14 ms·

Why Some Security Experts Use Mutt

158 points by secfirstmd 11y ago

yeukhon 11y ago
The title carries sarcasm as soon as you finish the article half-way. I totally agree that usability is damn important. One reason I stopped using Ubuntu Desktop version is exactly the poor usability of Unity, and I now prefer headless (and if I ever need browser I'd use X-windows). For email client I either use Thunderbird, or Outlook 2013, simply because graphical interface is easier to work with. I code using VIM and I do a lot of work from terminal, but I can't image myself learning all the tricks like dragging image, setting up a meeting, viewing people's availability the next day all via terminal screen. Doable but I still think graphical interface has advantage. The thing I dislike about email clients like Outlook is their WYSIWYG editor as sometimes the editor is limited, or too aggressive. But since my job involves a lot of communication, I do need the convenience of WYSIWYG and COPY-PASTE. What a struggle.
- sp332 11y ago
  It's pretty easy to install other desktop environments on Ubuntu. I run with xfce because I just need a taskbar to keep track of my terminal windows.
  - p4bl0 11y ago
    Why bother with the desktop environment at all in that case? You could just install a window manager (I like Openbox but you may prefer a tiling wm) and xfce4-panel, which works pretty well standalone. This has been my setup for years now :).
    - iso8859-1 11y ago
      Good point. But what is a desktop environment anyway (one could argue that you made your own)? For example, Lxde already uses Openbox, yet Openbox is not just the "WM for LXDE".
      - p4bl0 11y ago
        Usually, desktop environments come with a lot of software, like a graphical file browser, games, something to display the content of a directory on the wallpaper (the "Desktop" itself), etc. that I don't need, so I prefer to install only what I need (and concerning graphical software, that is only openbox, xfce4-panel, emacs, rxvt-unicode, inkscape, gimp, and iceweasel). But in a sens you are right, it's like I composed my own minimal desktop environment :).
  - TsiCClawOfLight 11y ago
    Have you tried a tiling wm? I use i3, it's great :-)
    - sp332 11y ago
      I have tried one but the learning curve was too steep for my net productivity to recover.
- thanksgiving 11y ago
  I'd prefer things that need formatting be an attachment such as rtf or pdf leaving the email in plain text. There is no reason why personally written email needs rich text.
  - gress 11y ago
    It should also be all caps. There is no reason why personally written email needs two cases.
  - bigger_cheese 11y ago
    I use outlook at my work for email and its not uncommon to send screenshots and similar. A common workflow for me is to hit print screen paste into the message compose window, crop the image and super impose annotations onto it using the office drawing tools (circle, arrows, text box etc). I also like the integration with Communicator and calendar, Having notification about when people are online in meetings and which building they are in (my work has multiple sites) is handy. I don't usually like Microsoft products but Outlook is pretty solid in my opinion. The only alternative I've really seen is Lotus Notes.
    - mappu 11y ago
      Does that really crop the image, or just hide parts of it? I ask because cropping in Word can be undone by another recipient.
  - pbhjpbhj 11y ago
    Do you apply an extreme minimalist styling to other areas of your daily life - like "there's no need to clothes to be any other colour than gray"? or "there's no need for food to have a flavour as long as it's nutritious". Genuine question. Most people use some form of flourish even in handwriting - an underline, all-caps, increased letter size or spacing, a personally preferred colour; isn't it weird to not have the facility for that in email?
    - thanksgiving 11y ago
J_Darnley 11y ago
Reminds me on the inverse question I replied to from a few weeks ago: "Ask HN: Someone still using Thunderbird for Gmail in 2015?" https://news.ycombinator.com/item?id=10026641 https://news.ycombinator.com/item?id=10026641 To be honest, I never thought about the possible weakness of the html rendering in most clients. But then I am more concerned about my privacy than security.
- 0x0 11y ago
  How can you have pricacy without security?
morganvachon 11y ago
I don't use mutt anymore, but I still feel it's a beautiful client, both in its simplicity and its appearance (take the screenshot from the article, for example). I probably should start using it again since I'm transitioning away from Gmail to a traditional mail host.
- icebraining 11y ago
  I use Alpine instead; tried mutt first, but found it abstruse to set up.
  - raverbashing 11y ago
    Yeah, I'm biased towards (Al)pine, would be interesting to know how does Mutt compares with it
    - eru 11y ago
      I started with Pine, and used mutt for a bit later. Mutt is ok, if you invest the time in learning it. (If you can handle vim, you can cope with mutt.)
      - twic 11y ago
        Interesting. I've been using (al)pine for years, and there are bits of it which really frustrate me - mostly how slow it is when dealing with large mailboxes - so i have been considering a move to mutt for a while. I'm not a vim fan, so i might have to reconsider!
        eru 11y ago
        Oh, the specific keystrokes etc are not the same. (I don't think they even have the concept of modes in mutt.) It's more of a spiritual similarity. About as faint as vim / nethack.
lottin 11y ago
Another reason is that it spawns a text editor. Typing emails in a text widget without proper editing capabilities can be irritating.
- icebraining 11y ago
  In Firefox, you can use It's All Text! to edit the current text area in a proper editor. https://addons.mozilla.org/en-us/firefox/addon/its-all-text/ https://addons.mozilla.org/en-us/firefox/addon/its-all-text/
  - grayclhn 11y ago
    That works less and less as more websites offer "improved" text editing capabilities through javascript.
  - necessity 11y ago
    Pentadactyl also allows you to edit input fields with any editor (and many other things): http://5digits.org/nightlies http://5digits.org/nightlies Same goes for vimperator, of which Pentadactyl is a fork.
- Steltek 11y ago
  I'm rapidly returning to mutt from gmail because the new gmail compose widget is so bloody awful. I use Firefox-Aurora and the compose widget is sluggish, buggy, and the faux-window manager is a terrible paradigm. I'm fairly sure this isn't my aging brain calcifying on me and turning me into "grrr, I hate change": messages not sending when requested (or sending twice), line breaks not rendering, and a generally unresponsive UI. As a bonus, I can start toying with GPG for real now (for all of my friends and family that will never use GPG?).
- TsiCClawOfLight 11y ago
  Thunderbird and, I think, Kmail allow you to specify an external editor (probably vim, Emacs users would use something inside Emacs)
- foldr 11y ago
dogma1138 11y ago
Most "Security Experts" are working for consultancy, tech firms, and government agencies so they probably use plenty of other clients. The majority will probably run Outlook since Exchange is the defacto mail-server standard for any organization (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born), the rest will probably use Gmail or any other web-based mail that their smaller company is using. Most "experts" don't necessarily follow their own advice just as alcohol, drug use and smoking is more common in Doctors than any other diploma based profession out there, so can security "experts" run just as much as a shitty setup as everyone else and think that slightly better common sense and opsec will keep them safe which more often than not it would.
- totony 11y ago
  You can use mutt with Exchange servers and Gmail servers
  - hibbelig 11y ago
    Mutt and Exchange? Bliss! Would you happen to have a doc link handy?
    - kylek 11y ago
