On Aug 24, 2020, at 11:33 AM, Bruce Scherzinger webmaster@PROTECTED [Dada Mail Developers] dadadev@PROTECTED wrote:

From: webmaster@PROTECTED

So my idea is an installation option that allows you to choose a Bridge-only configuration that would install only what is needed. Would that be doable?

It's probably a project that's over and above what I'm willing to commit to taking on myself. The benefit just may be too small, as the way you're using the app is somewhat of a minority.

If there were more mature front ends to Dada Mail to swap out, or if Dada Mail's own front end system/API for manipulating list settings was more modular, it would be a realistic project. The code that lights up when Bridge handles a message is probably quite extensive, so there isn't going to be a huge win when it comes to memory use or processing needs. There's always going to be room for improvement in the future, but something your proposing is probably far, far off.

One of the big projects I have announced that I'd like to chip away at - it's a big one, is to make the build system for Dada Mail a little more open and malleable, since right now, you can't actually build Dada Mail from source - I and I alone have the build scripts. This wasn't something I intended, but little utility scripts just became large build systems in of themselves, which is not good. Part of that project will be options like, "hey write and add in the documentation" (or not!), "Use this as a source for all the email template layouts", etc - and maybe when this all gets mature, you'll be able to say which giant pieces of the app will be part of the distribution you're building. That's a far ways off.

--

Justin J: Lead Dadaist.url: http://dadamailproject.com email: justin@PROTECTED twitter: @dadamail skype: leaddadaist

Dada Mail Announcements:http://dadamailproject.com/cgi-bin/dada/mail.cgi/list/dada_announce/

On Aug 24, 2020, at 11:33 AM, Bruce Scherzinger webmaster@PROTECTED [Dada Mail Developers] dadadev@PROTECTED wrote:

From: webmaster@PROTECTED

Hey Justin,

Just an idea that's been rattling around in my head for a few years. As you may recall, I manage subscriptions to my Dada lists entirely through Joomla website accounts using an extension I wrote many years ago. All my lists are "closed" as far as Dada knows and the user portions of the web interface are not public. All email traffic is handled by Bridge. That means a fairly large amount of code in the full Dada package isn't really needed for my case.

Is there a clean delineation of files that can be omitted/removed and allow DM to function properly the way I'm using it? I read things about security vulnerabilities in code I don't need but which is installed and wonder if I can get rid of it and those vulnerabilities.

So my idea is an installation option that allows you to choose a Bridge-only configuration that would install only what is needed. Would that be doable?

Hope you are well, my friend.

Thanks,Bruce

On August 24, 2020 1:17:55 PM "Justin J justin@PROTECTED [Dada Mail Developers]" dadadev@PROTECTED wrote:

From: justin@PROTECTED

Howdy everyone,

v11.11.1 is out! A few bug fixes - most notably getting those tracker analytic emails actually go out, and some security holes closed up. (There's been no actual security exploits found)

Download and install:

https://dadamailproject.com/d/install_dada_mail.pod.html

Changelog (and below):

https://dadamailproject.com/d/changes_11_x.pod.html#pod11.11.1

Focus

This is mostly a bug-fix release for issues found in the v11.11.0 release of Dada Mail. There's also places we've tightened up some potential security exploits regarding the file browser/uploaders we ship with Dada Mail.

Changes

Directories managed in the, "dada_mail_support_files" directory will now have their permissions changed when not in use

Files and directories in the, dada_mail_support_files directory are ones that are served directly by the webserver. Items like images, javascript files, etc, are found here. The file managers/uploaders that are shipped with Dada Mail are installed here too. These are third-party apps in of themselves, and we don't have complete control over their development. Historically, security issues crop up in these apps, either in current or in past versions - it happens, and since their job is to upload files onto the web server, this can really cause chaos on a web hosting account.

To keep the attack surface as small as possible, Dada Mail will now always change the permissions of directories that are not in use to, 0644, rather than the more open, 0755. This will disallow access to the directory via something like a web browser.

Option to install no file manager uploader

Dada Mail has the option to install one of three bundled file managers: KCFinder, Rich FileManager, and Core 5 Filemanager. But it never had the option to install no file manager at all. This version adds the ability to select "Don't Install a File Browser/Uploader"

Bugfixes

"Send message tracker analytics report a few days after a mass mailing was sent " doesn't work - query is incorrect

https://github.com/justingit/dada-mail/issues/956

TinyMCE Vulnerability should be fixed in Dada Mail

https://github.com/justingit/dada-mail/issues/955

"Recent Activity" chart not loading

https://github.com/justingit/dada-mail/issues/954

--

Justin J: Lead Dadaist.url: http://dadamailproject.com email: justin@PROTECTED twitter: @dadamail skype: leaddadaist

Dada Mail Announcements:http://dadamailproject.com/cgi-bin/dada/mail.cgi/list/dada_announce/

Dada Mail Developers Post to: Dada Mail Developers ( dadadev@PROTECTED )Manage Your Subscription Unsubscribe

Dada Mail Developers Post to: Dada Mail Developers ( dadadev@PROTECTED )Manage Your Subscription Unsubscribe