Re: [cobalt-users] TMDA

[Wayne <cobalt@xxxxxxxxxx>]

On Sat, 13 Dec 2003 20:58:58 -0800, you wrote:

>On Friday 12 December 2003 01:31 am, Pablo Jejcic wrote:
>
>> Did anyone give a try to http://tmda.net/ ?
>>
>> I'm thinking of installing this on my Cobalt Qube3, but if anyone
>> have negative thought I will not... ;)
My ISP has installed tmda on their system. Although not a Qube3 it is Slackware
linux running Sendmail
>
>While this particular implementation of challenge/response happens to 
>have some interesting additional features, challenge/response is 
>basically a flawed method for dealing with email, as it requires 
>unknown senders to do something extra to get email to you.
>
>For example, if you install this on your server, all your users will 
>find their mailing list subscriptions will no longer work.  In fact 
>many mailing lists now immediately automatically unsubscribe anyone who 
>sends a challenge/response email, and if those emails get back to 
>senders they generate a lot bad will.
>
Not true. Only those users that choose to install tmda for their account will be
using it and while it is on the system any user can choose to use it or not.

>Yes, you can set up tagged addresses so your mailing list email (for 
>example) will get through, but unless you install tmda.cgi you'll have 
>to manage this for all your users.
>
Yes tmda.cgi is real cool. The web interface makes managing your lists and
reviewing the pending msgs a snap.

>And if you do try to install tmda.cgi, note (from the documentation) 
>that it only works as is on qmail servers.  The RaQ uses sendmail, not 
>qmail.
>
Not true. My ISP is using tmda.cgi with sendmail. You do have to have Python
installed.

>In any event, even if you do get tmda.cgi working, your users will have 
>to unsubscribe from, and resubscribe to, all their mailing lists, 
>between the time you install tmda and the time they post to any list 
>for the first time.
>
Not true. By adding the "ACTION_INCOMING="hold"" to the config file in the users
.tmda directory the challengers  are suspended and will not go out. Then by
monitoring the pending list you just add the items you want to receive to the
whitelist so all of my list subscriptions including this one were added without
having to resubscribe. This does require close monitoring of the pending list
but after some time I will remove the ACTION_INCOMING="hold" from the config
file.

>Not to mention the same problem occurring with every form-to-email page 
>running on your server; they'll need to be changed as well, or you'll 
>need to know of all of them, and create whitelist entries yourself.
>
I do not have any of these but making the whitelist entries using the tmda.cgi
web tool is really not that hard to do.

>One of my clients installed a challenge/response system for his main 
>domain and didn't notice the problem with form-to-email until he'd lost 
>a lot of business.
>
>Jeff

TMDA does take some doing to get it working so I would suggest to do it on a
test system first. Once it running smoothly it is very nice and I have not lost
any email so far.

Wayne