[Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[xor]

[-- Attachment #1: Type: text/plain, Size: 647 bytes --]

http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/

TL;DR:

> In 2013, GIMP’s developers pulled the GIMP Windows downloads from
> SourceForge. SourceForge was full of misleading advertisements
> masquerading as “Download” buttons — something that’s a problem all over
> the web. 
[...]
> In 2015, SourceForge pushed back. Considering the old GIMP account on
> SourceForge “abandoned,” they took control over it, locking out the
> original maintainer. They then put GIMP downloads back up on SourceForge,
> wrapped in SourceForge’s own junkware-filled installer.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Wladimir J. van der Laan]

On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/

All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.

No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.

Wladimir

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Andy Schroder]

Regarding changing the e-mail list provider. Is anyone interested in 
sponsoring it? There are non-free options, but it may be difficult to 
always ensure the fee is being paid to the provider. I think finding an 
agreeable free solution may have been the issue before? I've also 
thought of trying to make a pay per message or byte solution (and this 
cost could be dynamic based upon the number of current mailing list 
subscribers). This could solve the who pays problem (the sender pays), 
as well as motivate people to be more concise and clear with their 
messages, and at the same time limit spam.



Any thoughts?

Andy Schroder

On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
> On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
>> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
> All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
>
> No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
>
> Wladimir
>
>
> ------------------------------------------------------------------------------

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Troy Benjegerdes]

I'll sponsor it, if we agree to implement a HashCash spam filter
in the next 6 months. I've run mail servers for $DAYJOB for 5 or
so years, and I've run my own personal server for the last 14.

Since Bitcoin is a perfectly good HashCash system, I'm thinking a
http://www.courier-mta.org/courierfilter.html filter plugin that 
checks to ensure that the required bitcoin fee has been paid, or 
better yet included in the message in some standard form.

I'd like to have several other people with linux admin experience
also agree to host live mirrors of the list, which could be switched
over by whomever controls the relevant MX records for the mail list.

What do you think a reasonable per-message fee should be, such that
a couple of independent admins can reasonably expect to be able to
pay $250/month each for their time and server hosting/bandwidth costs?

I also think that anyone who's contributed more than say 10 or 15 
commits to https://github.com/bitcoin/bitcoin/graphs/contributors
should be excluded from the pay-with-bitcoin filter, as they have
paid with code. The rest of us should be paying to distribute and 
archive their efforts.

On Wed, Jun 10, 2015 at 12:46:49PM -0400, Andy Schroder wrote:
> Regarding changing the e-mail list provider. Is anyone interested in 
> sponsoring it? There are non-free options, but it may be difficult to 
> always ensure the fee is being paid to the provider. I think finding an 
> agreeable free solution may have been the issue before? I've also 
> thought of trying to make a pay per message or byte solution (and this 
> cost could be dynamic based upon the number of current mailing list 
> subscribers). This could solve the who pays problem (the sender pays), 
> as well as motivate people to be more concise and clear with their 
> messages, and at the same time limit spam.
> 
> 
> 
> Any thoughts?
> 
> Andy Schroder
> 
> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
> > On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
> >> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
> > All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
> >
> > No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
> >
> > Wladimir
> >
> >
> > ------------------------------------------------------------------------------
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development

-- 
----------------------------------------------------------------------------
Troy Benjegerdes                 'da hozer'                  hozer@hozed.org
7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop

      Never pick a fight with someone who buys ink by the barrel,
         nor try buy a hacker who makes money by the megahash

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Andy Schroder]

[-- Attachment #1: Type: text/plain, Size: 3766 bytes --]

Hello Troy,

I like the idea of the live mirrors. I'm personally just an amateur at 
setting up e-mail servers, but the first concern I have is that everyone 
hosting a mirror may not necessarily use the same SMTP MTA. I personally 
use postfix, but I'm not sure what most people use.

Some other features I'd like to see required is PGP/MIME support and 
ensuring that digital signatures are not broken by footers, etc. 
appended to the bottom of the message by the list. It might be nice to 
also allow for HTML messages?

