provenance-matters: explain what went wrong

[web.git] / personal / _posts / 2018-06-02-mailman-subscription-spam.md

diff --git a/personal/_posts/2018-06-02-mailman-subscription-spam.md b/personal/_posts/2018-06-02-mailman-subscription-spam.md
index 237153c026524132fbb389c5e69bb9578b207158..e8d557c48e6b23b4a98a54d4719204988ae7ac0b 100644 (file)
--- a/personal/_posts/2018-06-02-mailman-subscription-spam.md
+++ b/personal/_posts/2018-06-02-mailman-subscription-spam.md
@@ -20,14 +20,17 @@ spam.  So, more than enough reasons to try and stop this.
 ### The Big Guns
 
 My first reaction was to go and look for a way to add a CAPTCHA to the
 ### The Big Guns
 
 My first reaction was to go and look for a way to add a CAPTCHA to the

-subscription page.  Unfortunately, Mailman itself does not support a CAPTCHA (at
-least not Mailman 2), and the existing patches I found were all about adding
-support for Google's reCAPTCHA.  I am not going to expose my users to Google's
-tracking like that, nor am I willing to actively discriminate against people not
-having Google accounts (reCAPTCHA is much more annoying if Google can't track
-you because you are not logged in), so reCAPTCHA was clearly not an option.
-Instead, the plan was to look at one of these patches and implement a simple
-question-and-answer CAPTCHA myself.
+subscription page.  Unfortunately, Mailman 2 itself only very recently (with
+version 2.1.26) gained support for CAPTCHAs, and even that just supports
+Google's reCAPTCHA.  I am not going to expose my users to Google's tracking like
+that, nor am I willing to actively discriminate against people not having Google
+accounts (reCAPTCHA is much more annoying if Google can't track you because you
+are not logged in), so reCAPTCHA was clearly not an option.  Instead, the plan
+was to look at one of the patches that add CAPTCHA support to older versions of
+Mailman and implement a simple question-and-answer CAPTCHA myself.
+
+**Update:** I previously claimed Mailman 2 does not support CAPTCHAs at all,
+  which turned out to be incorrect. **/Update**

 
 ### Keep It Simple
 
 
 ### Keep It Simple
 


@@ -42,9 +45,10 @@ have found my servers so far are much less patient than that, just setting
 spam.
 
 So, if you are reading this and running a Mailman installation: **Please set
 spam.
 
 So, if you are reading this and running a Mailman installation: **Please set

-`SUBSCRIBE_FORM_SECRET` and protect your setup against abuse!**  Just run `pwgen
-16` to get some random string, and then add `SUBSCRIBE_FORM_SECRET = "<random
-string here>"` to `/etc/mailman/mm_cfg.py`.  It's really that simple!  Just a
+`SUBSCRIBE_FORM_SECRET` and protect your setup against abuse!** Just run
+`openssl rand -base64 18` to get some random string, and then add
+`SUBSCRIBE_FORM_SECRET = "<random string here>"` to `/etc/mailman/mm_cfg.py`.
+It's really that simple!  Just a

 [four-line patch in my Ansible playbook](https://git.ralfj.de/ansible.git/commitdiff/937b170594be82e500ae726dc47de8ca9ef3dfcf)
 to get this rolled out to all servers.  Note that you need to be at least on
 Mailman 2.1.16 for this to work; all currently supported versions of Debian come
 [four-line patch in my Ansible playbook](https://git.ralfj.de/ansible.git/commitdiff/937b170594be82e500ae726dc47de8ca9ef3dfcf)
 to get this rolled out to all servers.  Note that you need to be at least on
 Mailman 2.1.16 for this to work; all currently supported versions of Debian come


@@ -53,7 +57,5 @@ with a recent enough version (if you use backports on Debian 7 "Wheezy").
 The more people do this, the more it will help to stop this kind of spam.  Or
 rather, it'll force the spammers to upgrade their game.  I assume eventually I
 *will* have to add a CAPTCHA.  Or maybe there is a simple and reliable way to
 The more people do this, the more it will help to stop this kind of spam.  Or
 rather, it'll force the spammers to upgrade their game.  I assume eventually I
 *will* have to add a CAPTCHA.  Or maybe there is a simple and reliable way to

-migrate to Mailman 3 before that happens---and maybe that will have a CAPTCHA.
-(Though, from a quick search, it doesn't seem like it does, which I find pretty
-surprising.  If my tiny servers are abused like this, I assume it's a really
-common problem and Mailman should protect against it per default.)
+migrate to Mailman 3 before that happens---and maybe that will have more
+reasonable CAPTCHA options, something beyond just reCAPTCHA.