4 ms·

Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is securi

Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care." So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for security sake. So what happens if you want to view a html email? What about mail on a mobile phone (I guess security experts do not use them)? And mutt has other attack surface because it is using the terminal. Look here for a Ubuntu security notice about mutt: http://www.ubuntu.com/usn/usn-2440-1/ http://www.ubuntu.com/usn/usn-2440-1/ Now I smile because gmail is not affected by that! This is all not practical for 99,9% of normal users out there. If you care about security do not let the paranoia control you. We need to improve security for the normal users out there. Just my opinion.

hyyypr 11y ago
You can read html emails in mutt with decent support, using "links" or a somilar app. Mutt let's you define application that generate dumps for a given MIME type. See: https://www.debian-administration.org/article/75/Reading_HTML_email_with_Mutt https://www.debian-administration.org/article/75/Reading_HTM...
toothbrush 11y ago
I used to use mutt (now i use mu4e) and indeed i do not own a mobile phone capable of more than GSM. Also, as mentioned elsewhere, HTML rendering works fine in mutt and mu4e (although perhaps this opens me up to various nefarious things). I don't do this because i'm a security expert (i'm not), i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. EDIT: Oh yeah, and i'd never trust my web browser with my PGP key...
- dmd 11y ago
  > i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. The trouble is that most people who say this end up doing 6 things that take 200 ms each (with the keyboard) instead of 1 thing that takes 1 second (with the mouse), and feel like they're zooming along in hyperspace. You feel like a leet hacker, but are you really getting anything done more efficiently?
  - toothbrush 11y ago
    > are you really getting anything done more efficiently? Maybe not, but is that 200ms improvement when using the mouse really worth it if i get all warm and fuzzy-feeling by being able to type something? :p Intangible benefits, yo. More seriously though, i also feel (personally -- maybe i'm an outlier) like switching from keyboard to mouse and back is a bit of a performance hit, so i tend to concentrate my workflow around the keyboard as much as possible. And yeah, maybe (99% certainly!) i'm not the leetest or fastest h4x0r out there, but at least i'm enjoying myself :). (i would be curious about an actual test case though -- maybe someone could design a few common tasks to complete using one's favourite HID and compare!)
mobiuscog 11y ago
> What about mail on a mobile phone (I guess security experts do not use them)? Just to note that I'm not a security expert, but I never check email on my phone. Just don't need to. Whilst I realise mobile devices are very popular, there are a lot of people who don't require checking email when they're not at a desk.
josteink 11y ago
> So who cares if you write your email in text mode but browse the web with Chrome/Firefox? On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim. Now try that with a privately owned and administered server.
- DanBC 11y ago
  You think the US government doesn't have full access to your private server? If it's located within the US they have full physical access. If it's located outside the US it's a valid target for all the TLAs. If the government is on your list of threats you need a lot more than "private mail server".
  - josteink 11y ago
    > If it's located within the US they have full physical access. If I were to live in the US, I would know when my server went missing. With Google or other cloud-providers they can do it behind your back. > If it's located outside the US it's a valid target for all the TLAs. And then can't seize it. It's physically secure. It may not be bullet-proof security-wise (what is?) but they can't rubber-stamp their way into it. And for some people that's quite an important aspect.
    - dijit 11y ago
      Amen, this whole "if it's not 100% secure why bother" argument is annoying, we can still make it hard for them. We can, and we definitely should.
      - DanBC 11y ago
        It makes it easier for them.
        dijit 11y ago
        what does? housing mail outside the US? outside of their partner companies or previously breached companies (in the case of google). I mean, if you have a remote server- it's lawful for them to snoop (by their own law), but it certainly makes it harder, to gain access and maintain access- as these systems may be wildly different and hosts will be varying degrees of paranoid.
kevinmobrien 11y ago
With tremendous respect to Linus, this isn't a fair characterization of the "security community", whatever that means. There are both practitioners and vendors who take the view that security should enable business, not block it; there are groups of experts who run contrary to this, and believe in a reductive and restrictive approach to everything. The continuum of thought around what it means to be secure, especially when dealing with organizational security, seems to be shifting towards the former, rather than the latter. As far as Linus' statements go, saying that security is imperfect by design isn't a new take on it, and I'm in complete agreement with you that it needs to be something that regular users can benefit from.

