29 ms·
21 years after the request OpenPGP support gets added to Thunderbird
- janvdberg 6y agoIs this the longest time between request/bug and fix?
- gostsamo 6y agoMost likely there is a bug filed somewhere that asks for removing most of the parentheses from LISP. :)
- Jtsummers 6y agoIn a way, that's how we got Dylan.
- trothamel 6y agoIt's in a different field, and I'm being very tongue-in-cheek - but the Twenty-Seventh Amendment to the US Constitution has it beat. https://en.wikipedia.org/wiki/Twenty-seventh_Amendment_to_the_United_States_Constitution#Revival_of_interest https://en.wikipedia.org/wiki/Twenty-seventh_Amendment_to_th...
- mch82 6y agoCool link
- gerdesj 6y agoI think Open Office and Libre Office have some contenders back from Star Office days. I still use LO daily though.
- kryptiskt 6y agoLast month there was a patch for a 35-year old bug in patch: http://bsdimp.blogspot.com/2020/08/a-35-year-old-bug-in-patch-found-in.html http://bsdimp.blogspot.com/2020/08/a-35-year-old-bug-in-patc...
- throrthaway 6y agohttps://gitlab.gnome.org/GNOME/gtk/-/issues/233 https://gitlab.gnome.org/GNOME/gtk/-/issues/233 16 years and still pending! All bets are off for this dark horse
- JdeBP 6y agoIt has been 21 years since people asked to have SRV DNS resource record support in Mozilla. * http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html http://jdebp.uk./FGA/dns-srv-record-use-by-clients.html
- throrthaway 6y agoNow my opinion may seem controversial but I personally believe having feature requests that are old enough to legally drink is not a sign of healthy project management
- tedunangst 6y agoThe bug is closed. What more do you expect project management to do?
- teddyh 6y agoI’m thinking that they might implement HTTPS and SVCB records, once standardized: https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-01 https://tools.ietf.org/html/draft-ietf-dnsop-svcb-https-01
- tzs 6y agoIf it does have that title, there are other bugs that are almost as old in Thunderbird and still open, so it might not hold the record for long if someone gets around to fixing any of those. For example, bug 41929 [1] is only 6 months younger. Briefly, you cannot have two different IMAP accounts in Thunderbird that have the same username and host but different ports. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=41929 https://bugzilla.mozilla.org/show_bug.cgi?id=41929
- sushisource 6y agoWhy even bother at this point? PGP encryption in email is... not a good way to do secure communication.
- unixhero 6y agoFor one, it works.
- recursive 6y agoAnd if it doesn't work, you're doing it wrong. Or maybe never figured it out well enough to even try in the first place.
- jtsiskin 6y agoWhat’s wrong with PGP? Or are you referring to email
- nikisweeting 6y agoThere are many things wrong with both the UX and internal cryptographic design of PGP. Here are a few articles that go over those issues in more depth: https://blog.filippo.io/giving-up-on-long-term-pgp/ https://blog.filippo.io/giving-up-on-long-term-pgp/ https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma... https://secushare.org/PGP https://secushare.org/PGP https://www.techrepublic.com/article/why-pgp-is-fundamentally-flawed-and-needs-to-be-fixed/ https://www.techrepublic.com/article/why-pgp-is-fundamentall...
- somedude11 6y agoYet it's the best we got right now.
- nikisweeting 6y ago
- oconnore 6y agoI do think there ought to be a way to do good cryptography in email. Email is not going away anytime soon, so giving up on it as a legitimate place where cryptography is needed seems too ivory tower for me. The “dead simple solution” is to just run the Signal protocol over SMTP, although I’m sure it’s possible there is a better design if you were to think about the specifics.
- jolux 6y agoNot if you want to interoperate with anything currently in existence. And if you don't, why bother building it on SMTP?
- mathnmusic 6y agoBecause there are too many users on SMTP/Email, but not many PGP users to worry about interoperating? I mean, Hey.com shows that people still like SMTP/Email.
- jolux 6y agoDoes it? Or does it show that a small number of highly technical users are willing to pay more for a different email experience? It's a bit early to judge their impact on the ecosystem, and I'm skeptical they'll capture a significant user base in the way that Gmail did. People use email because everyone uses email; you're not going to get people to change how they use email entirely. Nobody cares that it's running on SMTP, they care that they can email everyone they know with an email address.
