November 2003 - clo-devel - mailman3.common-lisp.net

Re: [clo-devel] Re: [lists] Re: Re: Payment Past Due, account
by Erik Enge 18 Nov '03

18 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > How does mailman work, If it recieves mail the same way user mail is > delivered, then it should be trivial to pipe it through a spam filter > and procmail along the way. Then procmail could isolate spam and send > normal messages along their merry way. That is true but one of the things I do like with the solution I came up with for the place I work is that the spamchecking is done at SMTP-time and if it is judged to be spam it gets rejected there; no collateral spam via bounces etc. Erik.

5 14

Re: [clo-devel] Project proposal (Handling Spam
by Erik Enge 17 Nov '03

17 Nov '03

Mario Mommer <mommer(a)igpm.rwth-aachen.de> writes: > Maybe we should make clear in a case like this that it is just a > comment and that approval won't depend on accomodating it [...] That sounds like a fine idea. Erik.

1 0

Re: [clo-devel] Project proposal (Handling Spam
by Erik Enge 17 Nov '03

17 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > Now back to the subject since we talked about it, I'd like to start a > project "cl-bayes" that will be a Bayesian Patter filtering library. What license would this be released under? Erik.

2 1

Re: [lists] Re: [clo-devel] Getting clhp installed on Apache
by Erik Enge 14 Nov '03

14 Nov '03

Nikodemus Siivola <nikodemus(a)random-state.net> writes: > Erik? If he wants to put his neck on the line then I think we should let him. :-) If clhp is too much of a strain on the server I'll take it down and perhaps months down the line when he's come up with a better way I'll let him try it out again. We're here to help CL developers and I think we should try our best to do exactly that. Now, you're right that we shouldn't bend-over backwards for everyone and their needs but this one seems fairly harmless. If the server halts because of a full disk or CPU grinding then that's what happens and I'll be very reluctant to try out clhp again. Anthony feels pretty secure that this won't happen so I'm willing to chance it. That said, this is not really a dictatorship so if the two of you want to outvote me, you can. :-) > Like Mario pointed out, this is why chrooting is *vital*. It's not > about trust, but about security and robustness. And I'd add "running > as nobody" and "cmhod -R o-w" to the list. ;) Anthony, what they are pointing out are likely to be requirements in a production scenario, anyway. Is there a way to make sure that clhp pages do not have access to files outside it's directory structure? Erik.

4 3

Re: [lists] Re: [clo-devel] Getting clhp installed on Apache
by Erik Enge 14 Nov '03

14 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > I've documented it pretty well in the INSTALL file, basically we need > cmucl, asdf, apache, gcc and apxs (for building the module) apxs is > part of apache, with the Debian system you'll need to $ apt-get > install apache-dev to get apxs. Ok, looks fairly straightforward. Any risk of this eating up all CPU or something like that? Erik.

3 4

[clo-devel] Getting clhp installed on Apache
by Anthony Ventimiglia 14 Nov '03

14 Nov '03

I don't know if I should direct this here or to admin, but it seems most of you read both lists. Anyway, when I first got CLHP started, I asked if you guys would be willing to install it on the common-lisp.net server. I didn't want to install it until the Apache module was working, and that time has come. So I'd like to know if we can install it, so I can actually use it for the clhp home page? -- (incf *yankees-world-series-losses*)

3 3

Re: [clo-devel] Re: [lists] Re: Re: Payment Past Due, account
by Erik Enge 13 Nov '03

13 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > Um er "Package" in Lispspeak Actually, no. Look at Franz' FTP server (opensource.franz.com) which is most definitely a package but hardly a library. Much better would it have been if Franz wrote an FTP server library and then wrote their FTP server on top of it. Then, if I thought they approach on the FTP server was poor and wanted to do it differently I wouldn't have to implement the library all over again. In Lisp the technical difference between application and library is certainly less clear than in (for example) C but the programmer still have to think about how others will his software for it to become a good library. > Well now you've given me incentive. The Bayesian end is pretty much > complete, And writing a working filter should be pretty easy. I want > to give it a HTTP frontend (via clhp) to make control easier, kind of > like the way Popfile works, I could make the filter work as a daemon, > which would filter every message that comes in and add an extra header > indicating the "Classification" (Bayesian filter allow for more than > just Spam and non-spam). Then you could use procmail to filter based > on the header. I don't know how it would integrate so if you could > give me some insight, I could design it to fit. We use Exim at the moment and /etc/aliases to shovel mail into Mailman. I think Exim has some features to redirect messages into your software and then back out again. Erik.

