|
|
Log in / Subscribe / Register

A preview of HyperKitty's reimagined mailing list interface

By Nathan Willis
April 30, 2014

The first beta for version 3 of the GNU Mailman suite was released on April 24. The upcoming version of the mailing-list management program will bring a host of new features, among them a completely new web-based front end called HyperKitty that is designed to bring list archiving up to modern user-interaction standards. HyperKitty looks more like a web discussion forum than Mailman 2's list-of-links archive pages, and it integrates better with other web applications, all while retaining the features expected of mailing lists.

Although it is difficult to calculate the precise deployment numbers, GNU Mailman is so widely used as a mailing-list manager that it scarcely has any competition, particularly among free-software projects. Years ago, mailing-list management was dominated by the proprietary LISTSERV and Majordomo. Mailman quickly won over a lot of converts after its debut in the late 1990s, although it has not had a major update in several years. Recently, Mailman has seen stiff competition from a different angle: web-based discussion forums. Between bulletin-board forum packages like phpBB and self-contained sites like Reddit and StackExchange, email-based discussions have lost noticeable ground in recent years in many places.

The reason for such a shift is up for debate; perhaps some users loathe the email-driven sign-up process required to join a discussion, perhaps others prefer to intentionally visit a site rather than be bombarded by replies delivered straight to the inbox. But many people, including those in the Mailman project, seem to agree that the web front-end to Mailman 2 offers an experience far less comfy than that of most web forums: plain-looking and hard-to-navigate archives, less-than-smooth handling of threads, the inability to reply from the web interface, and a number of missing features that—for better or worse—users have come to expect (such as user profiles and rating messages up or down).

Mailman's current archiver component, Pipermail, also suffers from some serious technical limitations. It does not integrate easily with other web frameworks, it offers weak protection against email-address harvesting, it does not scale well, and archived messages do not have stable URLs. Lack of stable URLs means that if the archive needs to be regenerated (or indeed if some other administrative actions like message deletion need to be taken), the existing URLs break, causing consternation to search engines, bookmark users, and third-party applications.

More modular mail machines

The architecture of Mailman 3 splits the application into a core module that communicates with other applications through a REST API. The two applications bundled with the core are the list-administration interface Postorius and HyperKitty, the new archiver front-end. However, either component could be replaced in a specific Mailman deployment, so that admin or archiving functionality could be built directly into some other web application or framework. Despite such flexibility, of course, the Mailman project has set out create the best archiver that it can, which can be seen in HyperKitty's new feature set and its user interface.

[HyperKitty lists]

Work on HyperKitty started in early 2012. Much of the front-end implementation stems from design work spearheaded by Máirín Duffy, while backend development has come from developers at Red Hat and several Google Summer of Code students. HyperKitty includes a Django application with a Bootstrap-based user interface, plus a storage backend called KittyStore (which can run on PostgreSQL, SQLite, or MySQL).

KittyStore provides stable URLs for archived message pages, since Mailman 3 generates the URL for each message based on the RFC 2822 Message-ID header, which is designed to be globally unique. Unique, stable URLs offer some advantages beyond simply not breaking every now and then. For example, they can be pre-computed based on the Message-ID header, so Mailman can insert a permanent link into the message footer when it is sent out to the list recipients. For that purpose, Mailman 3 uses the Archived-At header format described in RFC 5064.

In addition to the message archives themselves, KittyStore tracks basic user profiles for subscribers, including a simple "reputation" that counts up and down votes registered by the community on the author's posts. It also provides full-text search capabilities (which Pipermail did not) via the Whoosh library. That not only removes the need for lists to bolt on a site-specific Google search widget, but it allows private lists to be searchable by their subscribers.

The hyper experience

The visual makeover updates the aging basic-HTML look of Pipermail, but it, too, adds functionality. A demo server is running on the Fedora infrastructure with mirrors of the distribution's mailing lists; it is a good place to see the new interface in action. The server overview page allows searching and filtering through the hosted lists and displays a sparklines-style graph of each list's recent activity.

[HyperKitty list page]

The bigger changes, however, are found beginning in the individual list archive pages. Statistics are provided for each list, including the most recent and most popular threads and the most active posters. By default, HyperKitty gives each thread its own page (as opposed to one page per message in Pipermail), though there is a permalink for every message. The thread rendering is reminiscent of Gmail or the commenting systems in WordPress and other blogs; it shows the sender's name and an avatar image at the top of every message (as opposed to the sender's email address), indicates the number of up and down votes, shows attachments with a paperclip icon, and includes a "Reply" button at the bottom.