- oconnore 6y agoYou build it on SMTP because upgrading clients is easier than doing a clean slate redesign of ubiquitous internet protocols. Presumably we're discussing how an open protocol addition might gain any traction at all over walled garden protocols like Slack -- and in those cases you want to maintain as much compatibility as possible. "Federated SecureEmail 2.0" would be dead-on-arrival, where "Secure Client on top of bog-standard email" is ever so slightly less DOA. You get to re-use the existing identity/routing system, existing servers, existing authorization, etc.
- edgarvaldes 6y agoHow is the Thunderbird development speed nowadays?
- throrthaway 6y agoPretty moribund. They got dropped by Mozilla so it's entirely community-driven, and there's only so many things you need to add to an email client, unless you want it to turn into emacs or something. That said it's a damn good product that's damn good at what it does.
- jcranmer 6y agoThere's as many developers working on it now as there were when it was a part of Mozilla.
- throrthaway 6y agoAre they still paid by Mozilla, though?
- jcranmer 6y agoThey are not paid by Mozilla, but there are still paid contributors.
- elchin 6y agoGave me memories of the times when US had cryptography export restrictions :)
- dylan604 6y agoI remember back in the 90s exchanging PGP keys with my roommate to exchange encrypted emails. It was supposed to be so easy. Just 12 simple steps. Every time.
- libraryatnight 6y agoat least you had a friend to email! I couldn't get any of my friends to do it. "Man we can encrypt our emails." "But why..." "It'd be cool" "This seems hard." "Come on, exchange keys with me." "I don't want to make one."
- thereticent 6y agoMy high school friends and I settled for using Gain and Pidgin to enable the "secure" icon. :)
- godelski 6y agoFor awhile you could use Pidgin and OTR to even have secure messages through facebook's messenger. I'm not sure if they decrypted it or not, but it sure was fun.
- gogopuppygogo 6y agoReminded me of my Adium days. Back when I liked my messenger app on the Mac. Apple has tried hard to degrade the experience of their built in messenger.
- sli 6y agoBeen a hot minute since I've thought about Gaim. Thanks for the memories.
- p1mrx 6y agoGaim is just Pidgin's original name.
- aerovistae 6y agoNever seen a timestamp on the web that said "20 years ago". Wow. Reminds me of a tiny blog post I put up years ago about the future of archaeology. Forgive the silly site title. https://meaninglessdreams.wordpress.com/2014/09/26/156/ https://meaninglessdreams.wordpress.com/2014/09/26/156/
- codetrotter 6y ago> This hypothetical archaeologist has it easy I am not so sure of that. Even time stamps cannot be trusted very much. For example, a lot of photo cameras, audio recorders and other such devices still don’t have a small extra battery for keeping track of time. So every time you run out of battery, or in the case of wall-connected devices you unplug them from the wall, the clock is reset and time is set to some date that the device manufacturer decided to use as the epoch for their device. And most of these devices don’t have a GPS receiver in them either, so you need to manually set the time. And only some of them will prompt you for it directly while for others you need to remember this and go in the settings menu and adjust the time. So I routinely get time stamps that are things like 1st of January 2008, or 2015 or what have you. And sure if you notice right away you can correct it. But even when you know you sometimes get tired of that kind of stuff so you just leave it like it is. And that’s just at the recording stage. Then you transfer files between systems and sometimes you get the original time on your files and sometimes you don’t, and even if you did they might be wrong in the first place as per above. And all of this is for someone who knows how this stuff works and who tries as good as they can to have proper dates on files and to keep them that way. Then you have people who don’t know and don’t notice. And then you have people who willfully modify metadata. And then there is the data itself. We live in a post-truth age they say. How do you know in a thousand years that the data is from when it says it was from and furthermore that there is even a grain of truth in the data itself? I am sure there will be competent historians that are able to learn a bit of our time from our data. But I don’t think they will have it easy. And on top of that I don’t think data can really tell the future what life today is like. It’s hard to put in words what I mean by this last point so I won’t try to say any more about that.
- sergiomattei 6y agoI was born 20 years ago...
- mountainboy 6y agoWhat did they do, install enigmail extension by default?
- PenguinCoder 6y agoGood for them, but PGP is essentially dead for any non-technical zealot users. S/MIME is better supported and easier to use.
- crdrost 6y agoThat's actually the deal with Thunderbird, too. Supported S/MIME and needed a plugin, Enigmail, to interface with OpenPGP. What is happening here is that the thunderbird add-on interface is changing and they decided that instead of porting Enigmail they are integrating OpenPGP straight into Thunderbird like S/MIME is.
