Category: COTS

Posted on

CPanel’s “Plus Addressing” feature is specifically weird and problematic.

I got off on a tangent recently, wanting Gitlab’s “Service Desk” functionality to work. This feature allows remote users to open issues via a crafted “Plus addressing” email address, i.e. gitlabaddress+gitlab-project-identifier@yourdomain.com. I did everything I was told to, and was struggling with why it wasn’t working. It just wasn’t detecting new emails at all.

So I logged into the webmail of the domain on which I had set up the email account, it’s a cPanel website by one of the big commodity shared hosting providers. Sure enough, nothing is in the inbox. Hmm. Maybe Plus Addressing isn’t as ubiquitous as I thought. I mean it’s been a thing with Gmail for a while now, but maybe…

Nope, research showed that cPanel has indeed adopted it.

But wait. Ooooooh, cPanel, you think you’re crafty, don’t you? Rather than just allow the email in and rely on the user to filter it, cPanel actually immediately routes the email to a folder named for whatever you throw in after the plus sign. If the folder doesn’t exist, it just creates one. That’s sure convenient! Except for one thing — the user has no way of knowing that folder exists, at least via webmail, because the user is not “subscribed” to new folders by default. The only way I was able to find the emails is to go into “Manage Folders”, then they show up in the folder list, with “subscribed” unchecked. So I subscribed, then viewed the emails, then dragged them into the inbox, where they were promptly picked up by Gitlab.

A unique problem that may require a unique solution… I’ll have to think on this one a bit. Ideally, I would want these emails to enter the inbox normally. I know they think they’re doing the right thing for users wanting to use this as a spam filtering mechanism, but by having different behavior than other vendors supporting the extension of email address with a plus sign, they have created a dilemma for vendors who choose to make use of this functionality in their features.

Tested also on my Thunderbird client. Sending to a nonexistent folder hides the message in a newly-created unsubscribed folder. No hint to the user that it exists. Sending to an existing folder adds a new unread message to that folder.

So you can put things into a recipients mailbox without anyone knowing they are there…
You can take up SPACE in a recipient’s mailbox, causing a denial of service, without them knowing why unless they go out of their way to look for unsubscribed folders. What if I sent 10,000 emails to that newly-created unsubscribed folders. Or even more annoying, 10,000 randomly-created folder names.

Fascinating.

Posted on

Is Gitlab a viable Atlassian alternative? Spoiler: maybe?

Maybe you’re one of those stubborn people like me who insists on self-hosting everything. Maybe it’s a requirement due to sensitivity of data, or maybe it’s just pride. In any case, that’s what I was doing. I was proud of my Atlassian setup. I happily paid my $10 each for 10-user licenses of various Atlassian products. Jira, Confluence, Bitbucket.

Everything was fine, and everyone was living happily ever after.

UNTIL.

And this is where I sacrifice my personality for professionalism. In my humble opinion, Atlassian made a huge error in judgement. They decided to end support for their “Server” line of products in favor of “Cloud” and “Data Center.” No more $10 10-user licenses for self-hosted apps. 10-user licenses are FREE now — in the cloud. You want to host it yourself? Fuck you, go get the Data Center version. How much is it? Well, if you have to ask…

And yes, I was holding back. I’m a little bitter.

So here I am, exploring ways I can take my business elsewhere. I’m a simple man with simple needs. I don’t need all the workflow bells and whistles that Jira offers. Hell, we don’t even use most of that at my job. At the core, I need projects and issues. Gitlab has that. And of course Gitlab can do everything that Bitbucket does. What’s left? Hmm, Confluence. Well, I’ll explore that part later. I do know that there’s a “Markdown Exporter” plugin for Confluence that will export “markdown” documents in a way that can be imported into Gitlab, Github and other apps. I just don’t know what the paradigm equivalent is for it just yet.

So let’s start with eradicating Bitbucket.

OK, I built a VM. CentOS 8. Gitlab’s installation instructions are crystal clear. A few prerequisites, an update, and a repo install, then a package installer. Nice, that’s how I like it. OK, they include a LetsEncrypt cert deployment by default. We’ll have to get rid of that, I have my own CA internally, and I issue certs from that. Done, not so hard. Next, SSO. I have FreeIPA in my infrastructure and had integrated the Atlassian products with that. Can I do that with Gitlab? Shit yeah. Easy as chocolate pie. A little bit of finagling with the .rb file and I’m in.

So now on to Bitbucket. Well, they just went and built in the integration/import functionality, just like that. I can give it my bitbucket login and password and import ALL of my bitbucket projects in one session. Lovely. I’m in tears over here. Literally ten minutes after getting Gitlab up and running in my environment, I’ve got all my git repos imported.

How about Jira? Well, it used to be a pain in the ass, when I first looked into it it sounded intimidating. “Well, you’ll need to do REST API queries to both services to translate everything blah blah blah”. Nope. Not anymore. The latest Gitlab has an importer built-in. It’s a little weird and roundabout, but it farging works. Go to, or create, a project. Go to the Issues page within that project. Click the “Import from Jira” button. Here’s where it gets weird. You have to re-enter the Jira integration details for each project before you can import that project’s issues. It would be nice if you could do it once, map the Jira projects to existing projects and choose to ignore or create the rest, and click it. But no problem. It brings them in, correctly lists some of them as closed. etc. It’s just going to take some time, thought and planning.

Confluence integration is going to require its own post, because getting all the confluence data over, including attached files, is going to be important to me. I use it as a home for a whole lot of documentation that I refer to frequently, and I can’t afford to lose it. So stay tuned for more on that.

I’d love to hear what other people are doing. I can’t be the only one dealing with the loss of the nearly-free Server products.