Here is a link with some current statistics to get an idea what the load 
may be. I've been told there are about 1,200 subscribers. 
http://dir.gmane.org/gmane.comp.bitcoin.devel



Andy Schroder

On 06/10/2015 02:02 PM, Troy Benjegerdes wrote:
> I'll sponsor it, if we agree to implement a HashCash spam filter
> in the next 6 months. I've run mail servers for $DAYJOB for 5 or
> so years, and I've run my own personal server for the last 14.
>
> Since Bitcoin is a perfectly good HashCash system, I'm thinking a
> http://www.courier-mta.org/courierfilter.html filter plugin that
> checks to ensure that the required bitcoin fee has been paid, or
> better yet included in the message in some standard form.
>
> I'd like to have several other people with linux admin experience
> also agree to host live mirrors of the list, which could be switched
> over by whomever controls the relevant MX records for the mail list.
>
> What do you think a reasonable per-message fee should be, such that
> a couple of independent admins can reasonably expect to be able to
> pay $250/month each for their time and server hosting/bandwidth costs?
>
> I also think that anyone who's contributed more than say 10 or 15
> commits to https://github.com/bitcoin/bitcoin/graphs/contributors
> should be excluded from the pay-with-bitcoin filter, as they have
> paid with code. The rest of us should be paying to distribute and
> archive their efforts.
>
> On Wed, Jun 10, 2015 at 12:46:49PM -0400, Andy Schroder wrote:
>> Regarding changing the e-mail list provider. Is anyone interested in
>> sponsoring it? There are non-free options, but it may be difficult to
>> always ensure the fee is being paid to the provider. I think finding an
>> agreeable free solution may have been the issue before? I've also
>> thought of trying to make a pay per message or byte solution (and this
>> cost could be dynamic based upon the number of current mailing list
>> subscribers). This could solve the who pays problem (the sender pays),
>> as well as motivate people to be more concise and clear with their
>> messages, and at the same time limit spam.
>>
>>
>>
>> Any thoughts?
>>
>> Andy Schroder
>>
>> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
>>> On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
>>>> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
>>> All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
>>>
>>> No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
>>>
>>> Wladimir
>>>
>>>
>>> ------------------------------------------------------------------------------
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Troy Benjegerdes]

And just like I did here, if I were a list member with good reputation,
and felt like reposting something that did not make it to the list by
accident or ommission, or a hashcash posting fee that was too high, it
would end up on the list if enough people bothered to read it and 
either repost, or post the bond to pass the filter.