Obviously, list subscribers can already reply via their email client, but HyperKitty allows them to respond through the web interface as well, first authenticating them against the Mailman server. But HyperKitty can also let new users reply to messages in the web interface: unsubscribed users are prompted to subscribe to the list when they click on the "Reply" button. Naturally, it is important for list administrators to clearly explain the implications of subscribing to the list; to users not proficient with mailing lists, however, the sign-up process closely resembles that used by most other forum software.

[HyperKitty thread]

HyperKitty also attempts to provide navigation elements on each thread page that are easy to find but do not overpower the message content. There is a breadcrumb-style header on the top of each page (leading to the list home page, monthly archives, and back up to the overview of all lists), plus "Newer thread" and "Older thread" links that include a preview of each thread subject. There is also work underway to tag or categorize threads, although how useful that feature is remains unclear on a demo server. HyperKitty also tracks which threads a browser has visited, so users can easily see read and unread threads.

Future cats

Improving mailing list archives is a multi-faceted problem—even the major features discussed above can sometimes be in conflict. For example, the stable URLs of a HyperKitty archive include a lengthy Base32 hash derived from the message headers. Though it does not change, it is more difficult to remember than Pipermail's simple "1234.html"-style URLs. It is also certainly possible that some list administrators and subscribers will have no interest in web-oriented features like user-profile pages and up/down voting.

On the whole, though, HyperKitty looks far better than Pipermail, and not just in the aesthetics of the theme. Small touches make it more readable, like highlighting just the sender's name on each message, rather than showing multiple email headers and several lines of links back into the archive pages. Better default settings, such as one-page-per-thread, reduce the amount of time that a user has to spend clicking and waiting for pages to load. Statistics are not the most popular things in the universe, but by keeping them unobtrusive on the page, they manage to be helpful. And in the long run, improving the look of the web archiving component is not merely a cosmetic alteration: it makes the software—and the mailing list—more useful to the users.

Perhaps the ultimate test of HyperKitty's usability would be whether it actually makes Mailman seem friendly enough that users who prefer web discussion forums are comfortable reading and replying through it. After all, the free-software community has long grappled with the segmenting of discussions into separate silos; removing some of those obstacles would be a feat. Then again, what makes HyperKitty possible is Mailman 3's REST API; it the long run, perhaps Drupal, Joomla, MediaWiki, and other popular web applications will simply develop their own Mailman integration and the day will come when email-only discussions are a historical novelty.

There are other free-software list efforts, such as Groupserver, intent on modernizing the usability of mailing lists and there are other discussion-forum projects, such as Discourse, intended to provide a alternative to the current integrate-with-Facebook (or Google) option so many web sites seem to be opting for. If luring site maintainers away from proprietary web services for their discussion threads is the goal, there are several options.

If revamping a mailing list's user experience is the goal, though, Mailman 3 with HyperKitty is clearly a big step in the right direction that many list administrators will welcome. Mailman 3 has been in development for years; although there is no set timetable for when it will be declared stable, it looks like an update worth talking about.


to post comments

Trusting user-supplied data...

Posted Apr 30, 2014 15:57 UTC (Wed) by dskoll (subscriber, #1630) [Link] (17 responses)

...Message-ID header, which is designed to be globally unique...

I hope HyperKitty has defenses against attackers who deliberately re-use a Message-ID in the hopes of disrupting the archive... this seems dangerous to me.

Trusting user-supplied data...

Posted Apr 30, 2014 16:00 UTC (Wed) by dskoll (subscriber, #1630) [Link] (2 responses)

This page says that " Breidenbach of The Mail Archive did some analysis of their very large corpus of messages and makes a convincing argument that Message-ID is unique enough to rely on in the real world."

That may be true currently, because attackers have little incentive to duplicate Message-IDs. But if the Message-ID becomes a trusted piece of data for locating a specific message, that could change.

Trusting user-supplied data...

Posted Apr 30, 2014 17:17 UTC (Wed) by tzafrir (subscriber, #11501) [Link] (1 responses)

The Debian Lists archive allows searching by a message ID. As you can see from the examples, it does not assume a message ID is unique:
https://lists.debian.org/msgid-search/

Trusting user-supplied data...

