ietf
[Top] [All Lists]

Re: mailing list memberships reminder -> passwords in the clear

2012-11-03 15:10:03
On 2 Nov 2012, at 21:51, John Levine <johnl(_at_)taugh(_dot_)com> wrote:
Only majordomo2, which has been unmaintained for a while now (and
it's author calls it "Dead" holds much of a chance, but I doubt it
?would work for the IETF in its current condition.

Actually, MJ2 works great, I've been using it in production for years,

I completely agree that it's excellent software.

but I agree that we'd need to locate a perl weenie willing to make
tweaks, and it's probably not enough better than MM to be worth the
pain of switching.

I think it's the difference between night and day, personally.  MJ2 is 
technically superior and emphasises the task of actually managing mailing lists 
in a very clean, black-box way.  OTOH, it seems clear that Mailman has won over 
all the web hosters and whatnot because it's "User-friendly".  I guess 
"Integrated with the web" is an adequate sell, even if it practically means 
"Has a simple, inflexible interface that's only accessible using a web browser 
from lynx up.  Certainly, the IETF could benefit from MJ2's more techie 
features (not least, the means to do absolutely everything by email).  
Moderators, in particular.  But it still boils down to having and using 
supported software.

Sadly this isn't possible with mailman; you will always be mailed
your password if you need it and can't remember it.

If you use a high value password for your IETF list subscriptions, you
have deeper security issues than a few tweaks to mail software can fix.

Unfortunately though, it happens quite often.  Users want all the benefits 
without any of the inconveniences.  So they use their 
easy-to-remember/crack/used-everywhere-else passwords.

Cheers,
Sabahattin