On Wed, Jun 10, 2015 at 07:04:41PM +0000, Patrick Mccorry (PGR) wrote:
> Yeah post back to list - its an interesting response. So members with a good reputation could vote to say if the bond should be returned to the new member. I just wanted to highlight that people who do not commit a lot of code contribute in other, arguably equal ways. 
> 
> ________________________________________
> From: Troy Benjegerdes <hozer@hozed.org>
> Sent: 10 June 2015 19:58
> To: Patrick Mccorry (PGR)
> Subject: Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?
> 
> Did you want responses sent back to the list?
> 
> I think, if I had a revenue stream from a pay-to-post list in place,
> the first thing I'd do is spend some time on a reputation/'post bond'
> interface in which known users with a good reputation could post for
> no charge, while if you were unknown or new to the list, you would
> need to post a bond.
> 
> If the consensus of the list was that your message was valuable, it
> would be broadcast and archived no charge.
> 
> If enough readers thought the message was spam, those readers could
> collect the posted bond, thus compensating them for the time wasted
> reading said spam.
> 
> I would hope that in such an environment would still work for researchers.
> Does this answer your concerns? Should I repost to the list, because
> I do think your concern is worth sharing?
> 
> On Wed, Jun 10, 2015 at 06:48:29PM +0000, Patrick Mccorry (PGR) wrote:
> > What about researchers who do not commit code but help find problems in this space. I don't think a mailing should be a paid for service - as it's difficult to determine who should and should not pay.
> >
> > Sent from my iPhone
> >
> > > On 10 Jun 2015, at 19:45, Troy Benjegerdes <hozer@hozed.org> wrote:
> > >
> > > I'll sponsor it, if we agree to implement a HashCash spam filter
> > > in the next 6 months. I've run mail servers for $DAYJOB for 5 or
> > > so years, and I've run my own personal server for the last 14.
> > >
> > > Since Bitcoin is a perfectly good HashCash system, I'm thinking a
> > > http://www.courier-mta.org/courierfilter.html filter plugin that
> > > checks to ensure that the required bitcoin fee has been paid, or
> > > better yet included in the message in some standard form.
> > >
> > > I'd like to have several other people with linux admin experience
> > > also agree to host live mirrors of the list, which could be switched
> > > over by whomever controls the relevant MX records for the mail list.
> > >
> > > What do you think a reasonable per-message fee should be, such that
> > > a couple of independent admins can reasonably expect to be able to
> > > pay $250/month each for their time and server hosting/bandwidth costs?
> > >
> > > I also think that anyone who's contributed more than say 10 or 15
> > > commits to https://github.com/bitcoin/bitcoin/graphs/contributors
> > > should be excluded from the pay-with-bitcoin filter, as they have
> > > paid with code. The rest of us should be paying to distribute and
> > > archive their efforts.
> > >
> > >> On Wed, Jun 10, 2015 at 12:46:49PM -0400, Andy Schroder wrote:
> > >> Regarding changing the e-mail list provider. Is anyone interested in
> > >> sponsoring it? There are non-free options, but it may be difficult to
> > >> always ensure the fee is being paid to the provider. I think finding an
> > >> agreeable free solution may have been the issue before? I've also
> > >> thought of trying to make a pay per message or byte solution (and this
> > >> cost could be dynamic based upon the number of current mailing list
> > >> subscribers). This could solve the who pays problem (the sender pays),
> > >> as well as motivate people to be more concise and clear with their
> > >> messages, and at the same time limit spam.
> > >>
> > >>
> > >>
> > >> Any thoughts?
> > >>
> > >> Andy Schroder
> > >>
> > >>> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
> > >>>> On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
> > >>>> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
> > >>> All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
> > >>>
> > >>> No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
> > >>>
> > >>> Wladimir
> > >>>
> > >>>
> > >>> ------------------------------------------------------------------------------
> > >>
> > >>
> > >> ------------------------------------------------------------------------------
> > >> _______________________________________________
> > >> Bitcoin-development mailing list
> > >> Bitcoin-development@lists.sourceforge.net
> > >> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> > >
> > > --
> > > ----------------------------------------------------------------------------
> > > Troy Benjegerdes                 'da hozer'                  hozer@hozed.org
> > > 7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop
> > >
> > >      Never pick a fight with someone who buys ink by the barrel,
> > >         nor try buy a hacker who makes money by the megahash
> > >
> > >
> > > ------------------------------------------------------------------------------
> > > _______________________________________________
> > > Bitcoin-development mailing list
> > > Bitcoin-development@lists.sourceforge.net
> > > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> 
> --
> ----------------------------------------------------------------------------
> Troy Benjegerdes                 'da hozer'                  hozer@hozed.org
> 7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop
> 
>       Never pick a fight with someone who buys ink by the barrel,
>          nor try buy a hacker who makes money by the megahash

-- 
----------------------------------------------------------------------------
Troy Benjegerdes                 'da hozer'                  hozer@hozed.org
7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop

      Never pick a fight with someone who buys ink by the barrel,
         nor try buy a hacker who makes money by the megahash

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Ivan Brightly]

[-- Attachment #1: Type: text/plain, Size: 2018 bytes --]

I like elegant solutions and while eventually I can see a "pay to
contribute" service, I don't imagine you'll get consensus in short order.

List provider costs are pretty reasonable, so if that's the hurdle to
overcome I'm happy to offer sponsorship.

Ivan Brightly
SolidX Partners

On Wed, Jun 10, 2015 at 12:46 PM, Andy Schroder <info@andyschroder.com>
wrote:

> Regarding changing the e-mail list provider. Is anyone interested in
> sponsoring it? There are non-free options, but it may be difficult to
> always ensure the fee is being paid to the provider. I think finding an
> agreeable free solution may have been the issue before? I've also
> thought of trying to make a pay per message or byte solution (and this
> cost could be dynamic based upon the number of current mailing list
> subscribers). This could solve the who pays problem (the sender pays),
> as well as motivate people to be more concise and clear with their
> messages, and at the same time limit spam.
>
>
>
> Any thoughts?
>
> Andy Schroder
>
> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
> > On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
> >>
> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
> > All our downloads (even old ones) have recently been deleted from
> sourceforge, for this reason. They haven't been mentioned in Bitcon Core
> release announcements for a long time.
> >
> > No opinion on the mailing list. Though I think it's less urgent. The
> issue of moving the mailinglist has come up before a few times and people
> can't agree where to move to.
> >
> > Wladimir
> >
> >
> >
> ------------------------------------------------------------------------------
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