Posted Apr 30, 2014 17:21 UTC (Wed) by dskoll (subscriber, #1630) [Link]

Yes, but unless I'm missing something, HyperKitty does assume Message-IDs are unique.

The safest way to have stable URLs is to generate a random string, concatenate a sequence number, and put the result in an X-Archive-Id: header in the message and store the message with that header in the archive (and include the header in all remailed copies.)

That way, the archive identifier is completely under the control of the mailing list software and not the message originator.

The downside is you can't auto-generate links based on the References: or In-Reply-To: header, but you could map Message-IDs to archive IDs. If you see a given Message-ID more than once, you treat it as contaminated and don't use it to generate links... this minimizes what an attacker can do.

Trusting user-supplied data...

Posted Apr 30, 2014 19:05 UTC (Wed) by hmh (subscriber, #3838) [Link] (13 responses)

I sure hope mailman will reject any messages that arrive with a duplicated message-id. Or bounce it with an error message (properly rate-limited -- this is a backscatter source of the largest sort).

And that error handling path better work, and work well. Different messages with duplicated message-ids sent to the same mailing list is something that will happen, and it won't be rare, either.

Not only duplicate message-ids are an easy attack vector, but they're also a common bug. For example, we've observed it happening with Microsoft Outlook 2010 (no idea if this bug was fixed in later versions): it will sometimes fail to generate unique message-ids when the user replies to a message.

Trusting user-supplied data...

Posted May 1, 2014 7:18 UTC (Thu) by dlang (guest, #313) [Link] (12 responses)

how long should mailman be on the lookout for a duplicate message ID?

should it be able to detect a duplicate ID that arrived several years ago? if not, why not? it would have the same problem

If so, do you realize the size of the database that needs to be maintained (and the cost of checking it) for ever new message?

Trusting user-supplied data...

Posted May 1, 2014 10:28 UTC (Thu) by smurf (subscriber, #17840) [Link]

What cost? message IDs are not exactly long, and indexing them does not exactly consume a whole lot of space.

If you archive these messages anyway, an additional unique index on the msgid is dirt cheap.

Trusting user-supplied data...

Posted May 1, 2014 12:27 UTC (Thu) by hmh (subscriber, #3838) [Link]

Yes, I do. And the lifetime rules are pretty much "for as long as the archived data that depends on that uniqueness lasts".

Which is why I consider the use of message-ids as archival ids *with an uniqueness requirement* to be a design error. Never mind the RFCs require message-ids to be unique, this simply does not hold in practice, not even for requirements with a lifetime measured in days (duplicate supression).

Trusting user-supplied data...

Posted May 1, 2014 13:11 UTC (Thu) by dskoll (subscriber, #1630) [Link] (9 responses)

If so, do you realize the size of the database that needs to be maintained (and the cost of checking it) for ever new message?

If you wish to allow searching by Message-ID, you need to index them anyway.

Let's assume a busy mailing list that gets 1000 messages/day and a 20-year archive. That's about 7.5 million messages. If we generously allow 128 characters as the average Message-ID and assume 300% index overhead, the index file would be under 3GB which is not very large for a database and can easily do extremely quick checking for duplicates if implemented properly.

Anyway, the point is... Message-ID: is not a good choice for a unique message identifier. It's under the control of potentially malicious clients.

Trusting user-supplied data...

Posted May 2, 2014 14:31 UTC (Fri) by ms-tg (subscriber, #89231) [Link] (8 responses)

> Anyway, the point is... Message-ID: is not a good choice for a
> unique message identifier. It's under the control of potentially
> malicious clients.

I am assuming that there is an implied exploit here:
1. Send a bunch of emails with duplicate ID's but different content
2. ??

Am I correctly understanding what this comment, and others, are saying?

Trusting user-supplied data...

Posted May 2, 2014 14:47 UTC (Fri) by hmh (subscriber, #3838) [Link] (7 responses)

It is not only utterly easy to cause message-id colisions on purpose, it will also happen quite often due to defects in very commonly used email user agents.

Trusting user-supplied data...

Posted May 3, 2014 8:27 UTC (Sat) by rsidd (subscriber, #2582) [Link] (6 responses)

Yes, but what's the exploit here?

Trusting user-supplied data...

