Domain: list.org
Stories and comments across the archive that link to list.org.
Comments · 15
-
Storing cleartext passwords is asking for trouble.
I'm looking at you, Mailman... http://www.list.org/
-
Re:Holy shit!
Where i work i proposed using it to send alerts to students and faculty.
Then you need a mailing list manager, such as Mailman on your campus network. Guaranteed to have a much better up time and long term availability that Twatter.
-
John Viega and MailmanFor those who are or would assail John Viega's credibility, I should remind you who he is.
Most notable for the purpose of this discussion, Viega is the creator of Mailman, the fantastically-popular GPLd mailing list management software. All was good and well with his view of the many-eyeballs theory until, one day, he found a huge, glaring, holy-shit hole in Mailman a few years ago. He was so alarmed that nobody had ever spotted this that, after fixing it, he reflected on what he'd learned and turned it into a thoughtful article, The Myth of Open Source Security. As he wrote:"For three years, until March 2000, Mailman had a handful of glaring security problems in code that I wrote before I knew much about security. An attacker could use these security holes to gain access to the operating system on Linux computers running the program.
Again, Mailman was and is an extremely popular program -- this was not a problem of obscurity.
"These were not obscure bugs: anyone armed with the Unix command grep and an iota of security knowledge could have found them in seconds. Even though Mailman was downloaded and installed thousands of times during that time period, no one reported a thing. I finally realized there were problems as I started to learn more about security. Everyone using Mailman, apparently, assumed that someone else had done the proper security auditing, when, in fact, no one had."
So, the OnLamp.com article under discussion here is a follow-up to his original article, as he points out in the opening to the new article (but people apparently aren't reading.) As you can imagine, Viega is no rabid anti-OSS guy -- he's, in fact, the very model of what we want our developers to be. He writes good software, admits it when he writes bad software, and tells it like it is, even when we don't want to hear it.
(Disclaimers, such as they are: Viega is an adjunct professor at Virginia Tech, where I attend school, and I was the earliest alpha-tester of Mailman, in the late 90s.)
-Waldo Jaquith -
Re:Why did he abandon AbiWord?Much of SourceGear's computing infrastructure is Unix-based, and free software is used for things like e-mail, DNS, backups, and mailing lists. We use this software primarily because it's reliable and efficient. These systems were mostly put in place years ago, and only need periodic software updates and hardware check-ups.
Windows and IIS were the most convenient platform for our corporate web site given our
.NET product focus. You can visit Eric's Eric's personal web site, which was running Apache last time I checked. -
Re:phplist?PHPList is pretty cool, but is there a similar tool that also handles discussions?
Checkout GNU Mailman or Sympa.
Both are free; Mailman comes with RedHat, but Sympa is more advanced (choice of databases, ...). -
Community Discussions need Better Technology Tools
In the specific area of online discussions in local communities we need your advice. Related discussions on this has occured on the Democracies Online Code Network e-mail list for civic-minded techies.
We use e-mail lists. They work. Our participants love them. They need to work better with the web. We do not need a web-based system that treats e-mail participants as second class citizens. Our thousands of users won't make the transition - and we are not going to sacrifice our sustainable non-profit model that has worked for eight years.
In an ideal world someone would create an e-mail/web system akin to a cleaner, crisper Yahoogroups but something better that you can host on your own domain.
What we have:
Mailman with additional archives using Mail-Archive. (We are moving our last few lists off Yahoogroups.)
Basic web pages with forum information, hundreds of Minnesota-specific political links, and special election/candidate link directories.What we need in term of priority:
1. Advanced Web Archives and Subject Line Syndication - Improved web access to our e-mail forum archives including the ability to post via the web to -recent- messages by "no e-mail" members, the ability to automatically display via RSS the most recent subject lines from our various lists on our home page/other key web pages to posts in the archives. Hypermail, Mhonarc just don't cut it. They were great in their time, but we need something that takes advantage of MySQL, allows for linear display of posts in the same thread, and other tools. More on this
....2. Member Preferences Page - A single page like Yahoogroups where someone can control their settings on the all the lists they subscribe to on our server. We'd also like to allow people to recommend new e-mail lists for their local communities and essentially reserve a spot by letting us know that they are interested in a specific city/county/region or statewide public policy issue. We do not open community discussions without at least 100 participants and have an extensive public outreach process that goes with each new lists (i.e. online and in-person recruiting). If we recruit 50,000 "e-citizens" across Minnesota we need to use technology to help shape our forum development priorities.
