Redwood E-mail Lists -- Current Status
George Yefchak, Redwood webmaster

September 22, 2006

I've written the code necessary to send messages to any instrument group or groups.  This feature provides sort-of a replacement for the instrument group aliases which have been made ineffective due to CrystalTech's policy toward Comcast and AOL mail accounts (see below). There is now a web form which includes a list of checkboxes, one for each instrument, and a space to type in your message. Security is be implemented in two ways: (1) to use the form, you must enter your email address, and this address must match one of the addresses in the orchestra's email list. (2) the form includes a CATPCHA security image.

When the form is executed, an Access database query generates a list of e-mail address corresponding to the selected instrument groups. The server then sends a mail message to this dynamically created list of addresses. This proceeds without any reference to the moderated lists (see below), which is why any instrument group or groups can be used.

A link to the form is provided in the backstage area.

September 5, 2006

A year or two ago, CrystalTech stopped allowing mail to be auto-forwarded to addresses at the aol.com domain. Since our mail aliases operate by means of auto-forwards, this meant that AOL members would no longer receive mail sent to the orchestra, or two any of the subgroups or individual instrument groups. At the time, only Eric and a few other orchestra members were using AOL addresses. My solution was to create a moderated list containing all the AOL addresses, and full orchestra mail list which sent mail both to this new AOL members list and to all the subordinate aliases. Eventually Eric moved to a non-AOL address, and only three orchestra members remained on AOL -- one bassoon and two violins.

Two days from now (that is, on September 7, 2006), CrystalTech  will begin disallowing auto-forwards to Comcastaddresses as well. This is a bigger problem, since a much larger number of our members have addresses on the Comcast domain. It looks likely that auto-forwards to even more domains may be denied in the future. So, it really is time for our mail alias system, which relies on auto-forwarding, to go.

As of tonight, I've replaced the following aliases with true mailing lists:

• strings
• winds
• woodwinds
• brass
• percussion

Note that, as discussed below, we don't have enough mailing lists to accommodate the entire set of instrument groups. So these five groups, plus the full orchestra list of course, will have to do for now.

With only a few exceptions (including Eric, of course), you can only send a message to the group or groups you're a member of. So, for example, any of the flute players can send a message to the woodwinds or winds groups, but not to any others. If you wish to send a message to another group, or two the entire list, please send it to either me or to Eric and we'll forward it as appropriate.

I'm leaving the individual instrument aliases (e.g., trumpets, oboes, violas, etc.) up at least for a while. But note that members with an aol.com or Comcast address will not receive messages sent to these aliases. Meanwhile, I'm spending much of my "spare" time rewriting the ASP.net code which will carry out automated maintenance of the entire mail list system.

Sorry about all this...

August 12, 2006

Here is some information on the current status of our e-mail lists. Please contact me if you have suggestions for any improvements.

History

The orchestra’s first e-mail system was a private list maintained by Eric.  Soon thereafter, Rachel Harvey started a moderated list on eGroups, which was later assimilated into Yahoo! Groups. In 2004 I moved to a hierarchical mail alias system inspired by a similar system used by the HP Symphony Orchestra.  I chose CrystalTech.com  to host our web site specifically because they were one of the few shared-hosting services which allowed customer-management of hierarchical mail aliases.

In the hierarchical mail system, each orchestra member’s e-mail address is assigned to an instrument group, such as flutes, trumpets, percussion, etc. Most of these groups are assigned to parent groups such as woodwinds, brass, or strings.  The woodwinds and brass groups are assigned to their parent group, winds. Finally all the top-level groups are assigned to the full orchestra group. This allows messages to be sent easily to either the whole orchestra or to any specific set of instruments.

Implementation Details

As implemented in 2004, the mail lists are edited via custom ASP.net web forms and VB.net software written by me. To add a person to the list, either I or another authorized user visits a password-protected web page which allows the new member’s name, e-mail address, and instrument group to be specified. The software then carries out two similar but unrelated tasks: The e-mail address is added to the appropriate mail alias (using a .Net web service provided by CrystalTech’s mail software), and both the member’s real name and e-mail address are added to a password-protected Access database which resides in a hidden folder within the redwoodsymphony.org web server. Maintaining the member’s real name together with e-mail address in the database facilitates easier edits or deletions, since we don’t have to guess who BigGuy@gmail.com is (that’s just an example).

Spam

The problem with the mail aliases is that anyone can send mail to them. Ideally we should be using moderated lists rather than aliases, but there are difficulties with that (see below). For a year or so, very little spam was seen coming to the full orchestra mail list. Lately, however, spam has increased dramatically. Even worse, we’ve recently been afflicted with spoofing scams, where mail is being sent out as if it came from redwoodsymphony.org. Not only is this disturbing for the obvious reasons, but it also meant that everybody on the list received bounce messages when some of these spam mails hit invalid target addresses.

Options for Reducing Spam

Ideally each mail alias would be replaced with a moderated list, a type of mail list which offers several forms of protection against spam. To start, a moderated list can be configured to accept mail messages only from members of the group. This alone should vastly reduce spam. For additional protection, a list could be configured to accept mail only from the list moderator. Typically messages are sent to the moderator, and he/she posts them to the list if appropriate. A moderated list can be even further protected by requiring a password to be included in the subject line.

Unfortunately, several obstacles prevent me from moving from aliases to moderated lists. First, our web hosting service provides for only ten lists. And about half of our ten are already in use for our publicity e-mails as well as lists for the board, the marketing committee, and the volunteer group. Two options exist for solving this: I could purchase an additional web domain to obtain ten more groups, and/or I could eliminate the low-level groups and divide the orchestra only into the larger groups winds, strings, and percussion. Neither of these seems especially desirable.

A further complication is that setting a moderated list to accept messages only from its members doesn’t quite work for hierarchical lists. For example, the “members” of the full orchestra list are simply names of other lists (strings, etc.), not individual users. To circumvent this issue, I would need to write additional ASP.net software to assign individual e-mail addresses to all the groups. In this way, the hierarchy would exist only in Access database, while each mail list would contain a complete list of appropriate users. (This isn’t difficult, it’s just more work.)

Current Status

Because of the above complications, I’ve taken a simpler approach. I’ve replaced only the full orchestra mail alias with a moderated list. The members of this list are all the lower-level mail aliases, but permission to send mail is given only to Maestro Eric, Peter Stahl, and me. (The permissions list is expandable, of course.)

With this approach, anyone can send mail to the lower-level groups. This means you can contact members of your section, just as before. But to send a message to the entire group, you should send it to Eric or me. We’ll be happy to pass non-spam messages on to the full list if appropriate.

Future Plans

If the current solution is acceptable, I think we can stick with it. If lots of people want permission to send to the full list, and/or if we start seeing a significant amount of spam being sent to the lower-level groups, then I’ll need to consider either eliminating all mail aliases (to be replaced by a few moderated lists and appropriate new database software), or we’ll need to find an alternative mail system. Please let me know if you have comments or suggestions.