[Mailman-Developers] Mailman3 replaces [ with =?utf-8?q?=5B, why?

2024-05-30 Thread Alessandro Vesely
Hi all, I've seen these Subject: lines being changed using utf-8 quoted-printable encoding for every non-alnum character. The message has: X-Mailman-Version: 3.3.9rc4. Of course, doing so breaks DKIM signatures, and I'm trying to understand in what cases it is advisable to revert the

[Mailman-Developers] Re: ARC user options

2022-09-14 Thread Alessandro Vesely
On Wed 14/Sep/2022 06:35:50 +0200 Stephen J. Turnbull wrote: I still think you're going to get pushback on the requirements language, but the analysis is complete and accurate. That sounds good to me. I've posted the new draft version[*]. As all drafts, it is still open to discussions.

[Mailman-Developers] Re: ARC user options

2022-09-13 Thread Alessandro Vesely
On Tue 13/Sep/2022 10:14:12 +0200 Stephen J. Turnbull wrote: Alessandro Vesely writes: Maintaining synchronization of configurations of two lists will be tedious for the admin, or involve relatively complicated coding if we arrange to automatically mirror configuration changes. Couldn't

[Mailman-Developers] Re: ARC user options

2022-09-12 Thread Alessandro Vesely
Hi Steve, thanks for your precious insights. Some comments inline and a new version: On Sat 10/Sep/2022 10:41:21 +0200 Stephen J. Turnbull wrote: Alessandro Vesely writes: 3. The ARC method This twin-list proposal doesn't depend specifically on ARC. Right. For each list

[Mailman-Developers] Re: ARC user options

2022-09-09 Thread Alessandro Vesely
On Tue 06/Sep/2022 15:28:10 +0200 Stephen J. Turnbull wrote: At worst, one could set up two lists, fed by the same stream, one with munging enabled and the other not, letting users subscribe to the one they prefer. To be honest, while I'm at best 50% willing to implement the user option, I

[Mailman-Developers] Re: ARC user options

2022-09-06 Thread Alessandro Vesely
On Tue 06/Sep/2022 06:41:36 +0200 Stephen J. Turnbull wrote: Alessandro Vesely writes: On Sun 04/Sep/2022 13:38:39 +0200 Stephen J. Turnbull wrote: I asked bind-users if anyone verifying ARC saw any difference after trusting isc.org. Besides adding ARC sets, bind-users do From: munging

[Mailman-Developers] Re: ARC user options

2022-09-05 Thread Alessandro Vesely
Hi Steve! On Sun 04/Sep/2022 13:38:39 +0200 Stephen J. Turnbull wrote: Alessandro Vesely writes: There is a thread about ARC sealing in bind-users[*]. Not sure what you mean by "sealing". Do you mean they're not implementing the rest of the protocol? They add a comple

[Mailman-Developers] ARC user options

2022-09-04 Thread Alessandro Vesely
Hi, There is a thread about ARC sealing in bind-users[*]. They're applying ARC signatures, although they run Mailman 2. The last message hypothesizes a user option like so: *From munging*: Set this option to /Disabled/ to receive messages with the original From: line intact.

[Mailman-Developers] X-Mailman-Original-DKIM-Signature

2021-04-15 Thread Alessandro Vesely
Hi, I discovered this just today, after a list I'm subscribed to enabled it. I have a filter which tries to validate original signatures by removing footers and subject tags. Removing "X-Mailman-Original-" is going to be the next addition. I guess the purpose of this option is to spare a

[Mailman-Developers] Footer settings question: how common is dash-dash-space?

