Debian mailing lists, address munging, news gateway, and the list archives
Hi everyone,
I'd like to do something about the situation we currently have
where people's email addresses are currently shown on both the list
archives, and on news. I have talked to a number of people about this
situation over the last few weeks, and I have not been able to find
any form of concensus through private discussions, hence, I'd like to
see what people here think. First part of this email is about address
munging in news, and the second part is about address munging in our
archives.
1. Address munging in news
A number of you will be aware that Marco d'Itri, currently
runs a set of mail <--> news gateways, that replicate everything which
is posted on some debian lists to usenet, and vice-versa.
I have recently talked to Marco about how much munging of
addresses should be done on the gateway between the two. Currently,
all emails go through basically unmodified as far as email addresses
go.
A little while back, the Swen virus/worm started making its
appearance. One of the ways in which Swen tries to spread is by
reading email addresses on usenet, and emailing those addresses a
message entitled something similar to "Microsoft security
update". Because of the news gateway, there is a 10-day window in
which all posters to a list which is replicated to usenet, will
receive those messages. If you check your email infrequently, this
rapidly becomes a problem as you get flooded with a number of viruses.
While the Swen virus is what provided my motivation to ask for
a change, I think that a solution is needed even after that virus is
gone. My main concern is that while most developers are able to cope
with a high influx of incoming emails, a number of people on
debian-user-* lists aren't. They either have hotmail or similar
accounts, or very restricted ISP provided accounts. If you are also on
a modem, downloading those viruses can be quite a problem. While there
are a number of technical solutions, most of them are beyond the
immediate reach of a new debian user.
As I see it, we have two solutions to this problem. We can
either munge all addresses in the "To", "From" and maybe "Reply-To"
fields, or stop mirroring the -user-* lists to usenet. Personally, I'm
in favour of munging all addresses in those three fields before they
go out on the news gateway, with an optional header which can be added
if people wish their headers to stay in the clear. I'd like this to be
done for all lists as well. Ideally, we would hide the address by
replacing the domain part of the email address with something along
the lines of "hidden.invalid". If we decide that no automatic munging
of email addresses should occur, we should seriously reconsider the
use of the news gateway on the user lists.
Marco believes that this is not acceptable, as it would make
the gateway less useful for searching, and more difficult to use. He
does not believe that it would be that useful.
People I have talked to about this subject, tend to vary
wildly in opinion about exactly what, if anything, needs to be
done. I'm looking for some sort of public yet polite discussion on
this topic. =-) *crosses fingers*
2. Address munging on list archives
This is related to part 1. Basically, people have complained
in the past about all email addresses being public in our list
archives. Should we attempt to hide or disguise addresses in some way?
What mechanisms if any should we provide for people to get email
addresses. Why should people be able to get someone's email address
from the list archives? I would like to know what people think about
this issue, if only so we can mark the related bugs on the BTS as
wontfix. ;-)
Cheers,
Pasc
Reply to: