patch is merged, waiting on a new release, https://github.com/kubernetes/minikube/pull/18233

@bcampbell setting this to declined, please reopen, if this is still a concern

After doing some exploration I don't think emulation is viable due to the complexity and the performance, so blocking this task until T320811 is resolved. In the interim running dcl on WMCS looks to be the best alternative.

@Xover if you could paste the headers of two of the messages that would help, the whole raw text would be the best however. I am curious how identical the emails are, as that would help indicate where they are being duplicated.

part of bookworm upgrade sprint week, but I ran out of time, not currently prioritizing this work.

In T360804#9680160, @akosiaris wrote:

FYI, this is going to be so pretty slow (anecdotal stories speak of standard puppet CI taking up to 15mins instead of a few secs, other workloads vary). See T320811 for the bigger picture, the rest of the tasks in ARM support spell out the various other problems met by developers.

@DBu-WMF the current dmarc monitoring is still a work in progress. ITS has purchased a subscription to dmarcdigests via the security budget, which is currently active, but they are not intending to keep the service long term. However you can open a ticket with ITS to request access, while it is still available. As another route @Jgreen wrote some scripts for ingesting the reports for their own needs and we briefly discussed reusing that tooling outside of fund raising tech, but the work has not been planned as of yet.

In T356920#9672323, @Aklapper wrote:

@jhathaway: Another question is why the task is in S4 (Hardware Procurement) while it seems to have nothing to do with hardware procurement?

Thanks for the poke @RoySmith, ITS obtained this information from Zendesk on how Zendesk's spam marking system operates:

@SLyngshede-WMF let's move discussion to phabricator. I tried the updated patch on my x86_64 hackintosh with minikube 1.32:

patch, https://gitlab.wikimedia.org/jhathaway/dcl/-/merge_requests/2

1. Incident metadata

butter:

well how does PHID-TASK-5tckxnd23nugdvfo3ziu, relate to T358398?

great, thanks!

@fgiunchedi any update on the phab acccount, should I reach out to someone?

obtained, and seems to work, closing

For reasons that are not clear, we stopped compressing on May 30th of 2023 we also don't seem to have any deletion rules in place.

@RoySmith I also asked ITS if we could use phabricator to communicate, since it is accessible by volunteers.

thanks for the additional context @Muehlenhoff!

@Muehlenhoff I think that makes sense, are the updates run manually when Debian issues a release?

In T338032#9530030, @Dzahn wrote:

@jhathaway Did you open one and have the number?

@RoySmith did you ever here anything back from the ticket you opened? Also, you said this was mentioned in another forum, in what context, was there another message marked as spam?

This set of steps looks correct to me, based on what @jbond did on T345067

sounds good, happy to help

@Jgreen the tool only provides a graph and a percentage, I have added you as a viewer of the domain, https://postmaster.google.com. If that doesn't work I am happy to screen share, or drop some pics on this ticket.

@Dwisehaupt postmaster tools shows dmarc failures for this domain. Do you know where it is being actively used in emails being sent out?

other than one-click unsubscribe, we are in compliance

@bcampbell I assume this is resolved, please go ahead and reopen if it is not.

obtained the credentials from @bcampbell, now I need to test them!

@ssingh thanks for the analysis, I am pretty sure it is correct. @bking as to your question, redacting passwords would be preferred. However, before we figure out if that is necessary, @Joe do you think you could weigh in on the use of wmflib::autogen_password, it wasn't clear to me from the git history as to its intended use?

Has anyone ever looked at the project-group-structure plugin, which allows for access scoped project creation?

Since VRTS is sending under <SUPPORT LIST>@wikimedia.org domain, most of what applies to the wikimedia.org domain applies here. Google sees the domain as in compliance with dkim, spf & dmarc.

auth results on my personal gmail instance:

@bcampbell patch is merged, if you want to give it a whirl!

@bcampbell patch is out for review

ah, that seems like a bug? However, dkim signature should be okay, since our dmarc record is set to relaxed. Which allows subdomain matching, i.e. dkim: wikimedia.org aligns with from: no-reply@phabricator.wikimedia.org.

After reading this post on reddit, I think I finally grok the intended setup, apologies for being a bit dense on this one:

In T355691#9498461, @taavi wrote:

Is it known/ok that Phab is sending mail from phabricator.wikimedia.org but the DKIM signature is for wikimedia.org?

In T356118#9498766, @taavi wrote:

Does it matter that the mx*.wikimedia.org servers do not currently add an Authentication-Results header?

I believe so, for instance here what I get from a mail from services.discover.com on my personal account:

@bcampbell do you have any idea why this might be? Not a critical issue, but it is nice to be able to check how a single message is validated by Google.

It appears to point to an SPF record:

@AlexisJazz were you able to reproduce?