Subject: regarding IETF lists using mailman: nodupes considered harmful

From: Keith Moore <[email-masked]>
Date: Thu, 25 Aug 2005 18:20:01 -0400

I'm sending this to the ietf list because mailman is widely used for
IETF mailing lists.  

Recent versions of mailman appear to have a flaw that allows the sender
of a message to send a copy to everyone in a mailing list _except_ some
set of explicitly specified recipients, and there will be no indication
that those recipients were excluded.  In the context of an IETF mailing
list this can be used to exclude participation by certain individuals.

Specifics:  Mailman has a per-recipient setting called "nodupes".  The
effect of this setting is that any recipient address that has the
nodupes flag set, and which appears in a To or CC field of a message
sent to the list, will not receive a copy of the message from the
list.  It also appears (from emperical testing with a limited sample)
that the list may also remove that recipient's address from the CC
field of the copy of the message sent to the list.

Recent versions of mailman set "nodupes" by default.  List participants
can change it if they know about it, but they might have no idea of how
this setting works and how it can be used to exclude them from
participation.

The workaround is to set "new_member_options" (under General Options)
so that "Filter out duplicate messages to list members" is NOT set.
"Do not send a copy of a member's own post" should probably not
be set either.

Keith

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 26 Aug 2005 09:14:55 +0200

On Thu, 2005-08-25 at 18:20 -0400, Keith Moore wrote:
<SNIP>

> list.

But they _should_ be getting the message directly already, because of
the CC: or To:. Or is there something which causes the person not to get
it?

Indeed when some 'malicious' person would add Cc's/To's and would
instruct his SMTP to not forward to the additional addresses in the
Cc/To the users will effectively not receive the message.

Or when the recipient doesn't accept messages to [email-masked] +
himself, and expects everything to come from the list directly.

But how exactly does this cause a problem?

Greets,
 Jeroen

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 26 Aug 2005 03:56:52 -0400

> But how exactly does this cause a problem?

Isn't that enough?  Tricking the list software into excluding certain  
people from part of a discussion, even if it's only the part sent by  
one certain submitter?  It gives a false impression to the other list  
members that certain list members are part of the discussion when  
they have quietly been left out.

If that's not bad enough, what if the message in question were forged  
as being from someone who was also excluded from receiving it through  
this mechanism?  "I'm a moron, and I take back all the objections I  
raised to your proposal; WG chair, I support this proposal and think  
it should be sent to the IESG."  If the supposed sender never even  
sees a copy of "his" message, and if it's well crafted so as to not  
actually draw a direct reply, the WG may proceed on the assumption  
that it's legitimate.  (Of course, if the person is offline for a  
vacation or something, the same might happen.  And habitually signing  
one's messages may help call attention to the forgery, but we've got  
a ways to go to make that commonplace.)

Malicious intent aside, it's also useful to know sometimes if the  
mailing list software is somehow munging your messages in a way you  
didn't intend.  Stripping out attachments, converting encodings,  
changing HTML to plain text, etc.  (And I've seen mailman  
occasionally botch some such processing, leaving empty messages, but  
I don't recall the specifics at the moment, or if it's been fixed.)

Ken

---

From: Jari Arkko <[email-masked]>
Date: Fri, 26 Aug 2005 12:42:44 +0300

Folks,

I realize that this is something that could happen. Interesting
attack! But I missed the part where its somehow news to
us that e-mail system can be tricked in various ways.

And: Most of the time in important discussions it does not matter
if some messages get lost. People have lengthy debates about
matters, and only some of the participants are blocking
specific receivers. You talk to your colleagues and friends
about the discussions. You go and check archives now and
then for various reasons. In short, we typically rely on
multiple sources and media for our information, which helps
detect problems if there are any. And there are already a
number of reasons why you could be missing information,
such as false positives in your e-mail client's spam processing.

(Personally, I like to receive duplicates because then I know
the emails have gone to the list.)

--Jari

---

From: Ken Raeburn <[email-masked]>
Date: Fri, 26 Aug 2005 06:11:21 -0400

> us that e-mail system can be tricked in various ways.

It's not.  But that doesn't mean we need to add new ways, and enable  
them by default.

> if some messages get lost.

No, most of the time it doesn't.  But occasionally it does.

> the emails have gone to the list.)

So do I.  My thanks to Keith for pointing this out... it wouldn't  
have occurred to me that the defaults would be "wrong" for otherwise  
reasonable mailing list software. :-)  Guess I should check some of  
my subscriptions... now, if I could just remember all the lists on  
all the servers I've subscribed to....

Ken

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 26 Aug 2005 12:37:17 +0200

> they have quietly been left out.

Yes, which is why it might be good if the IETF Secretariat would:

 * Disable the nodupes feature
   That is, that per default it is disabled and folks get 'dupes'.

 * Notify, once, the users who have nodupes active, that it might
   affect the amount of mail they are getting, referencing or
   including Keiths original message.

Does this a) sound like a good idea, then b) can this be requested?

Rest of this discussion follows but can be skipped by most folks...

> this mechanism? 
<SNIP>
> (Of course, if the person is offline for a  

This part can be indeed only be solved by that simple step, which you
and I are already using: PGP sign the message.

Though privacy-folks then say 'but then I can't repudiate my message' to
which my silly answer is: either say something or don't.

I would actually be in favor of a mechanism where only PGP signed
messages get forwarded onto the list, others bounced back to the origin
stating that the sender can't be verified and that this might be because
it is not the original sender + how to setup and use PGP. This also
avoids having to check if a message from 'the iesg' actually comes from
the iesg by checking the headers. SPF will only help partially in this
case.

> I don't recall the specifics at the moment, or if it's been fixed.)

They have fixed quite a number of issues in that department
fortunately ;)

I personally like the 'nodupes' feature very much as messages that I get
cc'd on, thus most likely a reply to something doesn't get caught by the
List-Id header and then sorted in the correct folder, thus ending up in
my direct-message folder on this subject so I know that it is a reply
and I need to pay attention to it.

Something semi-related, nobody complains about the fact that one can Bcc
people which thus leads to other people than indicated in the To/Cc to
read the message, not that one knows the membership of most mailinglists
but still...

Greets,
 Jeroen

---

From: Bill Fenner <[email-masked]>
Date: Fri, 26 Aug 2005 09:29:24 -0400

> "Do not send a copy of a member's own post" should probably not

When Rob Austein and I discovered this (geez, it must have been a year
ago or more), there was no obvious way to change the default (looking
at UI and code), so we put it off  - I guess for long enough that the
UI might have caught up...

I noticed it because I tend to delete the version of a mail to list+me
that ends up in my inbox, because I know it'll end up in my listbox
too, and that stopped happening.

The action to recommend to existing users is to go to your options for
some list, e.g., https://www1.ietf.org/mailman/options/ietf , scroll
down to the bottom, in the "Avoid duplicate copies of messages?" box,
select "No" and "Set globally", then "Submit my changes".

If someone with a little more mailman clue than I can figure out a
withlist script (or similar) to set this default for all lists and all
users that'd probably be quite useful.

  Bill

---

From: Bill Fenner <[email-masked]>
Date: Fri, 26 Aug 2005 10:39:56 -0400

Sorry to follow up to my own message; I discovered when setting up
rtg.ietf.org's mailman setup that putting

DEFAULT_NEW_MEMBER_OPTIONS = 0

in mm_cfg.py will turn off the "nodupes" option for new lists.  It'll
still be on by default for existing lists, and existing subscriptions.

  Bill