Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add noreply setting to default docker compose file #320

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

Eevoo
Copy link

@Eevoo Eevoo commented Sep 12, 2021

I had to set this today because out of the box Zulip sends invites as noreply-@smtp.example.com instead of just noreply@smtp.example.com, which was causing email bounces as I didn't have a sending identity for that particular email address. The default is true for security reasons as listed in this hack, but I'd argue setting this setting to default to False will be the most pain-free way for most self-hosted users that are only running Zulip and not running it alongside an 'email to public support ticket tracker' feature.

Having said that, even if it is preferred to leave this at True, it will still help smooth the way for self-hosted users to find and change this setting up front rather than needing to track this down and manually create the setting.

I had to set this today because out of the box Zulip sends invites as noreply-<guid>@smtp.example.com instead of just noreply@smtp.example.com, which was causing email bounces as I didn't have a sending identity for that particular email address. The default is true for security reasons as listed in [this hack](https://medium.com/intigriti/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c), but I'd argue setting this setting to default to False will be the most pain-free way for most self-hosted users that are only running Zulip and not running it alongside an 'email to public support ticket tracker' feature. 

Having said that, even if it is preferred to leave this at True, it will still help smooth the way for self-hosted users to find and change this setting up front rather than needing to track this down and manually create the setting.
@timabbott
Copy link
Sponsor Member

@Eevoo thanks for the report; I don't understand why the emails would have been sent as noreply-@... rather than noreply-{random_token}@... -- did you have a typo in your explanation?

There is certainly an argument for going with the smooth approach rather than the most secure approach, but I want to make sure that there isn't a bug here as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants