Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 617710 - Mailing lists: allow off-list replies to messages on the mailing list
Summary: Mailing lists: allow off-list replies to messages on the mailing list
Status: CONFIRMED
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Mailing Lists (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Infrastructure
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-07 10:27 UTC by Michał Górny
Modified: 2017-05-08 07:13 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2017-05-07 10:27:58 UTC
We sometimes send messages to some mailing lists while CC-ing relevant maintainers or projects, in case they were not subscribed. Sadly, this means that (if they're still unsubscribed), their replies do not have it to the mailing lists (and the archives). As a result, we end up with shattered threads that are hard to follow [ex:1,2].

I think it'd be reasonable to pass replies to mailing list messages through, independently of whether the sender is subscribed. In other words, match them via in-reply-to to the previous messages on the mailing list.

[1]:https://archives.gentoo.org/gentoo-musl/message/fa2be8ac57d3ce342907a036e86c33a5
[2]:https://archives.gentoo.org/gentoo-musl/message/b90569f3b6dfaf348f3fa7ee9ff50c1c
Comment 1 Jorge Manuel B. S. Vicetto (RETIRED) Gentoo Infrastructure gentoo-dev 2017-05-07 12:24:48 UTC
Michał,

I think that will be dangerous as it'll make easier to send spam to the mls. This would deny the subscribers logic of the mls software.
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2017-05-07 12:48:04 UTC
I think you're overestimating the value of spamming Gentoo mailing lists. I don't really see people going all the way to implement custom spamming solutions just to abuse this feature. And even if that happens, we can just disable it back.

On the other hand, the subscription logic is pretty easy to work around. Especially that it's commonly deployed and pretty much the same for all instances of mlmmj, i.e. exploitable with a generic solution.
Comment 3 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2017-05-08 07:13:18 UTC
This would be significant development for mlmmj, which has zero knowledge of the Message-ID values. At best, you could hack it via a pre-processing layer that detected a known Message-ID and added a header to allow mlmmj to pass-through, but it would be significant development, and a heavy lookup, as it needs to have most of the messages IDs for all of history (replying to a month-old thread DOES happen).

Rather than the dropped mail, a long time ago I proposed that we get better bounce messages instead of mlmmj silently dropping unsubscribed email: If you are not subscribed to a list, and you email it, you should get an SMTP error about being not subscribed (and your local mailserver should generate a bounce).