Posted May 3, 2014 13:37 UTC (Sat) by NAR (subscriber, #1313) [Link]

Quite far fetched scenario, but
1, let's suppose there's a highly useful message on a mailing list (e.g. about enabling non-threaded view of messages in gmail). This message contains a link to "log in to gmail". It is so highly useful, that many people link to it and eventually Google will show it first for some search terms.
2, bad guy sends a message with the same Message-ID and same contents, except that "log in to gmail" link points to his server (phising(?) attack). This message replaces the original good message in the archives, so when new google searches provide the message, the users get the wrong link. They might get surprised that google asks for their password again, but if they type it, the bad guy gets their password...

Trusting user-supplied data...

Posted May 3, 2014 13:52 UTC (Sat) by dskoll (subscriber, #1630) [Link] (4 responses)

The exploit is being able to replace the content of an archived message with your own content.

For example, let's say on a security mailing list, someone posts a critical patch for an important piece of software. And an attacker posts an alternate version of the patch that leaves a hole open. Anyone searching the list archive for the patch will get the bad patch instead of the good one.

Trusting user-supplied data...

Posted May 3, 2014 14:20 UTC (Sat) by rsidd (subscriber, #2582) [Link] (3 responses)

Being able to replace a message is indeed bad. I didn't read carefully enough to notice that, I guess. I assumed that either all messages would be shown, or, in searching by message-id, one (presumably the first) would be shown.

Trusting user-supplied data...

Posted May 5, 2014 22:19 UTC (Mon) by anguslees (subscriber, #7131) [Link] (2 responses)

... So if the archive discards later duplicates (rather than overwrites earlier entries), have we addressed this issue? (Are there muas with predictable message ids that are worth attacking in this way?)

Trusting user-supplied data...

Posted May 5, 2014 22:22 UTC (Mon) by dlang (guest, #313) [Link]

I don't know specific names, but given the horrific problems I've seen in this area, I'd bet that there are MUAs that do have predictable message IDs

worth attacking? that depends who uses them.

Trusting user-supplied data...

Posted Jan 13, 2018 14:40 UTC (Sat) by cjwatson (subscriber, #7322) [Link]

Looking at the code, it seems reasonably clear that HyperKitty will discard later duplicates.

A preview of HyperKitty's reimagined mailing list interface

Posted Apr 30, 2014 16:15 UTC (Wed) by dw (subscriber, #12017) [Link] (3 responses)

It seems the ability to download plain mboxes has been removed, thus negating one of the chief benefits of hypermail over just about any other system (in particular Google Groups). I hope this feature returns before a final release happens

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 13:09 UTC (Thu) by hmh (subscriber, #3838) [Link]

"Download as mbox" or alternatively "download as maildir" are basically the "liberate the community data" and "allow fast local mirrors of the archive" functionality for email mailing lists... If it doesn't have that, it is a show stopper as far as I'm concerned. Maybe a plugin can fix that, but it is best implemented well integrated with the archive web interface.

Also, that simple "like/dislike" reputation bling can be actively harmful and needs to be optional per-list (and waste no resources when disabled). Maybe it is already implemented like that.

This might actually be personal preference bias, but IMO the new web interface looks way too complex and full of useless information (i.e. high noise), it has indirections that get in the way of getting work done, and it has too low information/screen density.

Also, it may well be too complex for casual users.

A preview of HyperKitty's reimagined mailing list interface

Posted May 3, 2014 23:08 UTC (Sat) by BenHutchings (subscriber, #37955) [Link]

Even today, those mboxes are usually corrupted (stripped attachments, mangled email addresses).

A preview of HyperKitty's reimagined mailing list interface

Posted Jan 13, 2018 14:29 UTC (Sat) by cjwatson (subscriber, #7322) [Link]

I realise this is thread necromancy, but I thought I'd note that export-to-mbox was added in HyperKitty 1.0.3 (2015-11-15). It looks like you can filter by date range, thread ID, or message ID.

A preview of HyperKitty's reimagined mailing list interface

Posted Apr 30, 2014 17:02 UTC (Wed) by johannbg (guest, #65743) [Link] (19 responses)

Hyperkitty has incorrectly implemented like/dislike system...

like/dislikes

Posted Apr 30, 2014 18:16 UTC (Wed) by louie (guest, #3285) [Link] (2 responses)

Incorrectly implemented? Want to elaborate constructively? Or point us at a bug you've filed? :)

like/dislikes

Posted May 2, 2014 14:18 UTC (Fri) by johannbg (guest, #65743) [Link] (1 responses)

The like/dislilke should be implemented based on personal preference not controlled by majority...

like/dislikes

Posted May 2, 2014 18:00 UTC (Fri) by jwakely (subscriber, #60262) [Link]

Advogato's diary ratings got that right, based on its trust metric: http://advogato.org/trust-metric.html

A preview of HyperKitty's reimagined mailing list interface

Posted Apr 30, 2014 20:10 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

Have you tried disliking the like system?