      I'm not sure about builtin support but there is always davmail (http://davmail.sourceforge.net/ http://davmail.sourceforge.net/) for exchange
    - mschuster91 11y ago
      IIRC Exchange does offer IMAP and SMTP...
      - totony 11y ago
        Exchange server sometimes choose to not provide smtp which is a pain. Their IMAP support is sometimes lacking too (i.e. imap-mail.outlook.com times out alot).
tptacek 11y ago
I don't know any security experts who do this. I do know a bunch of old-school nerds who use mutt because that's what they got started with.
- jvehent 11y ago
  I don't think people use mutt because of security (other than good PGP support). I think people use mutt because they like the efficiency of a lean, terminal based, email client.
  - dmix 11y ago
    That plus there aren't many good open source (non-web) options. Thunderbird is pretty bad.
    - simoncion 11y ago
      What's wrong with Thunderbird? Note that if you use it as an IMAP client for Gmail, that Gmail's IMAP implementation is -as I understand it- kinda bad, so you're gonna kinda have a bad time.
      - jvehent 11y ago
        There is nothing wrong with thunderbird, but it's a very different user experience from a terminal-based application. Side note: I use mutt with gmail imap and have no problem whatsoever. http://wiki.linuxwall.info/doku.php/en:ressources:astuces:mutt-kz_gpgme http://wiki.linuxwall.info/doku.php/en:ressources:astuces:mu...
      - ulrikrasmussen 11y ago
        I find that it hasn't really been designed for keyboard-only use. Some features, such as switching folders for instance, seem to require a mouse, or at least I haven't been able to find a shortcut for doing it. It's also kind of hard to avoid accidentally composing html emails - it cannot be disabled completely. I still use thunderbird myself though, as I haven't been able to find a better alternative for Linux. claws-mail comes close, but it does too much work in the ui thread, which grinds everything to a halt whenever it fetches email. Why do mail clients all seem to suck so much, given how much people use email?
methehack 11y ago
I'm not sure I buy the reasoning on "surface area", at least not the specific comparisons in the article. It seems unfair to count Chrome but not Unix. For that matter, shouldn't we count the surface area of everything that touches the email as it hops around, including routers, etc? And isn't that the whole problem with email that the protocol does not require secure transport? So, seems like the only way to make that even vaguely secure is to use PGP (or something) on top, in which case who cares about mutt...
- mike_hearn 11y ago
  Right. "Let's switch from an email client written in a safe high level language that's also running inside multiple sandboxes and which has a full time security team (e.g. gmail) to ...... a mail client written in C" Doesn't seem like a great approach.
  - sahara 11y ago
    (Preemptive N.B.—I'm far from an expert, but I'm very interested in seeing this aspect of the topic discussed further by folks who might be experts.) Isn't the general premise here that one can choose to package up any program in as many deeply nested (virtual or physical) sandboxes as one would like, but there's an inherent benefit to the piece of software inside all those boxes exposing to one's adversary as few avenues as possible to attempt to escape them (specifically as it pertains to people in the business of painting targets on their backs e.g. Soghoian)? Put another way, of course Gmail and Chrome have dedicated security teams, but they won't ever have prevent $GIVEN_INFOSEC_RESEARCHER's box from getting owned teams.
  - benmmurphy 11y ago
    C is not too bad in this situation. If you implement DEP + ASLR correctly and do not give the attacker access to an interpreter (javascript/fonts/xslt/etc) then it is quite difficult (impossible except for luck?) for an offline attacker to gain code execution. You need to leak information about the programs memory layout in order to bypass DEP but how do you do that with an email? The best vector is probably taking control of the IMAP/POP server Mutt is connecting to and finding a vuln that will leak an address back to the server and another vuln that will take control over the instruction pointer. Or alternatively hope there is some broken shell command injection lurking in Mutt.
jbk 11y ago
I still use mutt (and default to text), but I don't see anyone else doing this, even in my geek coworkers or friends. So I'm a bit surprised by this article. I use mutt because it's very very fast, and quite customizable (I maintain a kind of 0-inbox through a set of hotkeys, + spamassin + procmail). To handle numerous mailing-lists with medium volume, it's so far the best I've seen. I tried many email clients (on Windows, OSX and Linux), but I always come back to mutt, because it's the fastest to handle the high-volume of email I have...
- jvehent 11y ago
  Same here. I can sort through 300 emails in a few minutes, removing/organizing the cruft into folders, and keeping only a handful of them I need to reply to. That, plus excellent PGP support, just makes mutt a much better email client that any other existing ones, local or web.
- blumentopf 11y ago
  Subscribe to LKML or one of the subsystem mailing lists (e.g. dri-devel). Pretty much the majority of Linux kernel developers seem to be using Mutt. (Disclosure: Me too, since 1997 in fact when I needed to replace ELM.)
- heipei 11y ago
  I've been using mutt exlusively for many years, and I got a fair amount of flack for it every now and then. While I like to believe that it's more secure than any full-featured bloated mail-client (hello Thunderbird), my reason for using mutt is simpler. I like the speed, efficiency and customization aspects of mutts, plus being able to use vim to compose my mails. Quite frankly, I don't get how people rave about text editors but then fail to include them in their mail workflow, which is where people spend quite a bit of time nowadays. The other reason I like mutt is because it still conforms to the UNIX principle: One thing and one thing well. True, you could use mutt for SMTP/IMAP, but there are better tools for that. I use mutt with offlineimap, msmtp and mu (for searching).
- tomphoolery 11y ago
  I'm also a mutt user. Love being able to edit documents with Vim, stable PGP support, and the mnemonic hot keys. However, I wish I knew more (or could remember more) about how it works...and I can't seem to get folders to synchronize properly from `offlineimap` (though `procmail` lets me search my mail rather easily).
skepticaluchiha 11y ago
Popular mail clients such as Thunderbird and Outlook are underattack so the "Security experts" use lesser known clients. I do believe GPG should have been mentioned more besides the Enigmail mention since we are talking about security.
michaelsbradley 11y ago
I use mu4e[1] to read, search and refile my emails, and there's a keyboard shortcut for viewing an HTML email in a browser. offlineimap[2] handles inbound messages. I love it! But for writing email, I still tend to jump over to Apple Mail. msmtp[3] handles outbound messages on those occasions when I choose to fire off a message from within mu4e. [1] http://www.djcbsoftware.nl/code/mu/mu4e.html http://www.djcbsoftware.nl/code/mu/mu4e.html [&] https://github.com/djcb/mu https://github.com/djcb/mu [2] https://github.com/OfflineIMAP/offlineimap https://github.com/OfflineIMAP/offlineimap [3] http://msmtp.sourceforge.net/ http://msmtp.sourceforge.net/
- delish 11y ago
  I used mutt when I used vim, but after switching to emacs, I began using mu4e. Very keyboard-driven and scriptable. Glad to see others on HN using it. Speaking to your not using mu4e to compose mail, I compose mail in org-mode (I often make lists in emails) then copy them into an mu4e buffer. Funny to see someone using uncommon software the same way I do.
- toothbrush 11y ago
  I also use mu4e, and i'm curious, why do you switch to Mail.app for composing? I love the fact that all my editor customisations (of which there are many) are still there when i'm writing email.