[-- Attachment #2: Type: text/html, Size: 2837 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Troy Benjegerdes]

I think if the consensus is "pay with commits or pay with bitcoin"
we might have a consensus from the people that actually matter very 
quickly, because they've already paid ;)

My opinion is the most sustainable solution would be to identify a
team of admins and use something like Digital Ocean's new team accounts
feature and have someone like SolidX contribute funds for the servers
and a few hours a week from one of their sysadmins to the team.

I am dubious of most commercial list-as-a-service providers for the same
reason I am dubious of sourceforge. Market conditions change and then all
of a sudden the fact you're in control of a popular list becomes more 
valuable than what your customer is paying you to run the list.

If the list provider can actively help out in encouraging read-only mirrors
of the list archives, then I think we mitigate the above business risk.


On Wed, Jun 10, 2015 at 02:28:55PM -0400, Ivan Brightly wrote:
> I like elegant solutions and while eventually I can see a "pay to
> contribute" service, I don't imagine you'll get consensus in short order.
> 
> List provider costs are pretty reasonable, so if that's the hurdle to
> overcome I'm happy to offer sponsorship.
> 
> Ivan Brightly
> SolidX Partners
> 
> On Wed, Jun 10, 2015 at 12:46 PM, Andy Schroder <info@andyschroder.com>
> wrote:
> 
> > Regarding changing the e-mail list provider. Is anyone interested in
> > sponsoring it? There are non-free options, but it may be difficult to
> > always ensure the fee is being paid to the provider. I think finding an
> > agreeable free solution may have been the issue before? I've also
> > thought of trying to make a pay per message or byte solution (and this
> > cost could be dynamic based upon the number of current mailing list
> > subscribers). This could solve the who pays problem (the sender pays),
> > as well as motivate people to be more concise and clear with their
> > messages, and at the same time limit spam.
> >
> >
> >
> > Any thoughts?
> >
> > Andy Schroder
> >
> > On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
> > > On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
> > >>
> > http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
> > > All our downloads (even old ones) have recently been deleted from
> > sourceforge, for this reason. They haven't been mentioned in Bitcon Core
> > release announcements for a long time.
> > >
> > > No opinion on the mailing list. Though I think it's less urgent. The
> > issue of moving the mailinglist has come up before a few times and people
> > can't agree where to move to.
> > >
> > > Wladimir
> > >
> > >
> > >
> > ------------------------------------------------------------------------------
> >
> >
> >
> > ------------------------------------------------------------------------------
> > _______________________________________________
> > Bitcoin-development mailing list
> > Bitcoin-development@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> >

> ------------------------------------------------------------------------------

> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development


-- 
----------------------------------------------------------------------------
Troy Benjegerdes                 'da hozer'                  hozer@hozed.org
7 elements      earth::water::air::fire::mind::spirit::soul        grid.coop

      Never pick a fight with someone who buys ink by the barrel,
         nor try buy a hacker who makes money by the megahash

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Ivan Brightly]

[-- Attachment #1: Type: text/plain, Size: 394 bytes --]

"My opinion is the most sustainable solution would be to identify a
team of admins and use something like Digital Ocean's new team accounts
feature and have someone like SolidX contribute funds for the servers
and a few hours a week from one of their sysadmins to the team."

This is a perfectly fine option. Alternatively, if the paid mailing list
option is preferred, I'd suggest Intermedia:

[-- Attachment #2: Type: text/html, Size: 1038 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[s7r]

The mail list is public, so it's not like the data on it is somehow
sensitive. Sourcefoge is fine, it has a nice web UI where you can browse
the message and sort/order them as you want, etc.