(It's why I refuse to use Farcebook's system.)

A preview of HyperKitty's reimagined mailing list interface

Posted Apr 30, 2014 21:29 UTC (Wed) by viro (subscriber, #7872) [Link] (14 responses)

As in "implemented at all"? Like button: because there are those for whom even "me too" is too taxing, let alone the effort needed to contribute something to conversation...

A preview of HyperKitty's reimagined mailing list interface

Posted Apr 30, 2014 22:47 UTC (Wed) by mattdm (subscriber, #18) [Link] (13 responses)

It means "I don't have anything additionally valuable to contribute to this conversation, but I value this post someone else made". This is significantly better than "me too" posts, because those are mixed in with the actual discussion and mostly just add noise.

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 2:54 UTC (Thu) by liam (guest, #84133) [Link]

+1

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 11:43 UTC (Thu) by andyp (subscriber, #48701) [Link] (3 responses)

The problem with upvote/downvote/karma systems is that they allow a majority mindset to establish and stay established. Just look at the circle-jerks on Hacker News and Reddit (where clever algorithms have had to be tacked on especially to try to reduce the effects of group-think). Everyone with a slightly different point of view to the established clique gets downvoted, and downvoted messages are more likely to attract more downvotes. People don't click anonymous upvote/downvote buttons because of reasoned, civil thought, they do it as a deep, primal, emotional, self-centred reaction. They might do it because $famous_person or $alpha_person did. They don't think "does this add objective value to the conversation?" they think "do I agree with this? Does this person's literacy meet my standards? Do they use C or C++? Do they use emacs or vim? Down with their opinions!" People are awful. Giving them downvote buttons only enables their awfulness.

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 12:05 UTC (Thu) by mattdm (subscriber, #18) [Link]

Yeah, so don't rely on them exclusively. I also like Stack Exchange's model of having a cost for downvotes. (That's a different system than a discussion list, though, so not all of the same things apply.)

A preview of HyperKitty's reimagined mailing list interface

Posted May 6, 2014 1:25 UTC (Tue) by duffy (guest, #31787) [Link] (1 responses)

The point behind having like/dislike in the system was as others have said - basically, to try to eliminate 'me too' or negative posts that only serve to voice disagreement without productive suggestions for improvement.

That being said, I think there may be some merit into the personal like/dislike system that Johann mentioned and the advogato system, so we could look into those and see if it'd be possible to switch mechanisms.

A preview of HyperKitty's reimagined mailing list interface

Posted May 6, 2014 13:35 UTC (Tue) by duffy (guest, #31787) [Link]

PS here's an RFE I filed for looking into this:
https://fedorahosted.org/hyperkitty/ticket/68

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 17:26 UTC (Thu) by viro (subscriber, #7872) [Link] (7 responses)

Pardon my bluntness, what is the value of information that $N wankers with nothing to contribute had found $POSTING gratifying? If somebody can't be arsed to back their opinion by evidence, or at least by some attempt at arguments, that opinion is worthless by definition. AFAICS, the only possible use for such information is data mining for some kind of spam...

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 17:41 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (5 responses)

Like, maybe, highlighting an interesting post in a lengthy discussion?

A preview of HyperKitty's reimagined mailing list interface

Posted May 2, 2014 9:51 UTC (Fri) by deepfire (guest, #26138) [Link] (1 responses)

Interesting for whom? Do we have a useful notion of "average taste"?

A preview of HyperKitty's reimagined mailing list interface

Posted May 5, 2014 8:38 UTC (Mon) by Tjebbe (guest, #34055) [Link]

When asking about which one direction member is prettier, this may not be the most important feature.

But when asking, say, a technical question, there may be a number of wrong answers, a number of right ones that simply explain it badly, a number of unrelated answers, a number of rude ones, and a number of correct ones that happen to be well-written and generally more useful than all the others. Those are the ones you might want to have bubble up among all the others.