  - deong 11y ago
    To each their own, obviously, but this does seem profoundly weird. I can't imagine anyone choosing an Emacs-based mua and not using the editing ability for composing mail.
    - michaelsbradley 11y ago
      I've been using Apple Mail since the OS X Public Beta in 2000. Its address completion and rich text support are entwined in how I think about authoring emails, so I'm simply more comfortable using it for that purpose. It also helps that Emacs-style movement keys work throughout OS X, including Apple Mail's "new message" windows. I did give mu4e a go, i.e. for writing emails, and I never got to a point where it really appealed to me. I do love it, though, for reading and managing my tens of thousands of email messages. It's also nice that I can easily create links to messages in mu4e, which I can include in my org-mode files.
mfincham 11y ago
There are several slightly less hardcore alternatives to Mutt for those wanting a more modern e-mail experience without the security baggage of running an entire browser. Sylpheed for instance is a very pleasant text-only MUA (http://sylpheed.sraoss.jp/en/ http://sylpheed.sraoss.jp/en/). For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access.
- dfc 11y ago
  Text-only? I could have sworn sylpheed was a GUI program.
- kjs3 11y ago
  For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access. Do you have an example? Sounds like a pretty awesome setup that you should share.
  - mfincham 11y ago
    I will see if I can get it tidied up enough I'd be comfortable sharing :)
mrbill 11y ago
I've used mutt since '98 or so, and see no reason to change. For HTML email I can either pipe it into lynx or bounce it to Gmail.
hackuser 11y ago
Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying messages. You can leave it in plain text mode and, in the event you really need to view HTML, switch it to "Simple" or full HTML. It also can block remote images and, I think, all JavaScript. The wonderful Nostalgy add-on provides a very responsive keyboard interface. https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/ https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/ I don't know if current Thunderbird versions include all that, however.
- JohnTHaller 11y ago
  I use Thunderbird and keep it set as text only for sending and remote images loading is disabled by default (as it should be). JavaScript in emails is not loaded or run.
  - hackuser 11y ago
    Thanks. > I use Thunderbird and keep it set as text only for sending Is that an option for viewing messages? That's where the security risk mostly exists.
    - JohnTHaller 11y ago
      View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext. Loading of external images is fully disabled by default. You can enable it per-email by clicking as well as per-sender (which I don't personally do or recommend). Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is significantly reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity. That wipes out the vulnerabilities used in the vast majority of attacks right off the bat. Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.
  - deleted 11y ago
jakeogh 11y ago
I like alot: https://github.com/pazz/alot https://github.com/pazz/alot
massysett 11y ago
I used to use Mutt, but these days I do over 75% of my mail reading on a phone, and on a phone Mutt is a non-starter.
- schoen 11y ago
  I have used it from a phone with a terminal emulator over ssh (all of my phones have had keyboards). It was impressive to see how the keyboard supported mapping swipe gestures to cursor movement keys so that I could swipe up and down in my mutt message listings.
  - kragen 11y ago
    What's the best QWERTY-keyboard phone now?
    - luxpir 11y ago
      You would have to use an ancient modem or just sync emails by serial cable/irda, but the Psion 5MX was about the pinnacle of portable content creation hardware, IMO. With it you can write emails or whole books if you wish. Some prefer the 3 series, but not necessarily for the keyboard. 25-40hr battery life on 2 AAs, insta-on operation, CF card transfer of files - no wonder people are still using them. Now that people are not as fixated on having colour screens, being primed to now accept e-ink style displays, is there a chance we could get a similar device with more modern specs? I think I'd still rather work from a palmtop than a laptop or phone when not at a 'workstation'. I used an N900 for a long time (relatively speaking) and found its keyboard to be solid, but not in a way that could make writing or emailing tasks more productive.
      - kragen 11y ago
        It does look pretty awesome, but I can't find anybody selling Psions here in Buenos Aires, and it seems like they might lack something in the camera, GPS, 3-D modeling, and audio department. Like, I recorded a beatboxer at a public gathering today on my Android phone, and more than once I've sketched things on paper and photographed them with it, quite aside from other creative uses for photography.
gooseyard 11y ago
I've used mutt for ages, but a couple of years ago I switched to Karel Zak's mutt-kz branch (https://github.com/karelzak/mutt-kz https://github.com/karelzak/mutt-kz), which integrates notmuch into mutt. The setup is a little fussy (although well documented), but the results are spectacular. Mutt's search was never horrible but with notmuch its nutty fast, and the tagging feature makes dealing with search and mailing lists very convenient.
- pilooch 11y ago
  You can use mairix as a search system outside of mutt. Results are a temporary mailbox.
  - danieldk 11y ago
    notmuch can generate temporary maildirs as well with this script: http://git.notmuchmail.org/git/notmuch/blob_plain/HEAD:/contrib/notmuch-mutt/notmuch-mutt http://git.notmuchmail.org/git/notmuch/blob_plain/HEAD:/cont... However, in my experience mutt-kz is much faster. Plus, you get tagging everywhere (if you use it) and threads can be reconstructed across folders (helpful when your own mails are in a 'Sent' folder).
bakul 11y ago
I still use mh (well, nmh now) programs for my personal email. There is nothing that beats mh's "pick" program for selecting emails.
- a3n 11y ago
  Does imap figure anywhere in your mix?
  - bakul 11y ago
    Nope! I forward mail from various other email addresses to my email address where I care.
- dllthomas 11y ago
  I <3 nmh.
sanatgersappa 11y ago
Wish it was more user friendly and ran well on Windows (yes, I'm that guy). A good example of something that is user friendly, fast, secure and runs almost everywhere is the messaging client Telegram. Would be great if there were more programs like it.
- smt88 11y ago
  I think we're past the point of apologizing for using Windows. I just switched back after 5 years on Ubuntu and have been thrilled how things just work.
- simoncion 11y ago
  > Wish [mutt] was more user friendly and ran well on Windows... I would be shocked if Cygwin's mutt port didn't run just as well on Windows as it did on Linux. Remember that UNIX software that you compile with Cygwin becomes a native Windows executable.
  - dredmorbius 11y ago
    I was going to suggest this. It does.
  - mappu 11y ago
    Software you compile with Cygwin's GCC becomes a native Cygwin executable, with its own concepts of paths, processes, symlinks and environment. All binaries compiled with Cygwin always inherit GPL virality. The Cygwin OS is coincidentally hosted on Windows and mostly plays nice with it. Software you compile with Mingw(-w64)'s GCC becomes a native Windows executable.
    - simoncion 11y ago