3. Member Directory with Archive Links - (Again, we are not interested/able to use a web-centric conferencing system) This is where the web can complement our e-mail environment. I'd like each member to have the option to share information about themselves (our rules for posting including signing your real name, we have to use personal accountability in our model for online political discourse or everything would be pure crap). I'd like each e-mail that goes through the list server to insert their member directory page URL. From the member-directory page I'd to present both the information provided by the participants but also links to their recent posts across our various forums. And perhaps
...4. Participant Ratings - With unmoderated mailing lists, rating each post before it is delivered is impossible. Even if we moderate our lists, a multiple moderater bottle neck among our mostly non-techie audience would cause major delays in discourse. So
... one idea is to allow participants to optionally vote +1 substance, -1 for style for any post after it is distributed. We don't want to create a situation where people simply vote against people of other ideologies (we have a cherished and extremely rare cross-political spectrum audience) so some sort of forumula would have to be developed to give various weight to votes (i.e. repeat votes by one individual against another count less over time) and always bring the rating toward zero over time. Oh - why do this? While our unmoderated lists to have forum managers who have the power to sanction participants who violate our rules and guidelines, we ultimately believe that self-regulation, and group self-governance is our strength. We walk on a tight rope between chaos and control in order to keep and build our participatory civic audience based on our democratic and community purpose.5. E-Newsletter Distributed Content Management System - We have currently have 4,000+ people on our general announcement list (over next five years we'd like it to raise it to 50,000 or 1% of Minnesotans). We are planning a once or twice monthly e-mail newsletter with various content sections. I'd like to give our volunteer editor the tools to allow other volunteers to submit content (i.e. event lists, Minnesota political history this month, quotes of the month from our forums) on a regular basis into key sections of the newsletter and assuming that some content will be to long for e-mail newsletter format, something that integrates with a longer web section. 6. Mailman Advancements? Or another list packages. As an organization we'd like the ability to send one message to everyone on one of our lists without double posting. For our volunteer list managers we need the ability to quickly delete all the non-member (mostly spam) posts in one or two clicks and not have to click and select every post. What list packages do people recommend?
If you actually read this far, you should join the DO-CODE e-mail list that I mentioned above.
Cheers, Steven Clift
-
Geography is Key - Discussions,Content, or Access?
The use of global internet tools in very local communities has tremendous potential. Embrace geography. Love geography. This is not high school anymore, use your technical skills to benefit everyone even those jocks who pushed you around.
However, when you mix the goals of Internet access, local content, and local discussions/information exchange most non-profit/voluntar individual/commercial efforts fail without some level of subsidy. Figure out what you want to do most and do that well.
With Minnesota E-Democracy we have focused on the use of e-mail lists for state and local political/community discussion since 1994. We use e-mail lists with web archives to reach thousands of people on an ongoing basis. We are completely volunteer-based, have a donated web site, and are completing a move to Mailman from Yahoogroups in part because of their marketing/privacy shift.
We have a wealth of experience and articles available on my web site.
Steven Clift
-
Re:Don't Get Me WrongThe problem with Yahoo is that it is trying to make money doing something (providing communications) that has such a razor thin margin, and people willing to provide it for free, out of love for the particular community.
I think yahoo is going to slowly go downhill. They started charging to ftp files to geocities pages. They will start charging to access your email through pop on April 24th. Slowly it will get more and more ad-ridden, and filled with fees and annoyances, until it is dead. It was great while it lasted though, and I obviously still use it (look at my email address) and I'm a member of several groups.
sdf.lonestar.org may add mailing list capabilities to one of it's service levels. For group owners willing to pay, it may end up being the way to go. I'm in the midst of migrating my email and web page over there now.
The mailing list delivery mechanism is can be run from a home cable modem machine (pending harassment over the TOS and AUP, of course) but you are likely to get a lot of bellyaching if you go offline for a while. On the other hand a web-accessible archive can go offline for a while and not generate hate mail, death threats, and accusations that you are hijacking the internet or something.
I like the format of the archives produced by mailman, which is at http://www.list.org/
-
Mailman.Mailman rocks. Much better than Majordomo, even if it is written in Python.
;)Mailman, the GNU Mailing List Manager
Mailman is software to help manage electronic mail discussion lists, much like Majordomo or Smartmail. Mailman gives each mailing list a unique web page and allows users to subscribe, unsubscribe, and change their account options over the web. Even the list manager can administer his or her list entirely via the web. Mailman has most of the features that people want in a mailing list management system, including built-in archiving, mail-to-news gateways, spam filters, bounce detection, digest delivery, and so on. See the features page for more detail.
Mailman is free software. It is distributed under the GNU General Public License. The canonical Mailman home page is at a href="http://www.gnu.org/software/mailman/mailman
. html">www.gnu.org/software/mailman/mailman.html , with more information available at www.list.org. Mailman is written in the Python programming language, with a little bit of C code for security.It really is good software -- easy to administer, and easy for users. I wouldn't bother with Majordomo anymore...
