[Mailman-Developers] Requirements for a new archiver

[Barry Warsaw]

On Thu, 2003-10-30 at 00:08, J C Lawrence wrote:

> Hang-on.  Apache isn't the target.  Mailman's UI is a CGI app.  As such
> it works with any web server that supports CGI-bin, which pretty much
> means any web server with no exceptions.  That's a pretty large gain,
> especially in the novice admin or simple deployment case territory.

Sure, but I suspect that plumbing Mailman out to http will be just a
proxy rule away from integrating with an existing web server.  That's
not without its headaches too, but should be as widely supported.

> Doing our own thing for HTTP handling can quickly be another Pandora's
> box, security concern, and integration problem for the (majority of)
> people who do want to run Apache/Boa/Thttpd/Zeus/etc.

We do need to worry about the security of the http framework (e.g.
Twisted), but past that, it's still our responsibility.  I mostly see
this as a thin veneer between the web and the core logic for Mailman. 
Wanna use CGI?  I suspect it's just a little extra glue.  Same goes for
mod_python or whatever.

> > An approach like Exim + elspy affords some really cool possibilities.
> 
> Absolutely, but that is outside of Mailman's territory.

Definitely for now, that's for sure.  I don't want to write it off
completely, but we need to be practical too.

> More interesting would be things like TMDA integration, or implementing
> support for Yakov Shafranovich extension of my consent token protocol:
> 
>   http://www.ietf.org/internet-drafts/draft-irtf-asrg-cri-00.txt
> 
> Getting early buy-in as a sample implementation for an MLM wouldn't be a
> Bad Thing.  There's a lot of really neat and useful integration and
> feature set territory to explore before you start staring down the MTA's
> throat.

Sure.  I just skimmed the CRI draft, but here's some questions (hmm, if
you answer this please start a new thread).  If you send 10 messages to
a list within 10 minutes and I've never heard of you before, should I
send you 10 challenges or one?  If I send you 10, should I consider a
response to any one of them good enough to free all 10 posts?  Also,
isn't any CRI system going to have to have mail bomb defenses?

-Barry