      AFAICT, Unix software that you compile with Cygwin's tools understands both Unix paths and Windows style paths. [0] It also understands Windows environment variables. [1] Cygwin is aware of Windows processes. [2] Cygwin is aware of the Windows registry. [3] The executables that are created by the default Cygwin build process are PE executables that have a dependency on the Cygwin DLLs and run on any Windows system. They are native Windows software, with a dependency on a third-party DLL. If you build open-source software against the Cygwin libraries, that software can be distributed under its original license. If you modify the Cygwin build process to produce executables that do not depend on the Cygwin libraries, then you can distribute that software under any licence you like. Regardless, if you have cash you can always reach alternative licensing terms if you reach out to Red Hat. [4] Cygwin symlinks don't make use of NTFS junction points, but I imagine that that is for two reasons: 1) Cygwin might be run on a FAT32 system. 2) There are many, many, many pieces of Windows software (some of it is big name software!) out there that blow up spectacularly when they encounter a Junction Point. (Indeed, it was my direct experience that Windows Explorer behaved very poorly when asked to recursively delete a folder containing a couple of Junction Points in -I think- pre-SP1 Windows 7. I haven't tried JPs in AGES, so I can't speak to whether or not MSFTs own tooling has gotten better.) At a minimum, software compiled against Cygwin meets the most basic definition of Windows software (A PE executable that runs on Windows systems). I hope that I have made it clear that the Cygwin libraries also provide a large amount of interoperability between Unix software and software originally written for Windows. [0] Try it out. Fire up a Cygwin Bash shell and do the following (assuming that you're running on an English-language Windows): echo "hello there" > "$USERPROFILE\Desktop\helloThere.txt" then check the new file on your desktop. rm works just fine, too. Forward slashes work in paths, also! [1] Try this out in a Cygwin bash shell: echo $APPDATA ; echo $LOCALAPPDATA ; echo $SYSTEMROOT [2] Again, in a cygwin bash shell do: ps -W [3] Do (in a Cygwin bash shell): ls /proc/registry/ [4] https://cygwin.com/licensing.html https://cygwin.com/licensing.html
aidenn0 11y ago
Claws (and sylpheed, which it is a fork of) is by default text-only (html rendering only through a plugin). I used to use just mutt, but use claws quite a bit now.
- nickpsecurity 11y ago
  My graphical client of choice. Lightweight, quick, and relatively easy to box in. Didn't play with Gmail so nicely so I access it a different way. Works with other accounts fine.
leephillips 11y ago
I use mutt because after you learn of its power, other mail clients reveal themselves to be toys. I keep all my active correspondence in my inbox (5773 messages at the moment). With a few keystrokes I can instantly create a subset of my inbox optimized for the task at hand. (People who use toys instead of mutt often advocate an "inbox zero" approach, I understand.)
- eru 11y ago
  You can do the same two things with gmail. (There are lots of things mutt does that gmail doesn't, of course.)
  - leephillips 11y ago
    What two things? I'm not an expert on Gmail's keyboard interface. How, for example, can I see all the messages from Joe Zwanizol that are more than 15 days but less than 60 days old, using only the keyboard, in five seconds?
    - eru 11y ago
      > What two things? The two things mentioned: quickly-customized inboxes (via search) and handling lots of emails. > How, for example, can I see all the messages from Joe Zwanizol that are more than 15 days but less than 60 days old, using only the keyboard, in five seconds? There's a search syntax for that. Not sure whether you'll type it out in five seconds. A browser extension to bring mutt keyboard interface to gmail might be useful for some folk.
      - leephillips 11y ago
        After looking for it I found the search syntax, so it would seem that something like this is possible, as you say. But it's not as expressive as mutt's pattern language, so would be clunkier to use. But it is there.
therealmarv 11y ago
Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care." So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for security sake. So what happens if you want to view a html email? What about mail on a mobile phone (I guess security experts do not use them)? And mutt has other attack surface because it is using the terminal. Look here for a Ubuntu security notice about mutt: http://www.ubuntu.com/usn/usn-2440-1/ http://www.ubuntu.com/usn/usn-2440-1/ Now I smile because gmail is not affected by that! This is all not practical for 99,9% of normal users out there. If you care about security do not let the paranoia control you. We need to improve security for the normal users out there. Just my opinion.
- hyyypr 11y ago
  You can read html emails in mutt with decent support, using "links" or a somilar app. Mutt let's you define application that generate dumps for a given MIME type. See: https://www.debian-administration.org/article/75/Reading_HTML_email_with_Mutt https://www.debian-administration.org/article/75/Reading_HTM...
- toothbrush 11y ago
  I used to use mutt (now i use mu4e) and indeed i do not own a mobile phone capable of more than GSM. Also, as mentioned elsewhere, HTML rendering works fine in mutt and mu4e (although perhaps this opens me up to various nefarious things). I don't do this because i'm a security expert (i'm not), i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. EDIT: Oh yeah, and i'd never trust my web browser with my PGP key...
  - dmd 11y ago
    > i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. The trouble is that most people who say this end up doing 6 things that take 200 ms each (with the keyboard) instead of 1 thing that takes 1 second (with the mouse), and feel like they're zooming along in hyperspace. You feel like a leet hacker, but are you really getting anything done more efficiently?
kkapelon 11y ago
The sup email client is another good option. Text mode like mutt but threads emails like gmail http://supmua.org/ http://supmua.org/
koevet 11y ago
I do use mutt as my principal e-mail client. It started as an experiment, now I fully transitioned to it. I enjoy being able to compose messages in vim and the tight integration with gpg. In case you want to try mutt out, some time ago I wrote a short guide about setting up mutt on osx, http://www.lucianofiandesio.com/getting-started-with-mutt-on-osx http://www.lucianofiandesio.com/getting-started-with-mutt-on...
0XAFFE 11y ago
As I'm a emacs person, I tried once wanderlust[1] and got hooked up to it. Wanderlust is mail client which supports a wide variety of protocols. For me the biggest advantages are the blazing fast IMAP support and the whole emacs thing (Keybindings, Help (C-h b for all keybindings in this buffer, priceless I have to say), the possibility to run it either in GUI or in a terminal, etc). Recently the devs uploaded it to melpa[2] which makes it even more easy to get started. I would definitly recommend it, to people who are already using emacs, its such a joy! [1] https://github.com/wanderlust/wanderlust https://github.com/wanderlust/wanderlust [2] http://melpa.org/#/wanderlust http://melpa.org/#/wanderlust
- rekado 11y ago
  Another Emacs person here. I'm using offlineimap+msmtp together with mu4e. I prefer not to do IMAP sync or mail delivery in Emacs itself.
  - p4bl0 11y ago
    I do the same, except I use emacs build-in SMTP (smtpmail) directly. I'm quite happy with it :). What is the advantage of msmtp?
  - nextos 11y ago
    Have you tried isync? I was using offlineimap before, but found it buggy and inefficient.
    - darkr 11y ago
      Currently using isync for those exact reasons. Only issue that I have with it is that it doesn't support nested folders.
    - hiq 11y ago
      What are the bugs you are referring to? I have been using it for a few weeks for a couple of mail accounts without trouble so far. It could probably be faster though (customizing 'maxconnections' does help).
lloydde 11y ago
> A quarter of a century ago, checking your email meant logging onto a mainframe The lead in seems incorrect. Pine wasn't publicly released until 1992. By the early 90s many college and university environments were thin clients or unix workstations connecting to unix servers.

