be fixed by Monday EOB.
== Mailman 3 handles things different
Mailman 3 has a different account / subscriber model than Mailman 2. In MM2 an
account and a subscription would be the same. In MM3 an account and a
subscription are not necessarily linked to each other. It is possible to
(un)subscribe a mailing list without having an account. But the moment you
want to tweak settings, e.g. digest mode, you need to create an account. Once
you have an account you can link more than one mail address to it and change
settings for all of them from that account.
== My password for my MM2 account won't work!
Yes. We migrated subscriptions, but not accounts nor did we migrate passwords
associated with that MM2 account.
== Why is account creation disabled?
The ability to create an account has been disabled for the moment as $SOMEONE
created about 6.000 accounts on the mailing list server without ever – we
monitored this for about 3 months – linking a subscription to an account.
Login names for these accounts are all gibberish and we concluded it must be
some bot / script that does that.
We couldn't come up with an abuse case except for someone creating accounts in
order to create verification messages that would be sent to the accounts'
mailbox in order to test deliverability / create the impression that mailbox
would be actively used, before it would be used one day to send SPAM from it.
All accounts have mail addresses in one of two large platforms. We got in
contact with the postmaster teams, described the phenomenon and handed over a
list of sample addresses asking them to investigate if they could find
something unusual on their end. Unfortunately we never heard back. So in order
to prevent abuse we decided to disable account creation until we've found a
way to prevent these types of accounts.
= So what's the plan?
We need to bring in something that keeps machines out and let's humans in.
Captchas are a PITA and not as effective as we need them to be. Besides MM3
runs in a container and patching the container is something it really like to
stay clear from. It's likely we will enable / require MFA for new accounts,
but we haven't really had time yet to think this through and also to make up
our mind if we want to include the usual identity providers or use one of our
own.
Regards,
p@rick
--
[*] sys4 AG
https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer
Aufsichtsratsvorsitzender: Florian Kirstein
_______________________________________________
mailop mailing list -- [email protected]
To unsubscribe send an email to [email protected]
