List change - munging for From addresses

List change - munging for From addresses

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 915 bytes --]

Hi all,

As more and more sites are using DKIM signing or emails (and DMARC),
more and more of the list traffic is not being delivered due to Mailman
altering messages in subtle ways (so the DKIM signature is no longer
valid).  The easiest thing to do is to tell Mailman to munge the From:
address so that the messages come from the mailing list itself.  It
also adds a Reply-To: header with the original sender's address.

So a message from me to the list will now have

From: Stephen Rothwell via Linuxppc-dev <linuxppc-dev@lists.ozlabs.org>
Reply-To: Stephen Rothwell <sfr@canb.auug.org.au>

The only real downside to this (I think) is that if you take a message
from the list containing a patch and apply that to a git tree you will
have to fix up the Author appropriately.

Konstantin, I assume (hope?) that b4 may have some way of fixing the
authorship up?
-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: List change - munging for From addresses

[Stephen Rothwell via Linuxppc-dev]

[-- Attachment #1: Type: text/plain, Size: 989 bytes --]

Hi all

On Fri, 2 Aug 2024 13:03:47 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> As more and more sites are using DKIM signing or emails (and DMARC),
> more and more of the list traffic is not being delivered due to Mailman
> altering messages in subtle ways (so the DKIM signature is no longer
> valid).  The easiest thing to do is to tell Mailman to munge the From:
> address so that the messages come from the mailing list itself.  It
> also adds a Reply-To: header with the original sender's address.
> 
> So a message from me to the list will now have
> 
> From: Stephen Rothwell via Linuxppc-dev <linuxppc-dev@lists.ozlabs.org>
> Reply-To: Stephen Rothwell <sfr@canb.auug.org.au>
> 
> The only real downside to this (I think) is that if you take a message
> from the list containing a patch and apply that to a git tree you will
> have to fix up the Author appropriately.

This has now been turned on (hopefully :-)).
-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: List change - munging for From addresses

[Konstantin Ryabitsev]

On Fri, Aug 02, 2024 at 01:03:47PM GMT, Stephen Rothwell wrote:
> As more and more sites are using DKIM signing or emails (and DMARC),
> more and more of the list traffic is not being delivered due to Mailman
> altering messages in subtle ways (so the DKIM signature is no longer
> valid).  The easiest thing to do is to tell Mailman to munge the From:
> address so that the messages come from the mailing list itself.  It
> also adds a Reply-To: header with the original sender's address.
> 
> So a message from me to the list will now have
> 
> From: Stephen Rothwell via Linuxppc-dev <linuxppc-dev@lists.ozlabs.org>
> Reply-To: Stephen Rothwell <sfr@canb.auug.org.au>
> 
> The only real downside to this (I think) is that if you take a message
> from the list containing a patch and apply that to a git tree you will
> have to fix up the Author appropriately.
> 
> Konstantin, I assume (hope?) that b4 may have some way of fixing the
> authorship up?

Not really, for two reasons:

- X-Original-From is widely used, but isn't really a standard header.
- From-munging breaks end-to-end attestation, so we consider x-original-from
  and similar headers a potential impersonation attempt and ignore them.

I would generally say that From-munging isn't a great option for any list that
receives patches. A much better approach is to just not modify the message
headers or message body. This should be possible with mailman.

-K

Re: List change - munging for From addresses

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1245 bytes --]

Hi Konstantin,

On Fri, 2 Aug 2024 11:54:06 -0400 Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
>
> Not really, for two reasons:
> 
> - X-Original-From is widely used, but isn't really a standard header.

In our case, Mailman puts the original address in the Reply-To header.

> - From-munging breaks end-to-end attestation, so we consider x-original-from
>   and similar headers a potential impersonation attempt and ignore them.

OK.

> I would generally say that From-munging isn't a great option for any list that
> receives patches. A much better approach is to just not modify the message
> headers or message body. This should be possible with mailman.

Unfortunately, I have not found a way to ensure Mailman (v2, at least)
will not modify messages in all cases e.g. in some circumstances it
will modify the To/Cc list.

So, an alternative for us (though considerable more work) is to change
mailing list software.  Mailmanv3 would be an option, but seems overly
complex.  I see vger.kernel.org is now using mlmmj - is that a
reasonable option for us (i.e. is it able to not modify messages but
still have enough features)?  If so any hints about migrating? ;-)
-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: List change - munging for From addresses

[Konstantin Ryabitsev]

On Mon, Aug 05, 2024 at 12:42:04PM GMT, Stephen Rothwell wrote:
> > I would generally say that From-munging isn't a great option for any list that
> > receives patches. A much better approach is to just not modify the message
> > headers or message body. This should be possible with mailman.
> 
> Unfortunately, I have not found a way to ensure Mailman (v2, at least)
> will not modify messages in all cases e.g. in some circumstances it
> will modify the To/Cc list.

Right, Mailman-2 is also dependent on Python-2, which is quite obsolete by
this point as well.

> So, an alternative for us (though considerable more work) is to change
> mailing list software.  Mailmanv3 would be an option, but seems overly
> complex.  I see vger.kernel.org is now using mlmmj - is that a
> reasonable option for us (i.e. is it able to not modify messages but
> still have enough features)?  If so any hints about migrating? ;-)

I'd say that mlmmj has a very different approach than mailman -- it exposes
very little to end-users and list admins. Any changes to the list
configuration must be made by server admins, which can be seen as very
limiting by someone used to how mailman does it.

