(In case the list admin/moderator sees this message I sent this email again from the wrong FROM: address a few minutes ago, re-sending with the right one now, please discard that bad message(have not gotten confirmation it was held for moderation) -- side note with MM2 it gave the user the option to discard their own message if it was held for moderation if I recall right. My very first post to this list was held for moderation (sent from correct FROM: address), not sure why it was held(it got through eventually), was assuming that perhaps I triggered a bug in that the fact I am using the text mailman in my email address maybe tripped something I don't know, but I was seemingly unable to view the status/discard that message.)
On 2022-01-26 7:22, David Newman wrote:
Yes, this is possible. The IETF, the body that defines Internet technical standards, is still on MM2. I’m with them; given my druthers I’d run MM2 forever because it Just Works.
Then again, I put a high priority on keeping the base OS and applications patched against current security vulnerabilities. That’s getting harder to do with MM2.
Debian and FreeBSD have deprecated Python 2. MM2 still has maintenance releases but no new development. MM2 also has some archaic design decisions such as sending user passwords in plaintext email.
Like it or not, MM3 and related components are current, and currently maintained. I wasn’t crazy about the learning curve to get MM3 working, but I pressed on because it will provide a platform I can keep running much farther into the future.
Thanks for the insight, I read another post from someone yesterday saying they had 35 years of experience and were having a bunch of issues, much more serious situation(real users impacted) than mine.
I think I will go the route of MM2, probably setup a new VM and get postfix to just route the email for MM2 to the other system for processing. Then I guess I would need some proxypass rules in Apache to forward the cgi requests to the other system.
I don't recall any serious security issues over the years with MM2 (at least ones that made tech news), grand scheme of things for my use case I think it would be ok, just stick with Devan 3.x for MM2 for the foreseeable future. Feels super weird building a dedicated system for just this but I have plenty of hardware resources to do it. I already have an LXC container at home for a legacy software product (TV Mobili, AFAIK last version came out in 2015) on Devuan 3 which I never plan to upgrade just to be safe. Time for one more, well this case would be a VM running at my colo.
Hopefully can work on it today, though am not in any rush.
thanks
nate