- mapgrep 6y agoPerhaps true for individual mail but some corporate mail is very active with it. It works quite well within groups. If you use it every day it’s a total non issue. The problem is people who set it up, forget about it, and finally get encrypted message two years later. Of course that is then confusing to try to remember how to use.
- jwr 6y agoI am so annoyed by anyone saying something is "dead". I tried to use S/MIME. I really did. Went to those sleazy web pages of companies that issue certificates, was told I'd need to pay for various certificate products. Tried a free option. Tried to load the cert onto my YubiKey, tried using it in Apple Mail… The conclusion: it is by no means easy or well supported, and requires you to deal with those sleazy cert-celling companies.
- marta_morena_25 6y ago20 years too late. If they had done this 20 years ago and properly, it might actually have been of use. But even today Mozilla apparently does not comprehend its user base or what they should focus on for adoption. So why am I even surprised.
- sulam 6y ago21 year old bug, and Damon Gallaty apparently still works at the company that he worked at back then, albeit with some changes to the name on the checks he gets. I have some serious feels for the guy, that had to have been a frustrating experience.
- tingley 6y agoCredit to the people that wrote and maintained bugzilla, both as software and this particular instance. It's still ticking, much longer than (I assume) they planned it to.
- redis_mlc 6y agoMy opinion for 20 years has been that Atlassian JIRA would have been stillborn if somebody had added a blue and white CSS theme for Bugzilla.
- throrthaway 6y agoWho knows, we might even see GNOME getting thumbnail previews in its file picker!
- floatingatoll 6y agoPreviously on HN: 36 comments, 1 day ago: https://news.ycombinator.com/item?id=24501872 https://news.ycombinator.com/item?id=24501872 226 comments, 2 months ago: https://news.ycombinator.com/item?id=23864934 https://news.ycombinator.com/item?id=23864934 51 comments, 12 months ago: https://news.ycombinator.com/item?id=21197327 https://news.ycombinator.com/item?id=21197327
- dm319 6y agoReminds me of this article on HackerNews a little while ago: https://news.ycombinator.com/item?id=22368888 https://news.ycombinator.com/item?id=22368888
- snapetom 6y agosigh Thunderbird has so many great features under the hood, but the hood is the biggest issue I have that prevents me from switching full time. Classic and wide layouts are not optimized for wide resolutions in modern laptops. Their vertical layout is unusable. The columns in the list of messages are horizontal, taking up too much width. Each layout is a tradeoff on whether I want to message pane to be usable or the list of messages to be usable.
- JohnTHaller 6y agoHave you tried turning off some of the columns in the message list and using Vertical view? There's an absurd number of them that you really don't need all the time.
- snapetom 6y agoI have, but the biggest horizontal space eaters in that view are the most important ones - subject, from, and date. Turning off the others don't really help that much. Besides, Mail.app gives me the all the same information as in Thunderbird's, but the list of messages is rearranged for that view. It doesn't eat into the message plane. Thunderbird's vertical layout is just a re-arrangement of the panes. Edit: I mixed Vertical and Wide in my original message. I meant the vertical view is unusable. I've edited it.
- corford 6y agoEach to their own I guess. I use vertical and like it. Left pane on the left is all my accounts and folder tree; middle pane is email star:subject:sender:date; right pane is email contents. Above the three panes I simply have the message filter box and above that is the main toolbar (get messages, write, address book, view drop down, quick filter button). Simple but works well for me on 1920x1080 or higher (and dealing with about a hundred or so emails a day).
- apocalyptic0n3 6y agoI was never satisfied with their layout either. Always liked the way it behaved though. Ended up switching to Postbox, a Thunderbird fork, about 7 years ago and haven't really looked back. You have to pay for it, but it's a pretty solid email experience for what you pay (I think I paid $40 for a lifetime license a few years ago).
- Xophmeister 6y agoIs anyone else having problems with this, after migrating from Enigmail on Thunderbird 68? It fails to associate my accounts with my keys in my keyring, so I try to import an exported key. Whenever I do this, it gets stuck in a loop asking me for the passphrase for an old, revoked key :( Even after I deleted the revoked keypair -- which I know I shouldn't -- it's refusing to cooperate. So it looks like I've actually lost this feature by upgrading...