2 1

Re: [clo-devel] Re: [lists] Re: Re: Payment Past Due, account
by Erik Enge 13 Nov '03

13 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > I have been slowly converting my C++ library to Lisp, which I'll > eventually bring here. Excellent. Be sure to make it a library. :-) Once you've done that, perhaps I could see if there's any way to use it for common-lisp.net. Erik.

2 1

Re: [clo-devel] Getting clhp installed on Apache
by Erik Enge 13 Nov '03

13 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > So I'd like to know if we can install it, so I can actually use it for > the clhp home page? What would an install require? Erik.

2 1

Re: [clo-devel] Re: [lists] Re: Re: Payment Past Due, account
by Erik Enge 13 Nov '03

13 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > I don't know what kind of filtering rates Spamassassin gets, but the > Bayesian filter I use (PopFile) has a success rate over 98%. The biggest problem I have here is that I get false positives when I set the this-is-spam score lower than four and most spam I get is between three and four. Erik.

3 2

Re: [clo-devel] Re: [lists] Re: Re: Payment Past Due, account
by Erik Enge 13 Nov '03

13 Nov '03

Ivan Boldyrev <boldyrev+nospam(a)cgitftp.uiggm.nsc.ru> writes: > Spamassassin now supports bayesian filtering too. I use that at work but I don't find it to be terribly helpful. Plenty spam still come through. > Ah!.. I read list with Gmane newsgate... That is the downside, yes. However, if people who do post are not subscribed to this list I promise to be quick and add a filter to let them through. Of course, you can subscribe to the list and turn of delivery and then you can post freely. Erik.

2 1

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 12 Nov '03

12 Nov '03

Anthony Ventimiglia <anthony(a)ventimiglia.org> writes: > Sounds great, how will we handle signing of those of us that are > already members ? So far I have just asked that you upload your keys to your home directories. Once most/all have done that (only 25% or so have done this so far) I will send an encrypted/signed mail to your email account and expect you to decrypt and send it back to me. Not perfect but I can't think of a better way now that we are in this situation. Erik.

4 6

Re: [clo-devel] Re: Payment Past Due, account
by Erik Enge 12 Nov '03

12 Nov '03

"Alvaro Miles" <qnhfla17ln(a)yahoo.com> writes: > [snip spam] Ok, that's not fun. Our options: a) install spamassassin in which case it doesn't work very well and we'll still get spam every now and then, b) just let it keep pouring in, or b) close the list to non-subscribed traffic. What do you think? Erik.

4 3

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 11 Nov '03

11 Nov '03

Marco Baringer <mb(a)bese.it> writes: > which means that _i'll_ trust common-lisp.net's key, but i was > wondering about people who aren't developers on common-lisp.net. It's my understanding that here's where the "web of trust" is supposed to help. If common-lisp.net verifies plenty keys, then those keys verify it, then prehaps the chances of you knowing someone who has verified it (directly on indirectly) are growing by each developer added to common-lisp.net. Are there any other ways of doing it? Since you now only have one key you must trust it should be easier to find out if it has been hijacked. You have all of common-lisp.net you could call on the phone to verify the key, you could send emails, you could stop by #lisp. None of these are absolutes but I could think they help? Erik.

1 0

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 11 Nov '03

11 Nov '03

Marco Baringer <mb(a)bese.it> writes: > ok, so this "guarntees" that the key belongs to whevere has access to > that account (which is good), but how do you get people to trust > common-lisp.net's key? am i missing something simple? I'm guessing that when you send me your public key to register for a project and I reply with your password in an encrypted email (signed with the common-lisp.net key), you import the common-lisp.net key and sign it and then use it to verify the keyring whenever you need to. Does that sound like a plan? We should also publish it's fingerprint on the website. Erik.

3 2

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 11 Nov '03

11 Nov '03

Mario Mommer <mommer(a)igpm.rwth-aachen.de> writes: > Some redundancy would certainly be good. In case something bad happens > we would have to hack your box to run the site, btw. Good point. I will tell you and Nikodemus the root password plus the passphrase for the common-lisp.net private key (once I've created it). Should we also perhaps distribute a key-revocation certificate for the common-lisp.net key just in case it gets out in the wild? Erik.