158 points by secfirstmd 11y ago

The title carries sarcasm as soon as you finish the article half-way. I totally agree that usability is damn important. One reason I stopped using Ubuntu Desktop version is exactly the poor usability of Unity, and I now prefer headless (and if I ever need browser I'd use X-windows). For email client I either use Thunderbird, or Outlook 2013, simply because graphical interface is easier to work with. I code using VIM and I do a lot of work from terminal, but I can't image myself learning all the tricks like dragging image, setting up a meeting, viewing people's availability the next day all via terminal screen. Doable but I still think graphical interface has advantage. The thing I dislike about email clients like Outlook is their WYSIWYG editor as sometimes the editor is limited, or too aggressive. But since my job involves a lot of communication, I do need the convenience of WYSIWYG and COPY-PASTE. What a struggle.

sp332 11y ago
It's pretty easy to install other desktop environments on Ubuntu. I run with xfce because I just need a taskbar to keep track of my terminal windows.
- p4bl0 11y ago
  Why bother with the desktop environment at all in that case? You could just install a window manager (I like Openbox but you may prefer a tiling wm) and xfce4-panel, which works pretty well standalone. This has been my setup for years now :).
  - iso8859-1 11y ago
    Good point. But what is a desktop environment anyway (one could argue that you made your own)? For example, Lxde already uses Openbox, yet Openbox is not just the "WM for LXDE".
    - p4bl0 11y ago
      Usually, desktop environments come with a lot of software, like a graphical file browser, games, something to display the content of a directory on the wallpaper (the "Desktop" itself), etc. that I don't need, so I prefer to install only what I need (and concerning graphical software, that is only openbox, xfce4-panel, emacs, rxvt-unicode, inkscape, gimp, and iceweasel). But in a sens you are right, it's like I composed my own minimal desktop environment :).
- TsiCClawOfLight 11y ago
  Have you tried a tiling wm? I use i3, it's great :-)
  - sp332 11y ago
    I have tried one but the learning curve was too steep for my net productivity to recover.
thanksgiving 11y ago
I'd prefer things that need formatting be an attachment such as rtf or pdf leaving the email in plain text. There is no reason why personally written email needs rich text.
- gress 11y ago
  It should also be all caps. There is no reason why personally written email needs two cases.
- bigger_cheese 11y ago
  I use outlook at my work for email and its not uncommon to send screenshots and similar. A common workflow for me is to hit print screen paste into the message compose window, crop the image and super impose annotations onto it using the office drawing tools (circle, arrows, text box etc). I also like the integration with Communicator and calendar, Having notification about when people are online in meetings and which building they are in (my work has multiple sites) is handy. I don't usually like Microsoft products but Outlook is pretty solid in my opinion. The only alternative I've really seen is Lotus Notes.
  - mappu 11y ago
    Does that really crop the image, or just hide parts of it? I ask because cropping in Word can be undone by another recipient.
- pbhjpbhj 11y ago
  Do you apply an extreme minimalist styling to other areas of your daily life - like "there's no need to clothes to be any other colour than gray"? or "there's no need for food to have a flavour as long as it's nutritious". Genuine question. Most people use some form of flourish even in handwriting - an underline, all-caps, increased letter size or spacing, a personally preferred colour; isn't it weird to not have the facility for that in email?
  - thanksgiving 11y ago

J_Darnley 11y ago

Reminds me on the inverse question I replied to from a few weeks ago: "Ask HN: Someone still using Thunderbird for Gmail in 2015?" https://news.ycombinator.com/item?id=10026641 https://news.ycombinator.com/item?id=10026641 To be honest, I never thought about the possible weakness of the html rendering in most clients. But then I am more concerned about my privacy than security.

0x0 11y ago
How can you have pricacy without security?

morganvachon 11y ago

I don't use mutt anymore, but I still feel it's a beautiful client, both in its simplicity and its appearance (take the screenshot from the article, for example). I probably should start using it again since I'm transitioning away from Gmail to a traditional mail host.

icebraining 11y ago
I use Alpine instead; tried mutt first, but found it abstruse to set up.
- raverbashing 11y ago
  Yeah, I'm biased towards (Al)pine, would be interesting to know how does Mutt compares with it
  - eru 11y ago
    I started with Pine, and used mutt for a bit later. Mutt is ok, if you invest the time in learning it. (If you can handle vim, you can cope with mutt.)
    - twic 11y ago
      Interesting. I've been using (al)pine for years, and there are bits of it which really frustrate me - mostly how slow it is when dealing with large mailboxes - so i have been considering a move to mutt for a while. I'm not a vim fan, so i might have to reconsider!
      - eru 11y ago
        Oh, the specific keystrokes etc are not the same. (I don't think they even have the concept of modes in mutt.) It's more of a spiritual similarity. About as faint as vim / nethack.

lottin 11y ago

Another reason is that it spawns a text editor. Typing emails in a text widget without proper editing capabilities can be irritating.

icebraining 11y ago
In Firefox, you can use It's All Text! to edit the current text area in a proper editor. https://addons.mozilla.org/en-us/firefox/addon/its-all-text/ https://addons.mozilla.org/en-us/firefox/addon/its-all-text/
- grayclhn 11y ago
  That works less and less as more websites offer "improved" text editing capabilities through javascript.
- necessity 11y ago
  Pentadactyl also allows you to edit input fields with any editor (and many other things): http://5digits.org/nightlies http://5digits.org/nightlies Same goes for vimperator, of which Pentadactyl is a fork.
Steltek 11y ago
I'm rapidly returning to mutt from gmail because the new gmail compose widget is so bloody awful. I use Firefox-Aurora and the compose widget is sluggish, buggy, and the faux-window manager is a terrible paradigm. I'm fairly sure this isn't my aging brain calcifying on me and turning me into "grrr, I hate change": messages not sending when requested (or sending twice), line breaks not rendering, and a generally unresponsive UI. As a bonus, I can start toying with GPG for real now (for all of my friends and family that will never use GPG?).
TsiCClawOfLight 11y ago
Thunderbird and, I think, Kmail allow you to specify an external editor (probably vim, Emacs users would use something inside Emacs)
foldr 11y ago

dogma1138 11y ago

Most "Security Experts" are working for consultancy, tech firms, and government agencies so they probably use plenty of other clients. The majority will probably run Outlook since Exchange is the defacto mail-server standard for any organization (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born), the rest will probably use Gmail or any other web-based mail that their smaller company is using. Most "experts" don't necessarily follow their own advice just as alcohol, drug use and smoking is more common in Doctors than any other diploma based profession out there, so can security "experts" run just as much as a shitty setup as everyone else and think that slightly better common sense and opsec will keep them safe which more often than not it would.

