Subject: Global mailman whitelist

From: Robert Sparks <[email-masked]>
Date: Wed, 02 Sep 2015 09:36:28 -0500

You may recall the following from a thread on autosubscribing the IESG 
to working group lists back in June.
The lists that have been testing it have had good results.
Please consider using it for your lists if you aren't already.
--------

There is a mailman list that is now being maintained (updated nightly) 
to make whitelisting easier. It consists of the full set of addresses 
that are subscribed to or have been whitelisted for any other mailman 
list at ietf.org.

Its name is "global-whitelist".

Mailman supports the notion of whitelisting the subscribers of some 
other list using '@listname' in the whitelist addresses.

You can replace whatever you currently have in the 
'accept_these_nonmembers' field on the 'Privacy options' page of your 
list's configuration with '@global-whitelist' and then anyone who is 
subscribed to any ietf list will be be able to post to your list.

(The global-whitelist list is configured to never carry any list traffic 
- it's archive will always be empty - attempts to send to it are 
automatically dropped.)

RjS

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 2 Sep 2015 07:43:55 -0700

Have indeed been using this successfully for my WG mailing lists. Great
help. Thanks a lot. 

-- 
---
Toerless Eckert, [email-masked]

---

From: "Marc Blanchet" <[email-masked]>
Date: Wed, 02 Sep 2015 11:23:47 -0400

> subscribed to any ietf list will be be able to post to your list.

wonder if you guys should do that globally to all the lists.

Marc.

>
> (The global-whitelist list is configured to never carry any list 
> traffic - it's archive will always be empty - attempts to send to it 
> are automatically dropped.)
>
> RjS

---

From: Robert Sparks <[email-masked]>
Date: Wed, 02 Sep 2015 10:27:27 -0500

On 9/2/15 10:23 AM, Marc Blanchet wrote:
>> You may recall the following from a thread on autosubscribing the 
>> IESG to working group lists back in June.
>> There is a mailman list that is now being maintained (updated 
>> nightly) to make whitelisting easier. It consists of the full set of 
>> addresses that are subscribed to or have been whitelisted for any 
>> other mailman list at ietf.org.
>>
I don't think so - existing list managers should get to choose what 
policy they want to keep.
I do think it would be useful for it to be the default setting for new 
lists.

---

From: Julien Meuric <[email-masked]>
Date: Wed, 2 Sep 2015 18:07:30 +0200

Hi Robert,

Please correct me if I am wrong, but this looks like compromising just 
one list (e.g, wrong human approval, weak administrator password, etc) 
enables to flood any list configured with @global-whitelist. Would it 
not be safer to turn the IESG mail alias into an iesg-whitelist to 
achieve the expected feature?

Thanks for this work on feature enhancement,

Julien

---

From: Robert Sparks <[email-masked]>
Date: Wed, 02 Sep 2015 11:16:26 -0500

On 9/2/15 11:07 AM, Julien Meuric wrote:
> enables to flood any list configured with @global-whitelist. 
Yes. But taking corrective action if that happens is simple.
> Would it not be safer to turn the IESG mail alias into an 
> iesg-whitelist to achieve the expected feature?
The conversation _started_ with whitelisting the IESG, but it did not 
end there. This addresses the common issue of whitelisting reviewers on 
various review teams, invited cross-area/cross-group participants, and 
similar groups of people.

---

From: Tim Wicinski <[email-masked]>
Date: Wed, 2 Sep 2015 12:23:20 -0400

Thanks Robert, I've give this a try.  What it did do was make me revisit 
the 'automatically accepted' member list for DNSOP - which is literally 
like a walk back through time.

tim