4 ms·

It's sad to see that Mozilla considers desktop email clients as outdated. It's true that most people use phone apps and webmail, but in enterprises the story is

It's sad to see that Mozilla considers desktop email clients as outdated. It's true that most people use phone apps and webmail, but in enterprises the story is completely different. MS Outlook rules in many places, but I'd bet there are at least a few million people using Thunderbird as their desktop mail client, more so in a (slightly "hostile") MS Exchange environment. If Thunderbird were to really evolve and provide what people have been asking for for a very, very, very long time, it is good calendaring that "just works" with MS Exchange (I know about the extensions and external applications available, but none of them provide a seamless experience or all features that are required for calendaring). Post Edward Snowden's revelations, more people need a good way to do encrypted mails well too (that's complex and is also more of a user experience issue, but an organization like the erstwhile Mozilla Messaging could have spent a good amount of effort on it). Along with this, we would have encrypted chats (since chat is already part of Thunderbird), encrypted voice calls, etc. That would be phenomenal! IMO, Mozilla really lost focus on Thunderbird long before it decided to shelve it as a "community driven project".

digi_owl 11y ago
Mozilla of today is run by designers, webheads and "social" personas. As for encrypted email, it could be made very simple. When you set up an account in Thunderbird, have it ask a simple question "do you have an encryption key?". If the user hits no, generate the key pair, and insert the public key by default. Then starts harvesting public keys from incoming emails, and encrypt by default if sending to an address that has a known public key.
- stinkytaco 11y ago
  Doesn't this sort of abandon the trust model of PGP? If you make default encryption a part of the system and an elevator pitch bullet point, I don't think it's really fair to call it simple because a UI change would be needed to ensure that though email may be encrypted, users can't necessarily trust the identity of the sender.
  - digi_owl 11y ago
    And how will software ever help with that? Put a signed image of the device user at time of sending? You are pretty much walking into the same issue that big media has had with DRM. You can't trust something user facing to be doing the "right" thing unless the whole chain down to the individual chips are certified by entities you control. Right now email is more like sending post cards than letters, yet people treat them like the latter. encryption by default would at least make them behave like letters while crossing the networks. Figuring out if the sender is who he or she claims to be is a very different issue, and one that has plagued humanity since the dawn of correspondence.
    - stinkytaco 11y ago
      My issue is not default encryption, which I think is a "good thing"™. It's that if you say "Thunderbird: Encrypted by Default"™, you give users a sense of security that is at least partially an illusion. This is something we would roundly criticize Google for if they were to say, for example, "your email and searching is secure because you are using SSL". I feel it's incumbent on an organization like Mozilla, one that I support at least partially because they are not building a platform to advance their own interests, to be very clear that email is encrypted en route, but not necessarily secure. I'm guess I'm viewing it from a communications angle.
      - digi_owl 11y ago
        Here we are back at the varying definition of "security". The encryption will defend against NSA style "grab everything, sort it out later" attacks. but it will not defend against targeted attacks where someone had compromised the remote sender somehow. The former is a boon for most people vs the present state, the latter is a hairy problem that has been with us since we first started sorting ourselves into ingroups and outgroups (how do you know that the email is not sent by someone with a gun pointed to their head?). Or as i was reminded by a different comment: perfect becomes the enemy of good.
  - pekk 11y ago
    In the status quo nothing is verified or encrypted anyway. When we make the perfect the enemy of the good, we reinforce that status quo. As long as the trust model of PGP depends on everyone to get the same religion, we are stuck waiting for a messiah which will never come. If we have any hope of improving the status quo, we need some kind of bootstrap, and that bootstrap won't look exactly like the final result we want. Ubiquitous email encryption would improve on the status quo, and prepare the ground for further improvements. People who don't care would still be generating more verifiable information than the status quo. People who want to use encryption wouldn't be forced to drop it in order to talk to family and friends. People who want to carefully manage their identities and use signing to build a web of trust could build that on top of ubiquitous encryption. This would get us closer to the PGP trust model than anyone has been able to do purely by evangelizing the PGP trust model.
- dublinben 11y ago
  I seem to recall that this is exactly what a brand new installation of Thunderbird with Enigmail will do. I don't know if the newly generated public key is published anywhere, but that's a simple configuration change.
  - digi_owl 11y ago
    Yep, but Enigmail is not part of the default Thunderbird package. It has to specifically be installed by the user after installing and running Thunderbird.
    - bad_user 11y ago
      Email encryption isn't mainstream and it isn't Thunderbird's fault, but GPG's. It's an antiquated protocol with an antique implemention and it's hard to understand and hard to setup. Thunderbird including the implementation by default would only confuse users. Those who want Enigmail already know to search for the plugin. Those who don't know what it is wouldn't know what to do with it.
      - icebraining 11y ago
        What's antiquated about the protocol?
    - dublinben 11y ago
      I actually installed Thunderbird and Enigmail at the same time through my operating system's packet manager. You do not have to start Thunderbird before installing Enigmail.
      - digi_owl 11y ago
        Turning a extension into a disto package, ye deities...
        icebraining 11y ago
anexprogrammer 11y ago
Thunderbird has been the poor, forgotten relation over at Mozilla for a long time now. Given the endless stream of ridiculous decisions for Firefox, over the last few years, I can't bring myself to see that as a bad thing. I'd like to hope that Thunderbird can thrive in a new home, but somehow I'm not optimistic.
mwexler 11y ago
And when you say "enterprise", think also of small and medium businesses. There are many advantages to webmail, but I keep running into smalls and mediums who use shared hosting for email (IMAP and (shudder) POP3), but can't truly leverage "Horde" or other open source webmails. Their options are Outlook if they have enough licenses ($$), or Thunderbird if they don't. Yes, many move to Google's infrastructure if they can, but not everyone is able to or wants to. Thunderbird is one of the remaining alternatives.
- newscracker 11y ago
  I can't edit my comment now, but when I mentioned "enterprise" and "at least a few million people", I did have small and medium businesses in mind as well. :)

