Subject: Configuration change complete (was Re: Changes in using the global whitelist on IETF lists)

From: Robert Sparks <[email-masked]>
Date: Thu, 14 Apr 2016 16:52:46 -0500

The change to add @global-whitelist to each list's configuration is now 
complete.
(As mentioned on other threads, we held off making this change during 
the server upgrades and during IETF 95).

If you need to revert the change for any reason, use the mailman 
configuration interface to remove @global-whitelist from your list's 
accept_these_nonmembers setting.

Please let me know if you see any unexpected behavior from your list.

RjS

On 2/18/16 9:40 AM, Robert Sparks wrote:
>
>
> On 2/17/16 12:55 PM, Jonathan Lennox wrote:
>>
>>> On Feb 3, 2016, at 12:45 AM, IETF Chair <[email-masked]> wrote:
>>>
>>> For the last few months, several working group lists have been 
>>> utilizing a global-whitelist containing the full set of addresses 
>>> that are subscribed to or have been whitelisted for any mailman list 
>>> at ietf.org <http://ietf.org>. This is working well, and we will be 
>>> configuring all new mailing lists to use this global-whitelist by 
>>> default. We also plan to adjust the configuration of existing lists 
>>> to use the global-whitelist later this month.
>>>
>>> If you are an administrator of a mailman list at ietf.org 
>>> <http://ietf.org> and you do not wish your list's configuration to 
>>> be altered to use the global-whitelist, please send a note to 
>>> [email-masked] <mailto:[email-masked]> before February 
>>> 19, 2015 asking that your list configuration remain unchanged.
>>
>> Has this not yet been implemented (since it’s not yet February 19th),
> No, it hasn't been implemented yet.
>> or is [email-masked] 
>> <mailto:[email-masked]> not included in the global 
>> whitelist?
> That address is in the global whitelist.
>> I just had to manually approve a “milestones changed” e-mail from the 
>> datatracker.
> You (and any list maintainer) can set up use of the global whitelist 
> immediately if you want to.
> Just go put @global-whitelist in your lists' accept_these_nonmembers 
> configuration field on the Privacy options page.
>
> I expect it will be several days after the 19th before the remaining 
> lists are touched. I'll send a note when that happens.
>

---

From: "Black, David" <[email-masked]>
Date: Thu, 14 Apr 2016 22:41:02 +0000

Stupid question - did this just create an opportunity for a spammer to subscribe to one IETF list and send spam all of them ??

Thanks, --David

From: WGChairs [mailto:[email-masked]] On Behalf Of Robert Sparks
Sent: Thursday, April 14, 2016 5:53 PM
To: [email-masked]
Subject: Configuration change complete (was Re: Changes in using the global whitelist on IETF lists)

The change to add @global-whitelist to each list's configuration is now complete.
(As mentioned on other threads, we held off making this change during the server upgrades and during IETF 95).

If you need to revert the change for any reason, use the mailman configuration interface to remove @global-whitelist from your list's accept_these_nonmembers setting.

RjS

On Feb 3, 2016, at 12:45 AM, IETF Chair <[email-masked]<mailto:[email-masked]>> wrote:

For the last few months, several working group lists have been utilizing a global-whitelist containing the full set of addresses that are subscribed to or have been whitelisted for any mailman list at ietf.org<http://ietf.org>. This is working well, and we will be configuring all new mailing lists to use this global-whitelist by default. We also plan to adjust the configuration of existing lists to use the global-whitelist later this month.

If you are an administrator of a mailman list at ietf.org<http://ietf.org> and you do not wish your list's configuration to be altered to use the global-whitelist, please send a note to [email-masked]<mailto:[email-masked]> before February 19, 2015 asking that your list configuration remain unchanged.

or is [email-masked]<mailto:[email-masked]> not included in the global whitelist?
That address is in the global whitelist.

I just had to manually approve a “milestones changed” e-mail from the datatracker.
You (and any list maintainer) can set up use of the global whitelist immediately if you want to.
Just go put @global-whitelist in your lists' accept_these_nonmembers configuration field on the Privacy options page.

I expect it will be several days after the 19th before the remaining lists are touched. I'll send a note when that happens.

---

From: Michael Richardson <[email-masked]>
Date: Fri, 15 Apr 2016 11:40:55 -0400

Black, David <[email-masked]> wrote:
    > Stupid question - did this just create an opportunity for a spammer to
    > subscribe to one IETF list and send spam all of them ??

Yes, but given a robot to subscribe to lists, they already had that ability.
We've made it slightly easier, with the bonus to us that we get much better
cross-WG conversations.
I think we can still be spammed by forced From: headers; I'm unclear if IETF
mail servers are evaluating DMARC'ings to know what to do with DKIM failures.

Now: if only we had a way to do distributed email reputations.

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 15 Apr 2016 11:58:04 -0400

> Now: if only we had a way to do distributed email reputations.

If somebody is globally whitelisted by virtue of subscription to one 
list, will the whitelisting automatically be cancelled if he is blocked 
from posting on the list he subscribed to?

	Thanks,
	Paul

---

From: Robert Sparks <[email-masked]>
Date: Fri, 15 Apr 2016 14:52:41 -0500

On 4/15/16 10:58 AM, Paul Kyzivat wrote:
> list, will the whitelisting automatically be cancelled if he is 
> blocked from posting on the list he subscribed to?
No.

I could see some paths for automation, but we would want to consider 
that carefully against the policies we have in place for when it's 
appropriate to block posting rights.

If a problem with one address occurs, there are several things we can do 
with the current setup, but it will be manual.

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 15 Apr 2016 17:31:42 -0400

> with the current setup, but it will be manual.

I guess that will be good enough, until it isn't.

	Thanks,
	Paul

---

From: "Eggert, Lars" <[email-masked]>
Date: Mon, 18 Apr 2016 16:51:07 +0000

Ahem. It appears you also hit the irtf-announce list with this change, which was configured to let only a select number of people post?

You may want to check if there were other closed lists that are now de facto open...

Lars

---

From: Robert Sparks <[email-masked]>
Date: Mon, 18 Apr 2016 13:00:17 -0500

Ack - good catch and sorry for the inconvenience.

I've scrubbed the list of lists and removed global-whitelist from lists 
that are intended to have a restricted set of posters.

RjS