And the same for other types of discussions; there may be knee-jerk reactions, ad-hominems, offtopics, etc. In any busy discussion group, it helps if it is easy to see which ones are generally thought of as better-written/throught-out than the others.

Of course you don't want to hide them or move them to some bin where you never look, but +/- on comment definitely has its uses.

A preview of HyperKitty's reimagined mailing list interface

Posted May 2, 2014 9:52 UTC (Fri) by deepfire (guest, #26138) [Link] (2 responses)

Moreover, if it's really that interesting, there must be replies.

A preview of HyperKitty's reimagined mailing list interface

Posted May 2, 2014 12:51 UTC (Fri) by mattdm (subscriber, #18) [Link]

> Interesting for whom? Do we have a useful notion of "average taste"?

For the people who are part of the project for which the mailing list exists.

"Average"? I don't think that applies. A more interesting question is: Do we have a useful notion of the _collective_ taste of the contributors to a project? This is specifically a way to get a sense of that.

> Moreover, if it's really that interesting, there must be replies.

This.... seems like a comment from someone who doesn't use mailing lists very much. It's true that most interesting comments will get replies, but the problem is that so will very many others.

A preview of HyperKitty's reimagined mailing list interface

Posted May 6, 2014 1:31 UTC (Tue) by duffy (guest, #31787) [Link]

s/interesting/provocative and you're right. :-/

A preview of HyperKitty's reimagined mailing list interface

Posted May 6, 2014 23:11 UTC (Tue) by nix (subscriber, #2304) [Link]

You forget that many people like to know which way the herd is going in order that they can follow. :)

(Of course I have to link to <https://xkcd.com/1013/> at this point.)

A preview of HyperKitty's reimagined mailing list interface

Posted Apr 30, 2014 19:05 UTC (Wed) by mathstuf (subscriber, #69389) [Link] (9 responses)

Will Mailman 3 not email me passwords in plain text? If not, is this clearly stated in the implications for signing up for the list in that "valuable" (read: shared with other sites) passwords should *never* be used with mailman?

Passwords

Posted Apr 30, 2014 22:25 UTC (Wed) by dskoll (subscriber, #1630) [Link] (8 responses)

A mailing-list manager should not allow users to pick their own passwords. It should force them to use randomly-generated ones like TnPBxSnL8dQBcPzH or wNJNpnaUrswq4Zy8 and then write them down.

This pretty much eliminates passwords on the mailing-list site being used to exploit other sites and vice-versa.

Passwords

Posted Apr 30, 2014 22:47 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

I guess that works with mailing lists because the number of times I need to log in is usually 1 (to turn off delivery if I read the list via gmane/NNTP).

Or you just have "email me a login link" which times out in an hour or two and have no passwords whatsoever.

Passwords

Posted May 1, 2014 1:32 UTC (Thu) by zlynx (guest, #2285) [Link] (6 responses)

What it should really do is verify your identity by S/MIME or PGP signature.

Passwords

Posted May 1, 2014 5:18 UTC (Thu) by mathstuf (subscriber, #69389) [Link] (5 responses)

Where is the trust root? I don't want to have to hook into the WoT as seen by joe-schmo.com just to edit mailing list preferences. I also don't think having a "HyperKitty approved" set of global trust root(s) is a good idea. Reminds me too much of the SSL trainwreck we already have on our hands.

Passwords

Posted May 1, 2014 20:35 UTC (Thu) by clint (subscriber, #7076) [Link] (4 responses)

You could have per-user sets of OpenPGP trust roots, monkeysphere-style.

Passwords

Posted May 1, 2014 21:24 UTC (Thu) by mathstuf (subscriber, #69389) [Link] (3 responses)

Could you give more details? That sounds like giving the user the lock and key to something without knowing what "monkeysphere" is.

Passwords

Posted May 1, 2014 21:52 UTC (Thu) by clint (subscriber, #7076) [Link] (2 responses)

Let's say I have a shell account somewhere where I can run monkeysphere but there is no site-wide Monkeysphere policy or activity. Using whatever alternate methods I currently have to authenticate, I can log in and configure any set of OpenPGP keys to be trusted identity certifiers, and any set of OpenPGP userids to represent authorized users of my shell account.

You can implement the same concepts in anything that uses OpenPGP authentication, without using any Monkeysphere software: in effect, a per-user pair of (trusted keyring and a set of authorized user IDs). Everything is localized solely to you unless you choose it not to be.

