Implement a simple non javascript captcha to mailman
I need to implement some sort of captcha for Mailman accounts. As all my lists are for Norwegians, I think it's enough to have a simple question in Norwegian that has to be answered. I'm not a Python programmer, and I asked Gemini. He suggested that I should add a settings_local.py file in /etc/mailman3, which settings.py from the same folder should import, as it have, at the end:
try:
from .settings_local import *
except ImportError:
pass
But the code from settings_local.py doesn't semm to be run.
The settings_local.py have:
import sys
import os
CURRENT_DIR = os.path.dirname(os.path.abspath(__file__))
if CURRENT_DIR not in sys.path:
sys.path.insert(0, CURRENT_DIR)
ACCOUNT_ADAPTER = 'mailman_local.adapter.CustomMailmanAccountAdapter'
ACCOUNT_FORMS = {'signup': 'mailman_local.forms_no.DynamicMathCaptchaSignupForm'}
INSTALLED_APPS += ('mailman_local',)
I have the directory /etc/mailman3/mailman_local with the following files:
- adapter.py
- forms_no.py
- __init__.py
If this at all is possible, I'd like to have the extra code/files in a place where an upgrade doesn't affect them, so /etc/mailman3 seems to be a good location.
Do you have suggestions in how to get this or a similar approach to work?
Thanks, Lars
On Sun, Oct 4, 2026 at 9:11 AM Lars Bjørndal via Mailman-users < mailman-users@mailman3.org> wrote:
I need to implement some sort of captcha for Mailman accounts. As all my lists are for Norwegians, I think it's enough to have a simple question in Norwegian that has to be answered. I'm not a Python programmer, and I asked Gemini. He suggested that I should add a settings_local.py file in /etc/mailman3, which settings.py from the same folder should import, as it have, at the end:
try: from .settings_local import * except ImportError: passBut the code from settings_local.py doesn't semm to be run.
The settings_local.py have:
import sys import os CURRENT_DIR = os.path.dirname(os.path.abspath(__file__)) if CURRENT_DIR not in sys.path: sys.path.insert(0, CURRENT_DIR) ACCOUNT_ADAPTER = 'mailman_local.adapter.CustomMailmanAccountAdapter' ACCOUNT_FORMS = {'signup': 'mailman_local.forms_no.DynamicMathCaptchaSignupForm'} INSTALLED_APPS += ('mailman_local',)I have the directory /etc/mailman3/mailman_local with the following files:
- adapter.py
- forms_no.py
- __init__.py
If this at all is possible, I'd like to have the extra code/files in a place where an upgrade doesn't affect them, so /etc/mailman3 seems to be a good location.
Do you have suggestions in how to get this or a similar approach to work?
- If implementing a Captcha was that simple, I am sure it would have been implemented by the Devs already.
- Gemini is not that intelligent for programming tasks, IMHO. Try Claude.
- A few list administrators have implemented Anubis in front of MM3 and it works perfectly.
- If you've got enough hairs to pull out then you're welcome to follow this guide I made with Claude > https://eu.kictanet.or.ke/~wash/mailman3-captcha-guide.html
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
Thanks a lot. You wrote:
[...]
- A few list administrators have implemented Anubis in front of MM3 and it works perfectly.
But doesn't that require javascript? Some users, including myself, are using text based browsers without support for javascript.
- If you've got enough hairs to pull out then you're welcome to follow this guide I made with Claude > https://eu.kictanet.or.ke/~wash/mailman3-captcha-guide.html
Thanks, Lars
On 2026-10-04 11:04:05 +0200 (+0200), Lars Bjørndal via Mailman-users wrote: [...]
- A few list administrators have implemented Anubis in front of MM3 and it works perfectly.
But doesn't that require javascript? Some users, including myself, are using text based browsers without support for javascript. [...]
Anubis, by default, avoids forcing non-JS-capable browsers to solve its challenges. I have it implemented in front of Postorius/Hyperkitty and am able to browse them fine even with a console-based browser like Lynx. Yes that means a bot could in theory bypass Anubis by claiming to be Lynx or similar, but in practice they all (at least the ones I've seen acting in problematic ways) pretend to be popular JS-capable graphical browsers instead at the moment.
Of course, any of this is subject to change. The attacks we've all been collectively weathering for the past 12-18 months are constantly evolving, so our mitigations against them have to continuously evolve as well just to keep up with them.
Jeremy Stanley
I need to implement some sort of captcha for Mailman accounts. As all my lists are for Norwegians, I think it's enough to have a simple question in Norwegian that has to be answered. I'm not a Python programmer, and I asked Gemini. He suggested that I should add a settings_local.py file in /etc/mailman3, which settings.py from the same folder should import, as it have, at the end:
Check out https://github.com/pbiering/mailman3-rpm.git It has patches you can apply and adapt to upstream MailMan3 where they need to be for a Captcha.
Peter C
On Sun, Oct 4, 2026 at 11:46 AM Peter Chubb via Mailman-users < mailman-users@mailman3.org> wrote:
I need to implement some sort of captcha for Mailman accounts. As all my lists are for Norwegians, I think it's enough to have a simple question in Norwegian that has to be answered. I'm not a Python programmer, and I asked Gemini. He suggested that I should add a settings_local.py file in /etc/mailman3, which settings.py from the same folder should import, as it have, at the end:
Check out https://github.com/pbiering/mailman3-rpm.git It has patches you can apply and adapt to upstream MailMan3 where they need to be for a Captcha.
Peter C
Peter C,
You have a horrible MuA. It doesn't know how to quote the original email.
-- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html]
"Washington" == Washington Odhiambo <odhiambo@gmail.com> writes: "Lars" == Lars Bjørndal <lrs@dalen.lamasti.net> writes: "Peter" == Peter Chbb <peter@chubb.wattle.id.au> writes:
Lars> I need to implement some sort of captcha for Mailman accounts. As Lars> all my lists are for Norwegians, I think it's enough to have a Lars> simple question in Norwegian that has to be answered. I'm not a Lars> Python programmer, and I asked Gemini. He suggested that I should Lars> add a settings_local.py file in /etc/mailman3, which settings.py Lars> from the same folder should import, as it have, at the end:
Peter> Check out https://github.com/pbiering/mailman3-rpm.git It has Peter> patches you can apply and adapt to upstream MailMan3 where they Peter> need to be for a Captcha.
Washington> You have a horrible MuA. It doesn't know how to quote the Washington> original email.
User error. It usually does the quoting correctly.
Peter C
participants (4)
-
Jeremy Stanley -
Lars Bjørndal -
Peter Chubb -
Washington Odhiambo