totony 11y ago
You can use mutt with Exchange servers and Gmail servers
- hibbelig 11y ago
  Mutt and Exchange? Bliss! Would you happen to have a doc link handy?
  - kylek 11y ago
    I'm not sure about builtin support but there is always davmail (http://davmail.sourceforge.net/ http://davmail.sourceforge.net/) for exchange
  - mschuster91 11y ago
    IIRC Exchange does offer IMAP and SMTP...
    - totony 11y ago
      Exchange server sometimes choose to not provide smtp which is a pain. Their IMAP support is sometimes lacking too (i.e. imap-mail.outlook.com times out alot).

tptacek 11y ago

I don't know any security experts who do this. I do know a bunch of old-school nerds who use mutt because that's what they got started with.

jvehent 11y ago
I don't think people use mutt because of security (other than good PGP support). I think people use mutt because they like the efficiency of a lean, terminal based, email client.
- dmix 11y ago
  That plus there aren't many good open source (non-web) options. Thunderbird is pretty bad.
  - simoncion 11y ago
    What's wrong with Thunderbird? Note that if you use it as an IMAP client for Gmail, that Gmail's IMAP implementation is -as I understand it- kinda bad, so you're gonna kinda have a bad time.
    - jvehent 11y ago
      There is nothing wrong with thunderbird, but it's a very different user experience from a terminal-based application. Side note: I use mutt with gmail imap and have no problem whatsoever. http://wiki.linuxwall.info/doku.php/en:ressources:astuces:mutt-kz_gpgme http://wiki.linuxwall.info/doku.php/en:ressources:astuces:mu...
    - ulrikrasmussen 11y ago
      I find that it hasn't really been designed for keyboard-only use. Some features, such as switching folders for instance, seem to require a mouse, or at least I haven't been able to find a shortcut for doing it. It's also kind of hard to avoid accidentally composing html emails - it cannot be disabled completely. I still use thunderbird myself though, as I haven't been able to find a better alternative for Linux. claws-mail comes close, but it does too much work in the ui thread, which grinds everything to a halt whenever it fetches email. Why do mail clients all seem to suck so much, given how much people use email?

methehack 11y ago

I'm not sure I buy the reasoning on "surface area", at least not the specific comparisons in the article. It seems unfair to count Chrome but not Unix. For that matter, shouldn't we count the surface area of everything that touches the email as it hops around, including routers, etc? And isn't that the whole problem with email that the protocol does not require secure transport? So, seems like the only way to make that even vaguely secure is to use PGP (or something) on top, in which case who cares about mutt...

mike_hearn 11y ago
Right. "Let's switch from an email client written in a safe high level language that's also running inside multiple sandboxes and which has a full time security team (e.g. gmail) to ...... a mail client written in C" Doesn't seem like a great approach.
- sahara 11y ago
  (Preemptive N.B.—I'm far from an expert, but I'm very interested in seeing this aspect of the topic discussed further by folks who might be experts.) Isn't the general premise here that one can choose to package up any program in as many deeply nested (virtual or physical) sandboxes as one would like, but there's an inherent benefit to the piece of software inside all those boxes exposing to one's adversary as few avenues as possible to attempt to escape them (specifically as it pertains to people in the business of painting targets on their backs e.g. Soghoian)? Put another way, of course Gmail and Chrome have dedicated security teams, but they won't ever have prevent $GIVEN_INFOSEC_RESEARCHER's box from getting owned teams.
- benmmurphy 11y ago
  C is not too bad in this situation. If you implement DEP + ASLR correctly and do not give the attacker access to an interpreter (javascript/fonts/xslt/etc) then it is quite difficult (impossible except for luck?) for an offline attacker to gain code execution. You need to leak information about the programs memory layout in order to bypass DEP but how do you do that with an email? The best vector is probably taking control of the IMAP/POP server Mutt is connecting to and finding a vuln that will leak an address back to the server and another vuln that will take control over the instruction pointer. Or alternatively hope there is some broken shell command injection lurking in Mutt.

jbk 11y ago

I still use mutt (and default to text), but I don't see anyone else doing this, even in my geek coworkers or friends. So I'm a bit surprised by this article. I use mutt because it's very very fast, and quite customizable (I maintain a kind of 0-inbox through a set of hotkeys, + spamassin + procmail). To handle numerous mailing-lists with medium volume, it's so far the best I've seen. I tried many email clients (on Windows, OSX and Linux), but I always come back to mutt, because it's the fastest to handle the high-volume of email I have...

jvehent 11y ago
Same here. I can sort through 300 emails in a few minutes, removing/organizing the cruft into folders, and keeping only a handful of them I need to reply to. That, plus excellent PGP support, just makes mutt a much better email client that any other existing ones, local or web.
blumentopf 11y ago
Subscribe to LKML or one of the subsystem mailing lists (e.g. dri-devel). Pretty much the majority of Linux kernel developers seem to be using Mutt. (Disclosure: Me too, since 1997 in fact when I needed to replace ELM.)
heipei 11y ago
I've been using mutt exlusively for many years, and I got a fair amount of flack for it every now and then. While I like to believe that it's more secure than any full-featured bloated mail-client (hello Thunderbird), my reason for using mutt is simpler. I like the speed, efficiency and customization aspects of mutts, plus being able to use vim to compose my mails. Quite frankly, I don't get how people rave about text editors but then fail to include them in their mail workflow, which is where people spend quite a bit of time nowadays. The other reason I like mutt is because it still conforms to the UNIX principle: One thing and one thing well. True, you could use mutt for SMTP/IMAP, but there are better tools for that. I use mutt with offlineimap, msmtp and mu (for searching).
tomphoolery 11y ago
I'm also a mutt user. Love being able to edit documents with Vim, stable PGP support, and the mnemonic hot keys. However, I wish I knew more (or could remember more) about how it works...and I can't seem to get folders to synchronize properly from `offlineimap` (though `procmail` lets me search my mail rather easily).

skepticaluchiha 11y ago

Popular mail clients such as Thunderbird and Outlook are underattack so the "Security experts" use lesser known clients. I do believe GPG should have been mentioned more besides the Enigmail mention since we are talking about security.

michaelsbradley 11y ago

I use mu4e[1] to read, search and refile my emails, and there's a keyboard shortcut for viewing an HTML email in a browser. offlineimap[2] handles inbound messages. I love it! But for writing email, I still tend to jump over to Apple Mail. msmtp[3] handles outbound messages on those occasions when I choose to fire off a message from within mu4e. [1] http://www.djcbsoftware.nl/code/mu/mu4e.html http://www.djcbsoftware.nl/code/mu/mu4e.html [&] https://github.com/djcb/mu https://github.com/djcb/mu [2] https://github.com/OfflineIMAP/offlineimap https://github.com/OfflineIMAP/offlineimap [3] http://msmtp.sourceforge.net/ http://msmtp.sourceforge.net/

delish 11y ago
I used mutt when I used vim, but after switching to emacs, I began using mu4e. Very keyboard-driven and scriptable. Glad to see others on HN using it. Speaking to your not using mu4e to compose mail, I compose mail in org-mode (I often make lists in emails) then copy them into an mu4e buffer. Funny to see someone using uncommon software the same way I do.
toothbrush 11y ago
I also use mu4e, and i'm curious, why do you switch to Mail.app for composing? I love the fact that all my editor customisations (of which there are many) are still there when i'm writing email.
- deong 11y ago
  To each their own, obviously, but this does seem profoundly weird. I can't imagine anyone choosing an Emacs-based mua and not using the editing ability for composing mail.
  - michaelsbradley 11y ago
    I've been using Apple Mail since the OS X Public Beta in 2000. Its address completion and rich text support are entwined in how I think about authoring emails, so I'm simply more comfortable using it for that purpose. It also helps that Emacs-style movement keys work throughout OS X, including Apple Mail's "new message" windows. I did give mu4e a go, i.e. for writing emails, and I never got to a point where it really appealed to me. I do love it, though, for reading and managing my tens of thousands of email messages. It's also nice that I can easily create links to messages in mu4e, which I can include in my org-mode files.