- capableweb 6y ago> For reasons associated with U.S. export restrictions, no cryptographic security of any kind is likely to be included in the original sources https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 https://bugzilla.mozilla.org/show_bug.cgi?id=22687#c1 Creepiest thing with seeing this ticket (again?) is noticing that the first comment is about that is used to be illegal to write anything with cryptographic security in the US and sell/give it to the outside world. https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
- deleted 6y ago[deleted]
- Longlius 6y agoAny signatory to the Wassenaar Arrangement, which includes the entirety of North America, Europe (including Russia), Australia, India, and Pacific Asia (minus China) must consider cryptographic technologies to be munitions for the purposes of export. Now, these restrictions have been considerably loosened to the point that the export isn't really controlled, but international law still considers it a munition. The US is hardly unique in this regard. It works the other way too. A surprising number of countries still restrict the import of cryptographic technology, including several EU states.
- hansvm 6y agoRelevant xkcd: https://xkcd.com/504/ https://xkcd.com/504/
- coderintherye 6y agoFor those that don't click through, it repeats what is a fairly cogent argument. If cryptography is classified as a munition, then there should be legal room to argue we have the right to it as provided by the 2nd amendment.
- 6y ago
- skyfaller 6y agoI used to love PGP, but I now think encrypted email is a bad idea. https://latacora.micro.blog/2020/02/19/stop-using-encrypted.html https://latacora.micro.blog/2020/02/19/stop-using-encrypted.... Better to use a protocol designed with encryption in mind, like Signal, to get forward secrecy, avoid leaking metadata, and have encryption always on by default. UPDATE: I have been reminded that PGP does not have to be used with email. I meant to say that I used to love using PGP with email, since that is the primary way I have used it. I will not comment on the use of PGP outside of email, since I haven't carefully examined its use in other contexts.
- mapgrep 6y agoSignal is great as an all in one solution if encrypted messaging is a hobby. It is also very good for mobile and encrypted occasional messages. If you try to actually build a secure environment within a group that tries to maximize security while getting real work done you find you want to be encrypted by default at least with each other. Signal is pretty suboptimal for heavy volumes of messages. If you and I have three threads going they are all jumbled together. If I want to send to more than one person I have to whip out my phone and form a group and name it. PGP is imperfect but with the right settings and defaults it is far better than having email default to clear text. And in any long term endeavor with more than a few people you will find you want email. Signal is great for what it does. It is not designed to be a high volume working tool like email though.
- skyfaller 6y agoSo you're saying that if you're building a professional secure environment, you don't need forward secrecy and it's ok to leak metadata? This doesn't make sense to me. The US gov't kills people based on metadata: https://ssd.eff.org/en/module/why-metadata-matters https://ssd.eff.org/en/module/why-metadata-matters It's not possible to make email secure, the flaws are on the protocol level. To fix it, you would need to change it until it is no longer email.
- mapgrep 6y ago
- justinator 6y agoRemember when someone had to set up a GoFundMe for the one guy that was supporting OpenPGP and everything thought, "let's help this guy out" but at the same time thought Why, though?
- matmann2001 6y agoI'm more impressed that a ticket managed to live on in a tracker for so long without getting lost over the years.
- 3np 6y agoIn contrast to ansible issues, which would have changed tracker or repo ~30 times in that time.
- oblio 6y agoAlso: No, no, you're wrong. Ansible is not crashing, you're just holding it wrong. :-p
- zufallsheld 6y agoOr any other recent repo where issues get "stale" and closed automatically.
- l0b0 6y agoWhere's the actual diff? It would be interesting to see how much and what sort of code is actually involved.
- Consultant32452 6y agoIgnorant question time, will this mean native support for email services like proton mail?
- 3np 6y agoprotonmail is different in that they have their own client/server protocol and you need something like their protonmail-bridge to interface with them over IMAP (which is only for paid accounts and does not depend on this feature). It makes it smoother to send and receive e-mails signed/encrypted with PGP.
- efitz 6y agoWow, this could have made such a difference to the direction of the internet, government surveillance, and maybe even saved the lives of dissidents- if it had been done 20 years ago.
- btilly 6y agoWonderful. What an amazing amount of work to implement a terrible idea. See https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html for why we shouldn't be using PGP in 2020.
- upofadown 6y agoGee, this anti-PGP rant showed up 3 times so far in this thread. I think that justifies a link to my critique: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
- btilly 6y agoHonestly, I have no idea who you are. I'm not surprised that someone out there thinks that it is a good idea. However every cryptographer that I know to trust who has bothered to comment on PGP has said to not use it. For example see https://www.schneier.com/tag/pgp/ https://www.schneier.com/tag/pgp/, or https://secushare.org/PGP https://secushare.org/PGP. Therefore I won't be using PGP. No matter how much you like it.
