[Mailman-Users] Privacy Options Filtering

[Stephen J. Turnbull]

Mark Sapiro writes:
 > On 06/03/2013 03:21 PM, Cyndi Norwitz wrote:

 > > Could there be an easier way?  I don't want to run the risk of
 > > list owners overdoing this, but some spam usernames are super
 > > obvious.  Like freecredit or onlinepoker.
 > 
 > Learn simple regular expressions. There are lots of good references, and
 > in their simpler forms, they're not much different from 'globs'.
 > 
 > Any 'simple' UI that attempted to translate say 'a string that matches a
 > part of the email address to the left of the @' into the corresponding
 > match would probably be unwieldy with too many options and would still
 > not have the power of simple regular expressions.

+1.  There could be an easier way, but I don't know what it is.  The
only real alternative would be to optionally allow globs, but that
would require additional syntax in a single box or an extra box.  Two
boxes strikes me as an attractive nuisance, and it would catch some
power users, too.

 > > The moderation panel click feature will add ANY email address to
 > > the filter lists upon request.  There is no check to see if it is
 > > a legit email address or not.  But if it adds a bad address, it
 > > breaks the filter.  The filter does still work, but it may not
 > > work for all the good addresses.  I'm not sure if it works up to
 > > the bad address and then stops.

Cyndi: I don't understand what you mean by "breaks", especially given
Mark saying it works.  Mark doesn't miss much, but there's always a
first time. :-)

 > OK. This is a bug. I have entered it in the tracker at
 > <https://bugs.launchpad.net/mailman/+bug/1187201> and I will fix it, but
 > I'm not yet sure how. And the filter does continue to work for all
 > addresses, even the bad ones.

Well, is it a bug?  It seems to me that depends on whether the setting
is REJECT (it's a bug, although only wasting the MTA's time AFAICS) or
DISCARD (not a bug).  If it's DISCARD, surely the admin intends to
nuke that spammer in the future, too?  I don't know if this argument
applies to evil characters in the address but it should be true for
invalid domains.

 > > I have had this happen many times and there is no warning at all.
 > > The only way you know is if you try to edit the filter box list.
 > > Then when you save changes, it erases all of your changes and
 > > gives you an error message.  The error message I got today said
 > > there was a bad email address and then it listed ALL of the
 > > addresses (and expressions) in my list.  Very not useful.

This is Mailman's way of letting you know that you're abusing the
system. ;-)  Yes, I know you don't think you have a choice. :-(  I
don't think it would be terribly hard for us to do better though; see
below.

 > > I would like to see the bad email error message come up when you
 > > ADD the email address.  If it's done directly on the Privacy page
 > > then leave it exactly as it is now.  But please add a check to
 > > the moderation page so you can't add a bad email address without
 > > at least being warned about it (better if it's rejected).
 > 
 > That's my inclination for the fix. I.e. don't add the address to the
 > filter and say why, but what else should or shouldn't be done. E.g.
 > suppose this is one address out of 5 to be added from 5 posts. Do we
 > abort the whole transaction, do everything else anyway or something in
 > between.

I would say Mailman should (1) add all the valid addresses, (2) give
an error message specifying any addresses Mailman rejected, followed
(3, in the same page) by a confirmation message saying which addresses
were added.  Also, it might be useful to *prepend* the new addresses
to the list or regexp.