hyyypr 11y ago

You can read html emails in mutt with decent support, using "links" or a somilar app. Mutt let's you define application that generate dumps for a given MIME type. See: https://www.debian-administration.org/article/75/Reading_HTML_email_with_Mutt https://www.debian-administration.org/article/75/Reading_HTM...

toothbrush 11y ago

I used to use mutt (now i use mu4e) and indeed i do not own a mobile phone capable of more than GSM. Also, as mentioned elsewhere, HTML rendering works fine in mutt and mu4e (although perhaps this opens me up to various nefarious things). I don't do this because i'm a security expert (i'm not), i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. EDIT: Oh yeah, and i'd never trust my web browser with my PGP key...

dmd 11y ago
> i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard. The trouble is that most people who say this end up doing 6 things that take 200 ms each (with the keyboard) instead of 1 thing that takes 1 second (with the mouse), and feel like they're zooming along in hyperspace. You feel like a leet hacker, but are you really getting anything done more efficiently?
- toothbrush 11y ago
  > are you really getting anything done more efficiently? Maybe not, but is that 200ms improvement when using the mouse really worth it if i get all warm and fuzzy-feeling by being able to type something? :p Intangible benefits, yo. More seriously though, i also feel (personally -- maybe i'm an outlier) like switching from keyboard to mouse and back is a bit of a performance hit, so i tend to concentrate my workflow around the keyboard as much as possible. And yeah, maybe (99% certainly!) i'm not the leetest or fastest h4x0r out there, but at least i'm enjoying myself :). (i would be curious about an actual test case though -- maybe someone could design a few common tasks to complete using one's favourite HID and compare!)

mobiuscog 11y ago

> What about mail on a mobile phone (I guess security experts do not use them)? Just to note that I'm not a security expert, but I never check email on my phone. Just don't need to. Whilst I realise mobile devices are very popular, there are a lot of people who don't require checking email when they're not at a desk.

josteink 11y ago

> So who cares if you write your email in text mode but browse the web with Chrome/Firefox? On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim. Now try that with a privately owned and administered server.

DanBC 11y ago
You think the US government doesn't have full access to your private server? If it's located within the US they have full physical access. If it's located outside the US it's a valid target for all the TLAs. If the government is on your list of threats you need a lot more than "private mail server".
- josteink 11y ago
  > If it's located within the US they have full physical access. If I were to live in the US, I would know when my server went missing. With Google or other cloud-providers they can do it behind your back. > If it's located outside the US it's a valid target for all the TLAs. And then can't seize it. It's physically secure. It may not be bullet-proof security-wise (what is?) but they can't rubber-stamp their way into it. And for some people that's quite an important aspect.
  - dijit 11y ago
    Amen, this whole "if it's not 100% secure why bother" argument is annoying, we can still make it hard for them. We can, and we definitely should.
    - DanBC 11y ago
      It makes it easier for them.
      - dijit 11y ago
        what does? housing mail outside the US? outside of their partner companies or previously breached companies (in the case of google). I mean, if you have a remote server- it's lawful for them to snoop (by their own law), but it certainly makes it harder, to gain access and maintain access- as these systems may be wildly different and hosts will be varying degrees of paranoid.

kevinmobrien 11y ago

With tremendous respect to Linus, this isn't a fair characterization of the "security community", whatever that means. There are both practitioners and vendors who take the view that security should enable business, not block it; there are groups of experts who run contrary to this, and believe in a reductive and restrictive approach to everything. The continuum of thought around what it means to be secure, especially when dealing with organizational security, seems to be shifting towards the former, rather than the latter. As far as Linus' statements go, saying that security is imperfect by design isn't a new take on it, and I'm in complete agreement with you that it needs to be something that regular users can benefit from.