COllaborative DEcision MAking (codema.in)

We now have an email alias/mailing list

Pirate Praveen Fri 7 Mar 2025 9:39AMPublicSeen by 4

I have created board@prav.app with private archives - you can see archives at https://lists.fsci.in/hyperkitty/ if you are logged in. We can use this for voting via gpg signed emails. Please maintain a GPG key for digital signatures (Thunderbird makes creation and using gpg very easy - you can do all of this from account settings -> end to end encryption graphically).

For people not using Thunderbird (it s also available in Android), you can try mailvelope web browser extension.

Pirate PraveenFri 7 Mar 2025 9:48AM

Please confirm if you got the welcome mail and the follow up mail I sent.

Pirate PraveenFri 7 Mar 2025 10:06AM

My default configuration for dmarc mitigation is replace from with list address, but this will break digital signature. Thunderbird says uncertain digital signature. Now trying the option to wrap message in an envelope.

Pirate PraveenFri 7 Mar 2025 10:53AM

May be we need to sign a file manually and attach it.

Pirate PraveenFri 7 Mar 2025 11:01AM

So at present, you need to create a text file, sign it, attach the .gpg file. 

gpg --sign board-vote-test.txt

Then people receiving it should save the attachment and verify it. This is more painful, but we can live with it until we figure out an easier method I think. Manually copying (cc) everyone instead of the alias would work.

gpg --decrypt board-vote-test.txt.gpg
This is a test message for board voting and OpenPGP.
gpg: Signature made Fri Mar  7 16:24:35 2025 IST
gpg:                using RSA key D30863E26020E543F4719A838F53E0193B294B75
gpg: Good signature from "Praveen Arimbrathodiyil (Pirate) <praveen.arimbrathodiyil@puri.sm>" [ultimate]
gpg:                 aka "Praveen Arimbrathodiyil (Pirate) <praveen@onenetbeyond.org>" [ultimate]
gpg:                 aka "Praveen Arimbrathodiyil (Pirate) <praveen@debian.org>" [ultimate]

Pirate PraveenFri 7 Mar 2025 11:25AM

gpg --sign --armor seems like a reasonable compromise - we still have to use command line to sign. but at least thunderbird can verify it.

Pirate PraveenFri 7 Mar 2025 11:31AM

So current status: mailman list setting don't do any dmarc mitigations. If disroot.org mails get delivered (autistici.org works fine), we are good for now. If disroot.org mails don't work, then we need to use gpg --sign --armor and attach the .asc file, which thunderbird can verify.

Pirate PraveenFri 7 Mar 2025 5:34PM

As per https://gitlab.com/mailman/mailman/-/issues/1056 if we keep subject prefix, and footer empty, we can get valid dkim and OpenPGP signed emails, for most cases.

Pirate PraveenMon 17 Mar 2025 12:05PM

I deleted the last thread which involved some personal details, we can discuss such topics also in the mailing list, which has private archives.