2 1

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 11 Nov '03

11 Nov '03

Nikodemus Siivola <nikodemus(a)random-state.net> writes: > Need To Know Basis, of course. As long as you're willing to shoulder > the signing, no-one else needs to know. If you think you need help, > then someone else as well. I don't think I need help but if I get hit by the bus you're out of luck. I think perhaps telling a couple of you will be appropriate. How's this for the website: We want users and developers who download software from this site to have a way of verifying that what they just downloaded is indeed what the author uploaded and that the author who uploaded the software indeed is the author they think he is. This will help in preventing trojaned software to spread. For the user to verify a software package (usually a tarball or a zip file), the author will need to sign said package use his <a href="http://www.gnupg.org/">GPG</a> (or <a href="http://www.pgp.com/>PGP</a> or similar technology) private key. (For details on how to do this, check out the GnuPG site, for example, which has several howto's and other useful documents.) Once the package has been signed, the user can then download the package pluss the author's public key and verify that the public key at hand signed the package he or she just downloaded. The weak link is of course that the user doesn't know if the public key is the author's or not. Here's where our signing policy comes into play. When developers apply for a project at common-lisp.net they receive their passwords encrypted (by mail) and if they successfully decrypt and answer the email, their public key will be signed by the common-lisp.net keymaster. Thus, the users will have a means of verifying that they have the correct key. Poorly worded but does this capture our intent? Erik.

5 4

[clo-devel] Terminated Account
by Billy Fountain 10 Nov '03

10 Nov '03

1 0

[clo-devel] Re: Payment Past Due, account
by Alvaro Miles 10 Nov '03

10 Nov '03

1 0

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 07 Nov '03

07 Nov '03

Kevin Rosenberg <kevin(a)rosenberg.net> writes: > I'd recommmend keymaster(a)cl.net and have a web page which describes > the criteria for a key to be signed by the keymaster key. (I'd reserve > you signing keys with your personal key for those owners with whom you > meet in person and look at their photo id. It looks like this is the best approach. Since I'm not the most experienced with these things around here, I'll ask: do we want the key to just sign (no password) or to sign and encrypt/decrypt (then we need a password, if I understand correctly)? Erik.

3 2

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 07 Nov '03

07 Nov '03

Nikodemus Siivola <nikodemus(a)random-state.net> writes: > Imagine: somehow the key gets stolen. Now the purveyor of the key can > sign stuff as Common-lisp.net, including keys of maliscious package > authors, which people will then install and run because the author's > key was trusted by Common-lisp.net... Ok, good point. So, who gets to know the key, then? Erik.

2 1

[clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 06 Nov '03

06 Nov '03

Kevin Rosenberg <kevin(a)rosenberg.net> writes: > Did I understand correctly that you'll be signing public keys that are > used are the common-lisp.net server? Yes. > If so, are you planning on signing them with your personal key or an > administrative, common-lisp.net key? Good question. What say you others? I think it sounds like a good idea to have an administrative common-lisp.net key. Erik.

2 1

Re: [clo-devel] Re: Please upload your public GPG key to common-lisp.net
by Erik Enge 06 Nov '03

06 Nov '03

Erik Enge <erik(a)nittin.net> writes: > Good question. What say you others? I think it sounds like a good > idea to have an administrative common-lisp.net key. Noone has disagreed with this so I'm going to assume they agree. What would be appropriate for this key with regards to real name and email address? "Common-Lisp.net Administrative Key" and "admin(a)common-lisp.net" perhaps? Erik.

3 4

[clo-devel] "authentication"
by Erik Enge 05 Nov '03

05 Nov '03

How do you know that packages left on common-lisp.net and signed with my key are really signed by me when you install them on your system? A slightly edited discussion on #lisp: <emarsden> it might be worth having common-lisp.net be a certificate authority, that issues X509 certificates for the software that it hosts (and other trusted sources). Pyramid of trust rather than web, easier to get into for newcomers <kire> emarsden: sounds like a fine idea. <dan`b> well, the question for cl.net is "by signing this key, what are we saying about its owner, or the software he uploads?" <kire> my respons would be: we say nothing except that we believe this key belongs to the publisher of that piece of software <dan`b> not that I'm altogether convinced by the debian approach either of signing when you have some mestspace proof that the person is who they say they are <dan`b> because usually it's the net.persona that you're interested in <emarsden> you're saying "this tarball has been signed by someone who's known to cl.net" <emarsden> which avoids the "someone modified cliki.net to point to a nasty tarball" problem <dan`b> kire: the interesting question to the end-user is "did this package come from someone with a cl.net account" <dan`b> so how much authentication do you do before giving accounts on cl.net out? <kire> dan`b: none, really. <emarsden> yes, "is trusted sufficiently to have an account" is fine <emarsden> the barrier to entry should be low, otherwise people will just work around the certificate check <kire> emarsden: yes, it must be made very straightforward. <dan`b> though in fairness to the cryptohippies, I would probably sign them as "partially trusted" not "fully trusted" if it's just "trusted sufficiently to have an account" <dan`b> so, for the cl.net application procedure, you ask people to send you signed mail to apply <dan`b> and you send the inital username/password etc details encrypted to that same key <dan`b> then you know that the cl.net user is the owner of the gpg key, and you can sign the key in question What do you guys think? Personally, I'm all for it. Erik.

3 2