digi_owl 11y ago

Mozilla of today is run by designers, webheads and "social" personas. As for encrypted email, it could be made very simple. When you set up an account in Thunderbird, have it ask a simple question "do you have an encryption key?". If the user hits no, generate the key pair, and insert the public key by default. Then starts harvesting public keys from incoming emails, and encrypt by default if sending to an address that has a known public key.

stinkytaco 11y ago
Doesn't this sort of abandon the trust model of PGP? If you make default encryption a part of the system and an elevator pitch bullet point, I don't think it's really fair to call it simple because a UI change would be needed to ensure that though email may be encrypted, users can't necessarily trust the identity of the sender.
- digi_owl 11y ago
  And how will software ever help with that? Put a signed image of the device user at time of sending? You are pretty much walking into the same issue that big media has had with DRM. You can't trust something user facing to be doing the "right" thing unless the whole chain down to the individual chips are certified by entities you control. Right now email is more like sending post cards than letters, yet people treat them like the latter. encryption by default would at least make them behave like letters while crossing the networks. Figuring out if the sender is who he or she claims to be is a very different issue, and one that has plagued humanity since the dawn of correspondence.
  - stinkytaco 11y ago
    My issue is not default encryption, which I think is a "good thing"™. It's that if you say "Thunderbird: Encrypted by Default"™, you give users a sense of security that is at least partially an illusion. This is something we would roundly criticize Google for if they were to say, for example, "your email and searching is secure because you are using SSL". I feel it's incumbent on an organization like Mozilla, one that I support at least partially because they are not building a platform to advance their own interests, to be very clear that email is encrypted en route, but not necessarily secure. I'm guess I'm viewing it from a communications angle.
    - digi_owl 11y ago
      Here we are back at the varying definition of "security". The encryption will defend against NSA style "grab everything, sort it out later" attacks. but it will not defend against targeted attacks where someone had compromised the remote sender somehow. The former is a boon for most people vs the present state, the latter is a hairy problem that has been with us since we first started sorting ourselves into ingroups and outgroups (how do you know that the email is not sent by someone with a gun pointed to their head?). Or as i was reminded by a different comment: perfect becomes the enemy of good.
- pekk 11y ago
  In the status quo nothing is verified or encrypted anyway. When we make the perfect the enemy of the good, we reinforce that status quo. As long as the trust model of PGP depends on everyone to get the same religion, we are stuck waiting for a messiah which will never come. If we have any hope of improving the status quo, we need some kind of bootstrap, and that bootstrap won't look exactly like the final result we want. Ubiquitous email encryption would improve on the status quo, and prepare the ground for further improvements. People who don't care would still be generating more verifiable information than the status quo. People who want to use encryption wouldn't be forced to drop it in order to talk to family and friends. People who want to carefully manage their identities and use signing to build a web of trust could build that on top of ubiquitous encryption. This would get us closer to the PGP trust model than anyone has been able to do purely by evangelizing the PGP trust model.
dublinben 11y ago
I seem to recall that this is exactly what a brand new installation of Thunderbird with Enigmail will do. I don't know if the newly generated public key is published anywhere, but that's a simple configuration change.
- digi_owl 11y ago
  Yep, but Enigmail is not part of the default Thunderbird package. It has to specifically be installed by the user after installing and running Thunderbird.
  - bad_user 11y ago
    Email encryption isn't mainstream and it isn't Thunderbird's fault, but GPG's. It's an antiquated protocol with an antique implemention and it's hard to understand and hard to setup. Thunderbird including the implementation by default would only confuse users. Those who want Enigmail already know to search for the plugin. Those who don't know what it is wouldn't know what to do with it.
    - icebraining 11y ago
      What's antiquated about the protocol?
  - dublinben 11y ago
    I actually installed Thunderbird and Enigmail at the same time through my operating system's packet manager. You do not have to start Thunderbird before installing Enigmail.
    - digi_owl 11y ago
      Turning a extension into a disto package, ye deities...
      - icebraining 11y ago

anexprogrammer 11y ago

Thunderbird has been the poor, forgotten relation over at Mozilla for a long time now. Given the endless stream of ridiculous decisions for Firefox, over the last few years, I can't bring myself to see that as a bad thing. I'd like to hope that Thunderbird can thrive in a new home, but somehow I'm not optimistic.

mwexler 11y ago

And when you say "enterprise", think also of small and medium businesses. There are many advantages to webmail, but I keep running into smalls and mediums who use shared hosting for email (IMAP and (shudder) POP3), but can't truly leverage "Horde" or other open source webmails. Their options are Outlook if they have enough licenses ($$), or Thunderbird if they don't. Yes, many move to Google's infrastructure if they can, but not everyone is able to or wants to. Thunderbird is one of the remaining alternatives.

newscracker 11y ago
I can't edit my comment now, but when I mentioned "enterprise" and "at least a few million people", I did have small and medium businesses in mind as well. :)