Why would you want to move to a paid solution? And why would you want
users to have to pay per message? This is the worst idea ever from my
point of view. We want to encourage people to join the community, run
full nodes, ask questions, come with solutions, ideas for improvements
and so on. Everyone should read and write and contribute as much as
possible with ideas in debates. You never know who can have bright ideas
in some contexts.

Bottom line is so far sourceforge handles the mail lists just fine. I
don't see a single advantage another mail list provider / system could
offer, except some headache and extra work for migration. The software
distribution via sourcefoge was cancelled for obvious reasons which I
fully understand and agree to, but it has nothing to do with the mail
lists. We have way more important things to brainstorm about.

On 6/10/2015 7:46 PM, Andy Schroder wrote:
> Regarding changing the e-mail list provider. Is anyone interested in 
> sponsoring it? There are non-free options, but it may be difficult to 
> always ensure the fee is being paid to the provider. I think finding an 
> agreeable free solution may have been the issue before? I've also 
> thought of trying to make a pay per message or byte solution (and this 
> cost could be dynamic based upon the number of current mailing list 
> subscribers). This could solve the who pays problem (the sender pays), 
> as well as motivate people to be more concise and clear with their 
> messages, and at the same time limit spam.
> 
> 
> 
> Any thoughts?
> 
> Andy Schroder
> 
> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
>> On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
>>> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
>> All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
>>
>> No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
>>
>> Wladimir
>>
>>
>> ------------------------------------------------------------------------------
> 
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> 

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Andy Schroder]

[-- Attachment #1.1: Type: text/plain, Size: 3671 bytes --]

Hello,

A couple of motivations for a mailing list switch:

 1. Sometimes the mailing list delays delivery for 10 minutes to several
    days.
 2. There are usually lots of ads at the footer of the messages. Really
    confuses new readers (for me at least), and seems like it really
    pollutes such a historical dialog that may be referenced long into
    the future. How would it be if the 10 Commandments, Magna Carta,
    Bill of Rights, The Sermon on the Mount, or The Gettysburg Address
    had ads intertwined within them?
 3. Don't think HTML messages are allowed.
 4. Seems like digital signatures are always broken on messages because
    the list server slightly modifies them (?), so my e-mail client
    doesn't verify them all.



Andy Schroder

On 06/10/2015 02:36 PM, s7r wrote:
> The mail list is public, so it's not like the data on it is somehow
> sensitive. Sourcefoge is fine, it has a nice web UI where you can browse
> the message and sort/order them as you want, etc.
>
> Why would you want to move to a paid solution? And why would you want
> users to have to pay per message? This is the worst idea ever from my
> point of view. We want to encourage people to join the community, run
> full nodes, ask questions, come with solutions, ideas for improvements
> and so on. Everyone should read and write and contribute as much as
> possible with ideas in debates. You never know who can have bright ideas
> in some contexts.
>
> Bottom line is so far sourceforge handles the mail lists just fine. I
> don't see a single advantage another mail list provider / system could
> offer, except some headache and extra work for migration. The software
> distribution via sourcefoge was cancelled for obvious reasons which I
> fully understand and agree to, but it has nothing to do with the mail
> lists. We have way more important things to brainstorm about.
>
> On 6/10/2015 7:46 PM, Andy Schroder wrote:
>> Regarding changing the e-mail list provider. Is anyone interested in
>> sponsoring it? There are non-free options, but it may be difficult to
>> always ensure the fee is being paid to the provider. I think finding an
>> agreeable free solution may have been the issue before? I've also
>> thought of trying to make a pay per message or byte solution (and this
>> cost could be dynamic based upon the number of current mailing list
>> subscribers). This could solve the who pays problem (the sender pays),
>> as well as motivate people to be more concise and clear with their
>> messages, and at the same time limit spam.
>>
>>
>>
>> Any thoughts?
>>
>> Andy Schroder
>>
>> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
>>> On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
>>>> http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
>>> All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
>>>
>>> No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
>>>
>>> Wladimir
>>>
>>>
>>> ------------------------------------------------------------------------------
>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>
>


[-- Attachment #1.2: Type: text/html, Size: 4857 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 1101 bytes --]

On Wed, Jun 10, 2015 at 02:59:48PM -0400, Andy Schroder wrote:
> Hello,
> 
> A couple of motivations for a mailing list switch:
> 
> 1. Sometimes the mailing list delays delivery for 10 minutes to several
>    days.
> 2. There are usually lots of ads at the footer of the messages. Really
>    confuses new readers (for me at least), and seems like it really
>    pollutes such a historical dialog that may be referenced long into
>    the future. How would it be if the 10 Commandments, Magna Carta,
>    Bill of Rights, The Sermon on the Mount, or The Gettysburg Address
>    had ads intertwined within them?
> 3. Don't think HTML messages are allowed.