Passwords

Posted May 2, 2014 11:24 UTC (Fri) by dskoll (subscriber, #1630) [Link] (1 responses)

That's over-engineering it. mathstuf's suggestion is probably fine: you just have "email me a login link" which times out in an hour or two and have no passwords whatsoever.

Passwords

Posted May 2, 2014 14:35 UTC (Fri) by mathstuf (subscriber, #69389) [Link]

Agreed. It's a mailing list and not a bank account. We don't need to go from "plaintext storage we email you every month" to "PGP-based web of trust" for it. Now, for the banks…

Discourse

Posted Apr 30, 2014 20:45 UTC (Wed) by louie (guest, #3285) [Link] (4 responses)

"Between bulletin-board forum packages like phpBB and self-contained sites like Reddit and StackExchange, email-based discussions have lost noticeable ground in recent years in many places."

It would be great to have a Grumpy Editor (Grumpy Community?) review of the current state of discourse.org, by the way.

Discourse

Posted Apr 30, 2014 22:30 UTC (Wed) by DrMcCoy (subscriber, #86699) [Link] (3 responses)

I don't really like this.

Emails I can locally archive, backup, search through, etc.. Stuff that's in some weird rich format up in the cloud I have no control over at all.

I'm fine with Discourse for, say, comments to news articles. It's in fact one of the lesser annoying systems out there (even though I personally am not a fan of endless scrolling). But as a productive discussion and organization platform for FLOSS projects? No, sorry, I trust mails more.

Discourse

Posted May 1, 2014 4:53 UTC (Thu) by riking (subscriber, #95706) [Link] (1 responses)

> I trust mails more.

And that's exactly why you can ask it to email you every post made on the forum: http://i.imgur.com/rLHyiYd.png

And you can set up "email-in" for new topics, and oh, reply-by-email which has always been there.

I definitely agree that there are a LOT of advantages to local operations. But I think that the way Discourse works makes sense. (Also, a "download archive" is on the wishlist!)

Disclosure: I'm taking a paid internship with them this summer, offered because I made some nice code contributions.

Discourse

Posted May 6, 2014 23:07 UTC (Tue) by nix (subscriber, #2304) [Link]

I don't want 'download archive'. If this is going to be used for development lists, I want 'act as IMAP server dammit' so I can use the same mail-management tools that I use for every other development list I'm on. Don't inflict this stuff on those of us who don't spend our lives in web browsers...

Discourse

Posted May 2, 2014 17:43 UTC (Fri) by fandingo (guest, #67019) [Link]

HyperKitty (and Reddit, which was an example from the article) both have RESTful APIs that can be used to download any content that you may want to archive locally. "Rich format" as a barrier to archival is a false complaint.

Board Interface

Posted Apr 30, 2014 22:44 UTC (Wed) by DrMcCoy (subscriber, #86699) [Link] (3 responses)

I kinda wish HyperKitty would also offer a threaded hybrid interface in addition to showing the thread in a messageboard-like fashion.

Like Gmane does, or slrn, or mutt: The screen split horizontally, with the upper half showing the subject lines arranged in a threaded hierarchy, and the lower half showing one message. I personally find that easier and more logical to navigate.

Board Interface

Posted May 1, 2014 5:22 UTC (Thu) by mathstuf (subscriber, #69389) [Link]

If it could do it without HTML frames, that'd be great. Not sure how well it'd work in a terminal either (but then mutt and/or slrn would be better anyways).

Board Interface

Posted May 6, 2014 1:36 UTC (Tue) by duffy (guest, #31787) [Link]

I think this is a great idea! I've made an RFE ticket for it here:
https://fedorahosted.org/hyperkitty/ticket/67

Board Interface

Posted May 6, 2014 23:09 UTC (Tue) by nix (subscriber, #2304) [Link]

Yes please! I've been using this setup for email for so many years that I'm periodically surprised when I realise that not everyone does it like this. (Actually I have a summary list at the top, a tree view in the middle -- though on the upper right like slrn would be fine too -- and the article filling the rest of the screen.)

Mailman at the low end

Posted May 1, 2014 10:48 UTC (Thu) by stevan (guest, #4342) [Link]

It's a pity majordomo had licence issues, as its beauty was relative simplicity but mostly that it didn't need another daemon running. The only thing that seems close is petidomo, written in C rather than perl, but that hasn't been updated in years. Would be good to have leaner mailman, though the article of course is most relevant to heavy use.