2021-01-29 Thread Alessandro Vesely
Hi, my footer removal software fails on IETF's "last-call" mailing list because it looks for a line of underscores, whereas that list uses "-- ". That sequence is "the separator line between the body and the signature of a message", according to RFC 3676. However, I had never seen it in

[Mailman-Developers] Mass subscriptions as a DoS attack

2020-11-27 Thread Alessandro Vesely
Trolls can wreak havoc by subscribing to one or more high volume mailing lists on behalf of a target one. For example, someone could subscribe this list to the Linux kernel mailing list. Everybody would see the confirmation message, but by the time someone realizes the need to unsubscribe,

[Mailman-Developers] Rewriting the Subject:

2020-11-25 Thread Alessandro Vesely
Hi all, I've installed my reverting DKIM verifier. Today it failed on a specific message which I also received directly. The reason it failed is the Subject: field was rewritten like so: ORIGINAL: Subject: RE: [dmarc-ietf] A policy for direct mail flows only, was ARC questions REWRITTEN:

[Mailman-Developers] Re: Verifying broken DKIM signatures

2020-09-28 Thread Alessandro Vesely
On Mon 28/Sep/2020 10:23:03 +0200 Alessandro Vesely wrote: >> Does this happen outside of DMARC mitigation?  Can you show examples? > > > I checked a few messages and couldn't find a switched To:.  Switched Cc: > seems > to happen when one of the recipients is t

[Mailman-Developers] Re: Verifying broken DKIM signatures

2020-09-28 Thread Alessandro Vesely
Hi Steve, your observations put me on the right track. Thank you so much! Long post below: On Thu 24/Sep/2020 12:31:29 +0200 Stephen J. Turnbull wrote: Alessandro Vesely writes: First, what Mailman are you talking about? Only Mailman 3 is likely to get these improvements, as Mailman 2

[Mailman-Developers] Verifying broken DKIM signatures

2020-09-22 Thread Alessandro Vesely
Hi all, there's been quite some discussion about signature breaking in indirect mail flows. Rewriting the From: header field seems to be the most popular workaround. Yet, it is possible to undo the transformation that Mailman put in place, thereby validating the original DKIM signature. I

[Mailman-Developers] Re: Anonymous mailing lists

2020-09-15 Thread Alessandro Vesely
On Tue 15/Sep/2020 13:58:24 +0200 Stephen J. Turnbull wrote: ves...@tana.it writes: Someone started talking about the risk of having their names and email addresses archived in a publicly accessible mailing list. So I thought I'd ask. In short, the proposal provided for completely removing

Re: [Mailman-Developers] Use of the public suffix list

2017-11-02 Thread Alessandro Vesely
On Thu 02/Nov/2017 03:31:46 +0100 Stephen J. Turnbull wrote: > Alessandro Vesely writes: > >> * The specs say that "DMARC should be amended to use [a method >> better than PSL] as soon as it is generally available" [1]. I >> believe that sentence refer

[Mailman-Developers] Use of the public suffix list

2017-10-26 Thread Alessandro Vesely
Hi all, I noticed (from a DMARC mitigation utility that Lindsay extracted) that Mailman features its own approach to using the PSL. Of course, development must go on, and sometimes it is a waste of time trying to make a super-duper scaffolding for a job that can be carried out complying to the

Re: [Mailman-Developers] Camera-ready option to mitigate DMARC issues

2016-11-06 Thread Alessandro Vesely
On Sun 06/Nov/2016 09:17:53 +0100 Stephen J. Turnbull wrote: Alessandro Vesely writes: The idea is to add a footer only in case it is not present, Aside from the technical difficulties that Mark describes, this suffers from a really big defect: for this to be actually useful, you'd need near

Re: [Mailman-Developers] Camera-ready option to mitigate DMARC issues

2016-11-06 Thread Alessandro Vesely
On Sat 05/Nov/2016 19:51:13 +0100 Mark Sapiro wrote: On 11/05/2016 04:11 AM, Alessandro Vesely wrote: The idea is to add a footer only in case it is not present, similar to what is done with subject_prefix. By properly setting both of them, a sender can submit what can be called a camera

[Mailman-Developers] Camera-ready option to mitigate DMARC issues

2016-11-05 Thread Alessandro Vesely
Dear all, I'd like to probe the feasibility of this option. The idea is to add a footer only in case it is not present, similar to what is done with subject_prefix. By properly setting both of them, a sender can submit what can be called a camera-ready post. Since no change applies, no DKIM