Please keep it that way; HTML messages have no place on a technical
mailing list.

> 4. Seems like digital signatures are always broken on messages because
>    the list server slightly modifies them (?), so my e-mail client
>    doesn't verify them all.

What type of digital signatures specifically? What email client?

-- 
'peter'[:-1]@petertodd.org
000000000000000004e3d7b1cff56c5264b16dd79d10a26683c2fabb11669b5d

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Andy Schroder]

[-- Attachment #1: Type: text/plain, Size: 557 bytes --]


Andy Schroder

On 06/10/2015 03:03 PM, Peter Todd wrote:
>
>> 4. Seems like digital signatures are always broken on messages because
>>     the list server slightly modifies them (?), so my e-mail client
>>     doesn't verify them all.
> What type of digital signatures specifically? What email client?

I think they are usually PGP/MIME signatures that are not working right. 
If you'll notice from my e-mail headers:

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
X-Enigmail-Version: 1.6






[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 946 bytes --]

On Wed, Jun 10, 2015 at 03:12:02PM -0400, Andy Schroder wrote:
> 
> Andy Schroder
> 
> On 06/10/2015 03:03 PM, Peter Todd wrote:
> >
> >>4. Seems like digital signatures are always broken on messages because
> >>    the list server slightly modifies them (?), so my e-mail client
> >>    doesn't verify them all.
> >What type of digital signatures specifically? What email client?
> 
> I think they are usually PGP/MIME signatures that are not working
> right. If you'll notice from my e-mail headers:
> 
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
> X-Enigmail-Version: 1.6

It might be that Thunderbird doesn't properly handle messages with both
signed and unsigned content. I use mutt myself, which handles it just
fine. (the sigs on your emails verify just fine for instance)

-- 
'peter'[:-1]@petertodd.org
0000000000000000134f9a433a4bece258b5035ecda33384f820a60493ca2887

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Andy Schroder]

[-- Attachment #1: Type: text/plain, Size: 2041 bytes --]


Andy Schroder

On 06/10/2015 03:20 PM, Peter Todd wrote:
> On Wed, Jun 10, 2015 at 03:12:02PM -0400, Andy Schroder wrote:
>> Andy Schroder
>>
>> On 06/10/2015 03:03 PM, Peter Todd wrote:
>>>> 4. Seems like digital signatures are always broken on messages because
>>>>     the list server slightly modifies them (?), so my e-mail client
>>>>     doesn't verify them all.
>>> What type of digital signatures specifically? What email client?
>> I think they are usually PGP/MIME signatures that are not working
>> right. If you'll notice from my e-mail headers:
>>
>> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.2.0
>> X-Enigmail-Version: 1.6
> It might be that Thunderbird doesn't properly handle messages with both
> signed and unsigned content. I use mutt myself, which handles it just
> fine. (the sigs on your emails verify just fine for instance)
>

It's possible that the enigmail extension is not working right, but I 
was under the impression that it is just feeding data to gpg and then 
receiving the response back. It's possible that your e-mail you just 
checked was not sent through mailman since I also replied directly to 
you explicitly (in which case the message has not been modified) and you 
probably have the setting in the mailing list set to not send duplicate 
messages if you are an explicit TO. I just deleted all explicit TOs for 
this message, so everyone should be receiving it through the mailing 
list and not directly. Is the signature still valid for you now? I think 
enigmail can handle messages with some signed and unsigned content, and 
maybe PGP/MIME inherently does not support this and a mailing list 
re-writing parts of messages is an expected action? If this message 
re-writing is an expected action and I'm correct that PGP/MIME does not 
support partially signed content, then maybe it is just a recommendation 
for this mailing list to not use PGP/MIME for messages sent to the list?

Can anyone else confirm?




