it's mailman time again

Sat Sep 2 07:57:58 UTC 2023

On Fri, Sep 01, 2023 at 10:16:05AM -0700, Randy Bush wrote:
> and i just have to wonder about sending passords over the net in
> cleartext in 2023.  really?

This is a non-issue.

Given that pretty much every SMTP connection is encrypted and that
the worst thing that an attacker in possession of one of your Mailman
passwords can do is unsubscribe you (in which case you and the list
manager will be notified, and you can solve the problem quite rapidly),
no, this isn't a problem that anyone needs to worry about.

I've run (and am running) a lot of mailing lists with Mailman including
some large-ish ones for what's now approaching 20 years.  The scenario
above has never happened.  Nobody's even tried, which isn't surprising
given that such an attack is increasingly difficult and yields little,
if any, benefit to the attacker.  Moreover, any hypothetical attacker
possessing the resources and expertise required to pull this off could
certainly find far more effective things to do.

---rsk