- j45 6y agoNice to see Thunderbird still improving. It also reminds me of the infamously long delay on JIRA-1369, the 20 year old ticket. https://jira.atlassian.com/browse/JRASERVER-1369 https://jira.atlassian.com/browse/JRASERVER-1369 At least it's neat software can be used for 20 years.
- shp0ngle 6y ago"How much do you trust the owner of this key to sign other keys properly? * I don't know * I do NOT trust * I trust marginally * I trust fully * I trust ultimately" This is a real pop-up I got the last time I tried to use PGP with Thunderbird. If people still get regular pop-ups like these, I don't think PGP will ever be popular. They might have switched to PEP (pretty easy privacy) that uses TOFU (trust-on-first-use) so maybe this is thing of the past, but I don't know.
- quadrifoliate 6y agoI know it's virtually forbidden to discuss practical details of PGP on HN, but what do you think is the sticking point about that pop-up? It makes people think a little rather than trust blindly, which seems to be...good? I do agree that the marginally and fully options are useless. Wonder if adoption would be better if you just removed them, and were left with: - I don't know what PGP is (exit, opens documentation or a tutorial) - I definitely distrust this key (because it has been marked as malicious in the wild) - I trust this key (because I have verified it either in person, or through a proof like Keybase)
- shp0ngle 6y agoEven you misunderstood that question. It's not "how do I trust this person key", but - "how much do I trust this person to sign other people's keys ". As in "how much do I think that other person is careful in checking other people's keys". Not judging his key, or your ability to check keys. You are judging the other person capability to check another, third person keys. This is important for PGP "web of trust".
- deleted 6y ago[deleted]
- globular-toast 6y agoSecurity has a big dirty secret: it's hard. If what you're doing is easy, it ain't security. Simple as that. TOFU works if you actually do it properly. That means verifying the fingerprint of the key you just received out of band once time. Now you can trust that key. How many people do this? Even IT professionals just routinely say yes for new ssh keys without checking. That's not TOFU, that's just trusting that you are not under attack which is not security. TOFU is actually just a degenerative form of web of trust anyway where you just automatically say "I do not trust" to the above so that each new trusted key needs to be established individually. But it does make it easier. Easier to not be doing security at all.
- TheDesolate0 6y agoMozilla is so broken. I would be surprised if they last another year. I wonder if Nvidia would like to buy them...
- LockAndLol 6y agoHas someone made a ranking of the oldest bugs Mozilla has? Maybe even by severity? I remember some years ago a security ticket was resolved after someone on reddit celebrated its decennial.
- globular-toast 6y agoThunderbird has the only calendar I know that has a "multiweek" display as opposed to (well, in addition to) the utterly retarded month view that exists in every other GUI. We've been doing electronic calendars for how long now? Why are we still using a paradigm from paper based calendars? At the beginning of a month I can see three weeks ahead, but at the end of the month I can see three weeks behind. It frustrates me no end that this is still a thing. It reminds me of the early days of Google maps when they were no better than paper maps, but now we can rotate the map, zoom in and out etc. But calendars are still no better than paper calendars. Apart from the one in Thunderbird.
- currysausage 6y agoSorry for nit-picking and being off-topic (I get your point!), but I don’t think there was ever a version of Google Maps without zoom. Actually, I have the fondest memories of the first version of Google Maps (the orange-themed one). It was so much better than anything it replaced at the time, and I think it would be perfectly usable even today, 15 years later!
- globular-toast 6y agoIt did have zoom, but they were fixed levels so no different to having multiple paper maps at different scales. Yes, of course there is the advantage that it's "not paper", but that was the only advantage really. This is not unexpected at all as new technology very often mimics existing technology in its first iteration. If you look at the first outputs of the Gutenberg press you can see they were trying to mimic handwritten books of the time. But usually the new technology very quickly surpasses the old after the first iteration, as electronic maps have now done.
- elric 6y agoMultiweek is pretty good. But I wish it had a better "multi day" view. Week view is great, a column per day, with the days neatly split into hour blocks. But my screen is huge. It could fit much more than 7 days with just as much detail. As soon as you switch to Multiweek, all that detail is lost. I guess what I'd like to see is a "Multi day" view, which starts today and displays the next N-days with as much detail as my screen allows (or N configured days).
- 29athrowaway 6y agoAny thoughts on Enigmail?
- justnotworthit 6y agoAs someone who deals with the opsec/public interface (and is a cynic about technology in general), I have to say that encrypted email via PGP has to be the computer security nerd's biggest and longest running "emperor has no clothes".