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 1420 bytes --]

On Wed, Jun 10, 2015 at 03:36:42PM -0400, Andy Schroder wrote:
> It's possible that the enigmail extension is not working right, but
> I was under the impression that it is just feeding data to gpg and
> then receiving the response back. It's possible that your e-mail you
> just checked was not sent through mailman since I also replied
> directly to you explicitly (in which case the message has not been
> modified) and you probably have the setting in the mailing list set
> to not send duplicate messages if you are an explicit TO. I just
> deleted all explicit TOs for this message, so everyone should be
> receiving it through the mailing list and not directly. Is the
> signature still valid for you now? I think enigmail can handle

It has perfectly valid signatures, as do your earlier messages to the
list.

> messages with some signed and unsigned content, and maybe PGP/MIME
> inherently does not support this and a mailing list re-writing parts
> of messages is an expected action? If this message re-writing is an
> expected action and I'm correct that PGP/MIME does not support
> partially signed content, then maybe it is just a recommendation for
> this mailing list to not use PGP/MIME for messages sent to the list?

PGP/MIME definitely does support partially signed content.

-- 
'peter'[:-1]@petertodd.org
000000000000000009e865d07f75341a5f3dc15f0e149055a241eedd552c3b88

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Andy Schroder]

[-- Attachment #1: Type: text/plain, Size: 2042 bytes --]

Hello,

Thanks for testing this clarifying things about PGP/MIME and I apologize 
for wasting your time with it. It looks like a SPAM filtering service I 
use is re-writing some parts of some plain text messages with some 
special/alternate encoding characters (not sure what it really is). 
Anyway, if I manually export/import a message from gmane (bypassing my 
e-mail SPAM filter), thunderbird/enigmail is not having problems 
verifying signatures. I guess I never realized this before because all 
other signed messages I normally receive are encrypted and the SPAM 
filter does not mess with non plain text data.



Andy Schroder

On 06/10/2015 03:43 PM, Peter Todd wrote:
> On Wed, Jun 10, 2015 at 03:36:42PM -0400, Andy Schroder wrote:
>> It's possible that the enigmail extension is not working right, but
>> I was under the impression that it is just feeding data to gpg and
>> then receiving the response back. It's possible that your e-mail you
>> just checked was not sent through mailman since I also replied
>> directly to you explicitly (in which case the message has not been
>> modified) and you probably have the setting in the mailing list set
>> to not send duplicate messages if you are an explicit TO. I just
>> deleted all explicit TOs for this message, so everyone should be
>> receiving it through the mailing list and not directly. Is the
>> signature still valid for you now? I think enigmail can handle
> It has perfectly valid signatures, as do your earlier messages to the
> list.
>
>> messages with some signed and unsigned content, and maybe PGP/MIME
>> inherently does not support this and a mailing list re-writing parts
>> of messages is an expected action? If this message re-writing is an
>> expected action and I'm correct that PGP/MIME does not support
>> partially signed content, then maybe it is just a recommendation for
>> this mailing list to not use PGP/MIME for messages sent to the list?
> PGP/MIME definitely does support partially signed content.
>



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 555 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Jeff Garzik]

[-- Attachment #1: Type: text/plain, Size: 4223 bytes --]

On Wed, Jun 10, 2015 at 11:59 AM, Andy Schroder <info@andyschroder.com>
wrote:

>  Hello,
>
> A couple of motivations for a mailing list switch:
>
>    1. Sometimes the mailing list delays delivery for 10 minutes to
>    several days.
>    2. There are usually lots of ads at the footer of the messages. Really
>    confuses new readers (for me at least), and seems like it really pollutes
>    such a historical dialog that may be referenced long into the future. How
>    would it be if the 10 Commandments, Magna Carta, Bill of Rights, The Sermon
>    on the Mount, or The Gettysburg Address had ads intertwined within them?
>     3. Don't think HTML messages are allowed.
>    4. Seems like digital signatures are always broken on messages because
>    the list server slightly modifies them (?), so my e-mail client doesn't
>    verify them all.
>
> Not only -- mail header rewrites cause all my emails to go into people's
spam folders, if they were not directly listed in the To/CC headers...