mfincham 11y ago

There are several slightly less hardcore alternatives to Mutt for those wanting a more modern e-mail experience without the security baggage of running an entire browser. Sylpheed for instance is a very pleasant text-only MUA (http://sylpheed.sraoss.jp/en/ http://sylpheed.sraoss.jp/en/). For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access.

dfc 11y ago
Text-only? I could have sworn sylpheed was a GUI program.
kjs3 11y ago
For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access. Do you have an example? Sounds like a pretty awesome setup that you should share.
- mfincham 11y ago
  I will see if I can get it tidied up enough I'd be comfortable sharing :)

mrbill 11y ago

I've used mutt since '98 or so, and see no reason to change. For HTML email I can either pipe it into lynx or bounce it to Gmail.

hackuser 11y ago

Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying messages. You can leave it in plain text mode and, in the event you really need to view HTML, switch it to "Simple" or full HTML. It also can block remote images and, I think, all JavaScript. The wonderful Nostalgy add-on provides a very responsive keyboard interface. https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/ https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/ I don't know if current Thunderbird versions include all that, however.

JohnTHaller 11y ago
I use Thunderbird and keep it set as text only for sending and remote images loading is disabled by default (as it should be). JavaScript in emails is not loaded or run.
- hackuser 11y ago
  Thanks. > I use Thunderbird and keep it set as text only for sending Is that an option for viewing messages? That's where the security risk mostly exists.
  - JohnTHaller 11y ago
    View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext. Loading of external images is fully disabled by default. You can enable it per-email by clicking as well as per-sender (which I don't personally do or recommend). Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is significantly reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity. That wipes out the vulnerabilities used in the vast majority of attacks right off the bat. Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.
- deleted 11y ago

jakeogh 11y ago

I like alot: https://github.com/pazz/alot https://github.com/pazz/alot

massysett 11y ago

I used to use Mutt, but these days I do over 75% of my mail reading on a phone, and on a phone Mutt is a non-starter.

schoen 11y ago
I have used it from a phone with a terminal emulator over ssh (all of my phones have had keyboards). It was impressive to see how the keyboard supported mapping swipe gestures to cursor movement keys so that I could swipe up and down in my mutt message listings.
- kragen 11y ago
  What's the best QWERTY-keyboard phone now?
  - luxpir 11y ago
    You would have to use an ancient modem or just sync emails by serial cable/irda, but the Psion 5MX was about the pinnacle of portable content creation hardware, IMO. With it you can write emails or whole books if you wish. Some prefer the 3 series, but not necessarily for the keyboard. 25-40hr battery life on 2 AAs, insta-on operation, CF card transfer of files - no wonder people are still using them. Now that people are not as fixated on having colour screens, being primed to now accept e-ink style displays, is there a chance we could get a similar device with more modern specs? I think I'd still rather work from a palmtop than a laptop or phone when not at a 'workstation'. I used an N900 for a long time (relatively speaking) and found its keyboard to be solid, but not in a way that could make writing or emailing tasks more productive.
    - kragen 11y ago
      It does look pretty awesome, but I can't find anybody selling Psions here in Buenos Aires, and it seems like they might lack something in the camera, GPS, 3-D modeling, and audio department. Like, I recorded a beatboxer at a public gathering today on my Android phone, and more than once I've sketched things on paper and photographed them with it, quite aside from other creative uses for photography.

gooseyard 11y ago

I've used mutt for ages, but a couple of years ago I switched to Karel Zak's mutt-kz branch (https://github.com/karelzak/mutt-kz https://github.com/karelzak/mutt-kz), which integrates notmuch into mutt. The setup is a little fussy (although well documented), but the results are spectacular. Mutt's search was never horrible but with notmuch its nutty fast, and the tagging feature makes dealing with search and mailing lists very convenient.

pilooch 11y ago
You can use mairix as a search system outside of mutt. Results are a temporary mailbox.
- danieldk 11y ago
  notmuch can generate temporary maildirs as well with this script: http://git.notmuchmail.org/git/notmuch/blob_plain/HEAD:/contrib/notmuch-mutt/notmuch-mutt http://git.notmuchmail.org/git/notmuch/blob_plain/HEAD:/cont... However, in my experience mutt-kz is much faster. Plus, you get tagging everywhere (if you use it) and threads can be reconstructed across folders (helpful when your own mails are in a 'Sent' folder).

bakul 11y ago

I still use mh (well, nmh now) programs for my personal email. There is nothing that beats mh's "pick" program for selecting emails.

a3n 11y ago
Does imap figure anywhere in your mix?
- bakul 11y ago
  Nope! I forward mail from various other email addresses to my email address where I care.
dllthomas 11y ago
I <3 nmh.

sanatgersappa 11y ago

Wish it was more user friendly and ran well on Windows (yes, I'm that guy). A good example of something that is user friendly, fast, secure and runs almost everywhere is the messaging client Telegram. Would be great if there were more programs like it.