-
Mailman.Mailman rocks. Much better than Majordomo, even if it is written in Python.
;)Mailman, the GNU Mailing List Manager
Mailman is software to help manage electronic mail discussion lists, much like Majordomo or Smartmail. Mailman gives each mailing list a unique web page and allows users to subscribe, unsubscribe, and change their account options over the web. Even the list manager can administer his or her list entirely via the web. Mailman has most of the features that people want in a mailing list management system, including built-in archiving, mail-to-news gateways, spam filters, bounce detection, digest delivery, and so on. See the features page for more detail.
Mailman is free software. It is distributed under the GNU General Public License. The canonical Mailman home page is at a href="http://www.gnu.org/software/mailman/mailman
. html">www.gnu.org/software/mailman/mailman.html , with more information available at www.list.org. Mailman is written in the Python programming language, with a little bit of C code for security.It really is good software -- easy to administer, and easy for users. I wouldn't bother with Majordomo anymore...
-
Mailing list subscription confirmationRFC3098 describes a procedure for "confirming" mailing list subscriptions which does not in fact require confirmation of subscriptions, and thus leaves open a wide avenue for abuse.
The RFC gives an example of a "confirmation message" which informs the recipient that s/he has been subscribed to a mailing list, and gives instructions for unsubscribing. This is not what modern mailing-list management packages (such as GNU Mailman or ezmlm/idx mean by a "confirmation message". These packages require that a user confirm by email that s/he wants to be on the list before adding the user to the list proper. The RFC allows that the user be subscribed first, and have to take action in order to unsubscribe.
The problem should be obvious: If you have to take action to unsubscribe from a list you never asked to be on, then your mailbox can still be flooded with list email before you have a chance to get off the list. You can be subscribed without your consent by a hostile party who wants to mailbomb you. (This is more common on badly-managed mailing lists than you might think.)
Spammers today already send out (fraudulent) "how to unsubscribe" messages, whereas well-managed mailing lists require active confirmation. An RFC on how to avoid being, or looking like, a spammer should recommend that one follow the methods of the best-managed legitimate mailing lists, not those of the spammers.
I would suggest that anyone interested in responsible mailing-list operation check out the MAPS Basic Mailing List Management Principles for Preventing Abuse. A mailing list which follows these rules will be much more resistant to abuse than one which strictly follows RFC3098. Moreover, a list which strictly follows RFC3098 and which is abused will qualify its site for the MAPS RBL.
-
Re:Python and Propoganda both start with the lette
I have seen a plethora of projects successfully that used Perl, and exactly zero that used Python.
Here's three for you, and chances aren't bad that you've already come across any or all of them:
- maps.yahoo.com, a map finding search system written in python
- mailman, a mailing list software package written in python
- RedHat's installer (can't find a URL -- try here?), an installation package written in python
So. Now you've seen three major projects written in Python, and chances are this isn't the first time you've seen one or all of them. Like Linux, Apache, Sendmail, and yes Perl, if you use the internet at all then you probably interact with Python all the time without necessarily realizing it. It's a nice, clean, scalable lanaguage who's one main drawback -- it's slow -- is handled nicely by the fact that it's so easy to integrate it with C. As a result, it gets easy to maintain a large, complex project in Python while optimizing bottlenecks with pure C modules.
Perl can pull some of the same tricks of course, but it's much messier. I like Perl, I mainly use Perl, and I'm not knocking it. But I really can't see the point in arguing the matter: Python is a much cleaner language that is far better suited for large scale projects. If you haven't come across it yet, maybe you just haven't done anything big enough yet.
-
Without DbC, what's the point?Sorry, but this is flat-out absurd. The main advangtage of Eiffel (as I've used it in engineering projects) is Design-by-Contract, which is unenforcable in lesser languages. Real Eiffel programmers don't want the ability to link in methods from other languages, especially since Microsoft are allowing mongrel languages to target
.NET, like Java and VB, which allow blasphemies like side-effects in functions with return values.Besides, any serious OO programmer knows that an OO language without multiple-implementation inheritance is a crippled husk of a language. Even Java has it with the addition of JAMIE and delegation.
.NET is merely a platform for VenerealBasic programmers who can't do real design, and Eiffel# is an Eiffel impostor with broken arms and legs. -
Postfix + mailman
-
We need documentation.This editorial hit the nail on the head. Documentation is the most critical need in the freed software community. It's the GNU project's most critical need.
Case in point: I'm trying to use the mailman mailing list software with Exim. It's been just no fun. I'll be able to figure it out, but it's going to take some effort.
You can be sure that once I do, I'm going to write up a README.exim and submit it to the manmail maintainers/developers, and perhaps add an FAQ entry.
Writing is not hard, and it really helps.