However, it *is* a great option for running mailing lists that process
patches and couples well with public-inbox for archiving. It also requires a
fraction of resources of mailman-3.

If you want to be able to have a more hands-off approach to your mailing list
management, with a fancy UI and lots of list admin tunables, your best option
is Mailman-3. If you want a "mean and lean" option, then mlmmj is the way to
go.

-K

Re: List change - munging for From addresses

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 1980 bytes --]

Hi all,

On Mon, 5 Aug 2024 10:54:17 -0400 Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
>
> > So, an alternative for us (though considerable more work) is to change
> > mailing list software.  Mailmanv3 would be an option, but seems overly
> > complex.  I see vger.kernel.org is now using mlmmj - is that a
> > reasonable option for us (i.e. is it able to not modify messages but
> > still have enough features)?  If so any hints about migrating? ;-)  
> 
> I'd say that mlmmj has a very different approach than mailman -- it exposes
> very little to end-users and list admins. Any changes to the list
> configuration must be made by server admins, which can be seen as very
> limiting by someone used to how mailman does it.
> 
> However, it *is* a great option for running mailing lists that process
> patches and couples well with public-inbox for archiving. It also requires a
> fraction of resources of mailman-3.
> 
> If you want to be able to have a more hands-off approach to your mailing list
> management, with a fancy UI and lots of list admin tunables, your best option
> is Mailman-3. If you want a "mean and lean" option, then mlmmj is the way to
> go.

Konstantin, thanks for your advice.

Munging the From addresses did not give wonderful results (among other
things it would make searching the archive a more conplex operation).

So, I am going to try "mean and lean" (since I am the owner/moderator
anyway).  Shortly (i.e. in the next hour or so), I will switch the
linuxppc-dev mailing list to use Mlmmj.  Hopefully this will fix all
our problems with DKIM/DMARC and delivery of posts from some domains.

For the subscribers, to see how to manage you subscription, you will be
able to end an email to <linuxppc-dev+help@lists.ozlabs.org> for
instructions.  Hopefully you all won't find it too restrictive.

Please report any problems with the list after the change to me.

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: List change - munging for From addresses

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 886 bytes --]

Hi ,

On Mon, 12 Aug 2024 15:54:27 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> On Mon, 5 Aug 2024 10:54:17 -0400 Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
> >  
> So, I am going to try "mean and lean" (since I am the owner/moderator
> anyway).  Shortly (i.e. in the next hour or so), I will switch the
> linuxppc-dev mailing list to use Mlmmj.  Hopefully this will fix all
> our problems with DKIM/DMARC and delivery of posts from some domains.
> 
> For the subscribers, to see how to manage you subscription, you will be
> able to end an email to <linuxppc-dev+help@lists.ozlabs.org> for
> instructions.  Hopefully you all won't find it too restrictive.
> 
> Please report any problems with the list after the change to me.

The switch has happened, let's see how we go (starting wit this mail
:-)).

-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: List change - munging for From addresses

[Michael Ellerman]

Stephen Rothwell <sfr@canb.auug.org.au> writes:
> Hi ,
>
> On Mon, 12 Aug 2024 15:54:27 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>>
>> On Mon, 5 Aug 2024 10:54:17 -0400 Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
>> >  
>> So, I am going to try "mean and lean" (since I am the owner/moderator
>> anyway).  Shortly (i.e. in the next hour or so), I will switch the
>> linuxppc-dev mailing list to use Mlmmj.  Hopefully this will fix all
>> our problems with DKIM/DMARC and delivery of posts from some domains.
>> 
>> For the subscribers, to see how to manage you subscription, you will be
>> able to end an email to <linuxppc-dev+help@lists.ozlabs.org> for
>> instructions.  Hopefully you all won't find it too restrictive.
>> 
>> Please report any problems with the list after the change to me.
>
> The switch has happened, let's see how we go (starting wit this mail
 
Looks like it's dropping some 'h' characters? :P

Otherwise looks OK so far. I'll send a patch to test how that goes.

cheers

Re: List change - munging for From addresses

[Konstantin Ryabitsev]

On Mon, Aug 12, 2024 at 04:19:13PM GMT, Stephen Rothwell wrote:
> > For the subscribers, to see how to manage you subscription, you will be
> > able to end an email to <linuxppc-dev+help@lists.ozlabs.org> for
> > instructions.  Hopefully you all won't find it too restrictive.
> > 
> > Please report any problems with the list after the change to me.
> 
> The switch has happened, let's see how we go (starting wit this mail
> :-)).

Headers look good! One thing you'll also want to set up is OpenARC to add
ARC signatures, which are now required by Google once your mail server reaches
certain thresholds. OpenARC isn't too hard to set up.

-K

Re: List change - munging for From addresses

[Stephen Rothwell]

[-- Attachment #1: Type: text/plain, Size: 463 bytes --]

Hi Konstantin,

On Mon, 12 Aug 2024 09:53:43 -0400 Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
>
> Headers look good! One thing you'll also want to set up is OpenARC to add
> ARC signatures, which are now required by Google once your mail server reaches
> certain thresholds. OpenARC isn't too hard to set up.

Done.  Does that look better?

The mail does seem to be flowing into Google a bit smoother.
-- 
Cheers,
Stephen Rothwell

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]