Subject: [Tools-discuss] Datatracker authentication for Mailman?

From: Carsten Bormann <[email-masked]>
Date: Tue, 11 Jul 2017 10:06:44 +0200

After doing the secret handshake again of giving someone the mailman password for a mailing list, I wonder how hard it would be to make datatracker authentication available in mailman.

Disclaimer: I know nothing about mailman, so this request may be ridiculously hard to implement.

But if it is doable with a reasonable amount of work, I think it would improve both the security of the mailing lists (by allowing us to get rid of shared, hard to change passwords) and make life a little bit simpler for chairs and other mailing list maintainers.

Grüße, Carsten

---

From: Ted Lemon <[email-masked]>
Date: Tue, 11 Jul 2017 07:26:32 -0400

> But if it is doable with a reasonable amount of work, I think it would improve both the security of the mailing lists (by allowing us to get rid of shared, hard to change passwords) and make life a…

+1

I suspect that it's hard, though.   But mailman's security for ietf mailing lists is horrible: the only reason we haven't been burned by it yet is that nobody's interested in attacking it.

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 11 Jul 2017 15:34:58 +0200

On 2017-07-11 10:06, Carsten Bormann wrote:
> After doing the secret handshake again of giving someone the mailman
> password for a mailing list, I wonder how hard it would be to make
> datatracker authentication available in mailman.
> 
> But if it is doable with a reasonable amount of work, I think it
> would improve both the security of the mailing lists (by allowing us
> to get rid of shared, hard to change passwords) and make life a
> little bit simpler for chairs and other mailing list maintainers.

I think this makes sense, and would be valuable; but it probably should
be done based on Mailman 3, which is heavily refactored compared to
Mailman 2.  We already want to move to Mailman 3 in order to be able
to add EAI (RFC 6531) support.

Best regards,

	Henrik