Hello list,

I am trying to use lists.sr.ht to establish a private mailing list
between a few friends. It hasn't gone particularly well:

1. I configured the list with the following permissions:

   * Non-subscriber permissions: None
   * Subscriber permissions: Browse, Reply, Post
   * Account Holder permissions: None

   This makes it impossible for anyone except my sr.ht account to
   subscribe. Fair enough, though maybe it could be handy to separate
   "Subscribe" permissions from "Browse" permissions.

2. I have tried adding my friends' email addresses to the list with
   Browse/Reply/Post permissions. One friend's subscription failed: his
   email's `From:` field matched the address I listed, but with a
   different `Return-Path:`. I can provide a dump of the email with all
   headers on request, but don't want to leak friend's email addresses
   to the open internet.

3. When I emailed my list's subscribe address, from the email address
   associated with my sr.ht account, I was told my subscription request
   was discarded. This was a bit confusing - it seems like users with
   access (including owners?) can only manipulate their subscription
   through the web UI?

I appreciate any advice people. TIA.

-- Jack

On Tue Feb 9, 2021 at 3:57 AM EST,  wrote:
> * Non-subscriber permissions: None
> * Subscriber permissions: Browse, Reply, Post
> * Account Holder permissions: None
>
> This makes it impossible for anyone except my sr.ht account to
> subscribe. Fair enough, though maybe it could be handy to separate
> "Subscribe" permissions from "Browse" permissions.

We don't separate these permissions on purpose. If you subscribe, you
are forwarded all emails, and could just browse them in your inbox. So
we also let you browse them on the web.

Also, if you want a totally private mailing list, I recommend locking
all of these down. This doesn't prevent anyone from subscribing. You can
override these permissions for individuals in the ACLs.

> 2. I have tried adding my friends' email addresses to the list with
> Browse/Reply/Post permissions. One friend's subscription failed: his
> email's `From:` field matched the address I listed, but with a
> different `Return-Path:`. I can provide a dump of the email with all
> headers on request, but don't want to leak friend's email addresses
> to the open internet.

You should just add the email address they'll be sending from to the
ACL. We don't use the Return-Path. This isn't a bug on our end.

> 3. When I emailed my list's subscribe address, from the email address
> associated with my sr.ht account, I was told my subscription request
> was discarded. This was a bit confusing - it seems like users with
> access (including owners?) can only manipulate their subscription
> through the web UI?

Can you send me (privately) the email which was sent back?

February 10, 2021 1:00 AM, "Drew DeVault" <sir@cmpwn.com> wrote:

> On Tue Feb 9, 2021 at 3:57 AM EST, wrote:
>
>> Maybe it could be handy to separate "Subscribe" permissions from
>> "Browse" permissions.
>
> We don't separate these permissions on purpose.

OK, makes sense.

>> 2. I have tried adding my friends' email addresses to the list with
>> Browse/Reply/Post permissions. One friend's subscription failed
>
> You should just add the email address they'll be sending from to the
> ACL. We don't use the Return-Path. This isn't a bug on our end.

I suspect I have not explained this well. I added the email my friend
was sending from to the ACL, but he was unable to subscribe. I will
email you off-list with the email he sent, along with the email you
requested in #3.

>> 3. When I emailed my list's subscribe address, from the email address
>> associated with my sr.ht account, I was told my subscription request
>> was discarded.
>
> Can you send me (privately) the email which was sent back?

Will do.

TYVM,

-- Jack