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 14:03 UTC (Thu) by smurf (subscriber, #17840) [Link] (1 responses)

Quite frankly, as long as Mailman *finally* understands non-ASCII characters in greeting messages and whatnot, I will be perfectly happy.

Everything else is nice-to-have.

NB: This is probably the longest period between alpha and beta release of a single program ever. 3.0.0a1 was released on 2008-04-08, according to Launchpad. Let's hope that the Beta period is a bit shorter than that.

A preview of HyperKitty's reimagined mailing list interface

Posted May 1, 2014 18:15 UTC (Thu) by mtaht (guest, #11087) [Link]

did they finally add pgp support? been out of tree for years....

A preview of HyperKitty's reimagined mailing list interface

Posted May 2, 2014 8:51 UTC (Fri) by ovitters (guest, #27950) [Link]

Looking forward to the new mailman. The current version is pretty terrible usability wise. Meaning that it was good at the time, but really showing its age. I've slightly followed version 3 development and like the idea that a user exists across mailing lists. HyperKitty seems really nice. Hopefully enough people try out the beta release, rather not do that.

Development has been awfully slow though, which is rather unfortunate.

A preview of HyperKitty's reimagined mailing list interface

Posted May 4, 2014 5:36 UTC (Sun) by dlang (guest, #313) [Link]

In terms of presenting a web view of (and access to) a mailing list, there are a couple other options to look at as well.

Nabble.com is a closed-source-but-free-to-use site that can act as a front-end for a mailing list, see http://postgresql.1045698.n5.nabble.com/PostgreSQL-f18437... as an example

FudForum can integrate with nntp, and so can mailman, so you can create a e-mail/nntp/web messaging system that allows people to use whichever posting and reading method they prefer. bar.baen.com is a registration-required example of this in action (forums for the Sci-Fi publisher Baen Books, registration is required to prevent any claims that content posted there counts as "first publication" for writers). This site has been running like this for a bit over a year now.

It will be interesting to see if Mailman can come up with another good option here. I've seen several other places facing the problems of fragmenting the user base and question-answering resources between web forums and mailing lists. Gaining more ways to integrate them together would be a very good thing.

A preview of HyperKitty's reimagined mailing list interface

Posted May 9, 2014 20:05 UTC (Fri) by mylwn3 (guest, #91595) [Link] (3 responses)

An nntp service a'la gmane is what I want. It sounds like this is something that could be possibly written for in mailman 3. Until then, I'll still be happily using gmane. I've never met a web forum I've liked. They're all horrible.

A preview of HyperKitty's reimagined mailing list interface

Posted Sep 4, 2014 6:20 UTC (Thu) by QNX (guest, #98709) [Link] (2 responses)

I'm glad I'm not the only one to show NNTP a little respect. I'd go a step further though. Gmane shouldn't have to exist, mailing lists for discussion shouldn't exist in the first place. NNTP is the proper protocol for many-to-many discourse, not SMTP.

A few years ago I started prototyping an NNTP backed threaded Web forum. I abandoned it for a serious lack of time. Content needs to be separated from presentation while providing a stable API for access to the backend store.

I still need to take a closer look at Discourse.

A preview of HyperKitty's reimagined mailing list interface

Posted Sep 4, 2014 6:50 UTC (Thu) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

No. Just no.

NNTS's passed on! This protocol is no more! It has ceased to be! It's expired and gone to meet its maker! It's a stiff! Bereft of life, it rests in peace! If you hadn't nailed it to the forum it'd be pushing up the daisies! Its metabolic processes are now history! It's off the twig! It's kicked the bucket, it's shuffled off its mortal coil, run down the curtain and joined the bleeding choir invisible!! THIS IS AN EX-PROTOCOL!!

It's way overcomplicated and is designed for a completely different era. It doesn't provide archive retrieval services, for one thing. You either have to sync everything or you're screwed.

A preview of HyperKitty's reimagined mailing list interface

Posted Sep 4, 2014 7:14 UTC (Thu) by anselm (subscriber, #2796) [Link]

NNTP is not a complicated protocol at all. I remember writing a simple NNTP server for in-house use in the early 1990s, and it took me about a day or so (in Perl).

If you're looking for complicated protocols, try IMAP.


Copyright © 2014, Eklektix, Inc.
This article may be redistributed under the terms of the Creative Commons CC BY-SA 4.0 license
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds