Posts from gmane no longer allowed?

[Chris Angelico]

On Mon, Sep 27, 2021 at 1:10 AM Grant Edwards <grant.b.edwards at gmail.com> wrote:
>
> On 2021-09-26, Chris Angelico <rosuav at gmail.com> wrote:
>
> > Not sure what the significance of the "application" is - Google has
> > different services for where you're using it with your own domain, but
> > that shouldn't be relevant. If you want to use Gmail with mutt, you
> > should be able to do that, regardless. (Or you can just use some other
> > email address to post from, that would also work.)
>
> I have other addresses from which I could post, but I don't want them
> visible on the list.
>
> There are three ways to use mutt (or any other IMAP/SMTP) client with
> GMail.
>
>  1. Plain old username/password authentication: This requires you to
>     enable the "less secure apps" option on your Gmail account. I used
>     to use that, and it worked. But, it's frowned upon, and I wouldn't
>     be surprised if it went away soon. It requires you to either put
>     your password in a plaintext config file or enter it every time
>     your connect to Gmail.

Agreed, I wouldn't recommend that.

>  2. Application-specific password: Creates a unique 16-digit
>     application password that allows access to selected
>     capabilities. This requires that you have two-factor
>     authentication enabled on your Google account. I probably should
>     do that, but I haven't figured out a convenient way to do so.

That would normally be the most convenient for personal usage like
this. It should be possible to use a simple TOTP tool, maybe even one
written in Python, like this:

https://github.com/Rosuav/shed/blob/master/2fa

>  3. OAUTH2: This requires that you "register an application" with
>     Google. That application is then issued revokable credentials. The
>     application uses those credentials to send an access request to
>     Google. The account's owner then goes to a specified URL to
>     autorize that access. The application is then issued revokable
>     access and refresh tokens. The access token allows access to
>     specific APIs for a short period of time (maybe an hour). After
>     the access token expires, the refresh token can be used to obtain
>     a new access token.

This is primarily aimed at third-party tools, where the user owning
the account isn't the same person as the creator of the tool. That's
why there's all the extra layers. It can certainly be used in a more
personal setup, but you'll probably need to do some
otherwise-unnecessary work. Google in particular is a bit of a hassle
for OAuth (compared to other OAuth providers), due to the wide variety
of services that they provide, some of which cost money. So there are
extra steps to choose which services to activate.

> The "register an application" step is where I got stuck. Other mutt
> users seem to have been able to go to their GMail account's cloud
> services page, create a project, create/register an application, and
> then download OAUTH2 credentials which they then use (via an external
> utility) with programs like mutt and msmtp.
>
> When I tried to "register an application" it demanded support and
> privacy policy URLs for my application. Those URLs had to be using
> domains that had bee pre-registered with Google. The only domain where
> I have a web page is at panix.com, and that domain isn't pre-
> registered with Google. I don't own that domain, so I'm not going to
> try to pre-register it with Google.

The most important address is the redirect URL. If you set that to
something on localhost, Google will know that you're building an
internal-only tool, and won't require anything much for the support
and privacy policy URLs (you could probably just set them to
http://localhost/support and http://localhost/privacy, or maybe even
leave them blank).

(But I'd still recommend an app password. Much easier.)

> I could continue to read the list with slrn, but post using something
> like Thunderbird, but do I really want to set up a whole new MUA just
> for one mailing list? [The other 20+ mailing lists I follow are all
> happy with posts from gmane.]
>

I'm not sure whether the policy change happened on python-list, or at
gmane. From the look of the error message you got, it may have
actually been gmane's decision. Haven't heard anything from the list
admins here about it, either way, so I have no idea.

ChrisA