smt88 11y ago
I think we're past the point of apologizing for using Windows. I just switched back after 5 years on Ubuntu and have been thrilled how things just work.
simoncion 11y ago
> Wish [mutt] was more user friendly and ran well on Windows... I would be shocked if Cygwin's mutt port didn't run just as well on Windows as it did on Linux. Remember that UNIX software that you compile with Cygwin becomes a native Windows executable.
- dredmorbius 11y ago
  I was going to suggest this. It does.
- mappu 11y ago
  Software you compile with Cygwin's GCC becomes a native Cygwin executable, with its own concepts of paths, processes, symlinks and environment. All binaries compiled with Cygwin always inherit GPL virality. The Cygwin OS is coincidentally hosted on Windows and mostly plays nice with it. Software you compile with Mingw(-w64)'s GCC becomes a native Windows executable.
  - simoncion 11y ago
    AFAICT, Unix software that you compile with Cygwin's tools understands both Unix paths and Windows style paths. [0] It also understands Windows environment variables. [1] Cygwin is aware of Windows processes. [2] Cygwin is aware of the Windows registry. [3] The executables that are created by the default Cygwin build process are PE executables that have a dependency on the Cygwin DLLs and run on any Windows system. They are native Windows software, with a dependency on a third-party DLL. If you build open-source software against the Cygwin libraries, that software can be distributed under its original license. If you modify the Cygwin build process to produce executables that do not depend on the Cygwin libraries, then you can distribute that software under any licence you like. Regardless, if you have cash you can always reach alternative licensing terms if you reach out to Red Hat. [4] Cygwin symlinks don't make use of NTFS junction points, but I imagine that that is for two reasons: 1) Cygwin might be run on a FAT32 system. 2) There are many, many, many pieces of Windows software (some of it is big name software!) out there that blow up spectacularly when they encounter a Junction Point. (Indeed, it was my direct experience that Windows Explorer behaved very poorly when asked to recursively delete a folder containing a couple of Junction Points in -I think- pre-SP1 Windows 7. I haven't tried JPs in AGES, so I can't speak to whether or not MSFTs own tooling has gotten better.) At a minimum, software compiled against Cygwin meets the most basic definition of Windows software (A PE executable that runs on Windows systems). I hope that I have made it clear that the Cygwin libraries also provide a large amount of interoperability between Unix software and software originally written for Windows. [0] Try it out. Fire up a Cygwin Bash shell and do the following (assuming that you're running on an English-language Windows): echo "hello there" > "$USERPROFILE\Desktop\helloThere.txt" then check the new file on your desktop. rm works just fine, too. Forward slashes work in paths, also! [1] Try this out in a Cygwin bash shell: echo $APPDATA ; echo $LOCALAPPDATA ; echo $SYSTEMROOT [2] Again, in a cygwin bash shell do: ps -W [3] Do (in a Cygwin bash shell): ls /proc/registry/ [4] https://cygwin.com/licensing.html https://cygwin.com/licensing.html

aidenn0 11y ago

Claws (and sylpheed, which it is a fork of) is by default text-only (html rendering only through a plugin). I used to use just mutt, but use claws quite a bit now.

nickpsecurity 11y ago
My graphical client of choice. Lightweight, quick, and relatively easy to box in. Didn't play with Gmail so nicely so I access it a different way. Works with other accounts fine.

leephillips 11y ago

I use mutt because after you learn of its power, other mail clients reveal themselves to be toys. I keep all my active correspondence in my inbox (5773 messages at the moment). With a few keystrokes I can instantly create a subset of my inbox optimized for the task at hand. (People who use toys instead of mutt often advocate an "inbox zero" approach, I understand.)

eru 11y ago
You can do the same two things with gmail. (There are lots of things mutt does that gmail doesn't, of course.)
- leephillips 11y ago
  What two things? I'm not an expert on Gmail's keyboard interface. How, for example, can I see all the messages from Joe Zwanizol that are more than 15 days but less than 60 days old, using only the keyboard, in five seconds?
  - eru 11y ago
    > What two things? The two things mentioned: quickly-customized inboxes (via search) and handling lots of emails. > How, for example, can I see all the messages from Joe Zwanizol that are more than 15 days but less than 60 days old, using only the keyboard, in five seconds? There's a search syntax for that. Not sure whether you'll type it out in five seconds. A browser extension to bring mutt keyboard interface to gmail might be useful for some folk.
    - leephillips 11y ago
      After looking for it I found the search syntax, so it would seem that something like this is possible, as you say. But it's not as expressive as mutt's pattern language, so would be clunkier to use. But it is there.

therealmarv 11y ago

Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care." So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for security sake. So what happens if you want to view a html email? What about mail on a mobile phone (I guess security experts do not use them)? And mutt has other attack surface because it is using the terminal. Look here for a Ubuntu security notice about mutt: http://www.ubuntu.com/usn/usn-2440-1/ http://www.ubuntu.com/usn/usn-2440-1/ Now I smile because gmail is not affected by that! This is all not practical for 99,9% of normal users out there. If you care about security do not let the paranoia control you. We need to improve security for the normal users out there. Just my opinion.

hyyypr 11y ago
You can read html emails in mutt with decent support, using "links" or a somilar app. Mutt let's you define application that generate dumps for a given MIME type. See: https://www.debian-administration.org/article/75/Reading_HTML_email_with_Mutt https://www.debian-administration.org/article/75/Reading_HTM...
toothbrush 11y ago
I used to use mutt (now i use mu4e) and indeed i do not own a mobile phone capable of more than GSM. Also, as mentioned elsewhere, HTML rendering works fine in mutt and mu4e (although perhaps this opens me up to various nefarious things). I don't do this because i'm a security expert (i'm not), i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. EDIT: Oh yeah, and i'd never trust my web browser with my PGP key...
- dmd 11y ago
  > i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. The trouble is that most people who say this end up doing 6 things that take 200 ms each (with the keyboard) instead of 1 thing that takes 1 second (with the mouse), and feel like they're zooming along in hyperspace. You feel like a leet hacker, but are you really getting anything done more efficiently?

kkapelon 11y ago

The sup email client is another good option. Text mode like mutt but threads emails like gmail http://supmua.org/ http://supmua.org/

koevet 11y ago

I do use mutt as my principal e-mail client. It started as an experiment, now I fully transitioned to it. I enjoy being able to compose messages in vim and the tight integration with gpg. In case you want to try mutt out, some time ago I wrote a short guide about setting up mutt on osx, http://www.lucianofiandesio.com/getting-started-with-mutt-on-osx http://www.lucianofiandesio.com/getting-started-with-mutt-on...

0XAFFE 11y ago

As I'm a emacs person, I tried once wanderlust[1] and got hooked up to it. Wanderlust is mail client which supports a wide variety of protocols. For me the biggest advantages are the blazing fast IMAP support and the whole emacs thing (Keybindings, Help (C-h b for all keybindings in this buffer, priceless I have to say), the possibility to run it either in GUI or in a terminal, etc). Recently the devs uploaded it to melpa[2] which makes it even more easy to get started. I would definitly recommend it, to people who are already using emacs, its such a joy! [1] https://github.com/wanderlust/wanderlust https://github.com/wanderlust/wanderlust [2] http://melpa.org/#/wanderlust http://melpa.org/#/wanderlust

rekado 11y ago
Another Emacs person here. I'm using offlineimap+msmtp together with mu4e. I prefer not to do IMAP sync or mail delivery in Emacs itself.
- p4bl0 11y ago
  I do the same, except I use emacs build-in SMTP (smtpmail) directly. I'm quite happy with it :). What is the advantage of msmtp?
- nextos 11y ago
  Have you tried isync? I was using offlineimap before, but found it buggy and inefficient.
  - darkr 11y ago
    Currently using isync for those exact reasons. Only issue that I have with it is that it doesn't support nested folders.
  - hiq 11y ago
    What are the bugs you are referring to? I have been using it for a few weeks for a couple of mail accounts without trouble so far. It could probably be faster though (customizing 'maxconnections' does help).

lloydde 11y ago

> A quarter of a century ago, checking your email meant logging onto a mainframe The lead in seems incorrect. Pine wasn't publicly released until 1992. By the early 90s many college and university environments were thin clients or unix workstations connecting to unix servers.