>
>    1.
>
>
>
> Andy Schroder
>
> On 06/10/2015 02:36 PM, s7r wrote:
>
> The mail list is public, so it's not like the data on it is somehow
> sensitive. Sourcefoge is fine, it has a nice web UI where you can browse
> the message and sort/order them as you want, etc.
>
> Why would you want to move to a paid solution? And why would you want
> users to have to pay per message? This is the worst idea ever from my
> point of view. We want to encourage people to join the community, run
> full nodes, ask questions, come with solutions, ideas for improvements
> and so on. Everyone should read and write and contribute as much as
> possible with ideas in debates. You never know who can have bright ideas
> in some contexts.
>
> Bottom line is so far sourceforge handles the mail lists just fine. I
> don't see a single advantage another mail list provider / system could
> offer, except some headache and extra work for migration. The software
> distribution via sourcefoge was cancelled for obvious reasons which I
> fully understand and agree to, but it has nothing to do with the mail
> lists. We have way more important things to brainstorm about.
>
> On 6/10/2015 7:46 PM, Andy Schroder wrote:
>
>  Regarding changing the e-mail list provider. Is anyone interested in
> sponsoring it? There are non-free options, but it may be difficult to
> always ensure the fee is being paid to the provider. I think finding an
> agreeable free solution may have been the issue before? I've also
> thought of trying to make a pay per message or byte solution (and this
> cost could be dynamic based upon the number of current mailing list
> subscribers). This could solve the who pays problem (the sender pays),
> as well as motivate people to be more concise and clear with their
> messages, and at the same time limit spam.
>
>
>
> Any thoughts?
>
> Andy Schroder
>
> On 06/10/2015 05:35 AM, Wladimir J. van der Laan wrote:
>
>  On Wed, Jun 10, 2015 at 10:25:12AM +0200, xor wrote:
>
>  http://www.howtogeek.com/218764/warning-don%E2%80%99t-download-software-from-sourceforge-if-you-can-help-it/
>
>  All our downloads (even old ones) have recently been deleted from sourceforge, for this reason. They haven't been mentioned in Bitcon Core release announcements for a long time.
>
> No opinion on the mailing list. Though I think it's less urgent. The issue of moving the mailinglist has come up before a few times and people can't agree where to move to.
>
> Wladimir
>
>
> ------------------------------------------------------------------------------
>
>  ------------------------------------------------------------------------------
> _______________________________________________
> Bitcoin-development mailing listBitcoin-development@lists.sourceforge.nethttps://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>


-- 
Jeff Garzik
Bitcoin core developer and open source evangelist
BitPay, Inc.      https://bitpay.com/

[-- Attachment #2: Type: text/html, Size: 6289 bytes --]

Re: [Bitcoin-development] Is SourceForge still trustworthy enough to host this list?

[Wladimir J. van der Laan]

On Wed, Jun 10, 2015 at 09:36:23PM +0300, s7r wrote:
> The mail list is public, so it's not like the data on it is somehow
> sensitive. Sourcefoge is fine, it has a nice web UI where you can browse
> the message and sort/order them as you want, etc.
> 
> Why would you want to move to a paid solution? And why would you want
> users to have to pay per message? This is the worst idea ever from my
> point of view. We want to encourage people to join the community, run
> full nodes, ask questions, come with solutions, ideas for improvements
> and so on. Everyone should read and write and contribute as much as
> possible with ideas in debates. You never know who can have bright ideas
> in some contexts.
> 
> Bottom line is so far sourceforge handles the mail lists just fine. I
> don't see a single advantage another mail list provider / system could
> offer, except some headache and extra work for migration. The software
> distribution via sourcefoge was cancelled for obvious reasons which I
> fully understand and agree to, but it has nothing to do with the mail
> lists. We have way more important things to brainstorm about.

I completely agree here. I'm not against migration if a much better option comes along, but e.g. paying for another provider sounds like nonsense when sourceforge does this for free (with some minor annoyances - other providers will have their own).

Paying per message is far-fetched, something that could work in economic theory with perfectly spherical people in their perfectly efficient market. In practice the likely result would be a mailing list only used for advertisement and promotion, and technical discussion and release announcements would disappear.

BTW for people that *don't* like sourceforge's web archive UI there are some other options via gmane:

http://dir.gmane.org/gmane.comp.bitcoin.devel

Wladimir