6 ms·

Summary: Mozilla used a library called RNP instead of integrating GPG. RNP does not support many GPG features, such as smartcards. Enigmail, the old method o

Summary: Mozilla used a library called RNP instead of integrating GPG. RNP does not support many GPG features, such as smartcards. Enigmail, the old method of using GnuPG with Thunderbird, is broken in 78.x. Author recommends downgrading to 68.x and using Enigmail for advanced users.

qzw 6y ago
Right, but then Thunderbird regularly prompts you to update to 78.x, and I’ve almost clicked ok several times already. I assume there’s probably a setting one can toggle in the config editor to turn off the prompt, but there should really be an option in the UI.
- forgotmypw17 6y ago
  When this type of stuff starts happening, I take it as a sign that the software has reached "critical mass", is now in a runaway cycle of increasing abuse of its users, and migrate away as quickly as possible. Thunderbird, years ago for me. If a human acts abusive towards me, it is logical to end the relationship, even if it is years old. I am a tolerant person, so once or twice I may accept excuses and justifications, but after that, it's time to distance myself. I don't see why it should be any different from software. If I feel like I am dependent on it and "can't" move away, all the more reason to prioritize finding alternatives. It is irrelevant whether the causes are incompetence, malice, or "accidental", the result is all the same, and I cannot allow it.
  - selestify 6y ago
    Sounds like a pretty reasonable personal choice to me, I don’t know why you’re being downvoted without any explanatory comments.
  - arsome 6y ago
    There is still, somehow, nothing I've found that's better than Thunderbird for an open source desktop GUI email client. Little choice but to allow it for many users like myself. Worse still - even many of the proprietary ones now rely on 3rd party servers for "cloud" features, or are bloated and ugly electron apps.
    - lmm 6y ago
      KMail is pretty great IME.
  - pizza234 6y ago
    There's not much in the email clients landscape; almost nothing in Linux, actually. I suppose that this is because nowadays almost all the users read email from web clients. For me TB just works (especially because I'm locked at the ESR version, 68), however, I've never been extremly happy of it.
    - forgotmypw17 6y ago
      "I know I shouldn't stay with them, but they are a good person, and even if they beat me, I just don't know if there are any better options out there." No offense intended, that's what your comment sounds like. If you start looking, I bet you will find some options.
      - theamk 6y ago
        I did start looking, and I didn’t find anything’ better. It seems most of the people who cared about local mail clients moved to either: - online services, which are way worse Re: auto-updates, they do not even ask. - mail clients with limited HTML support, which are not usable with many online stores I want to use. Which mail client are you using?
      - pizza234 6y ago
        There is a variety of desktop mail clients, but the vast majority (of cross platform _and_ open source) is small-ish unkown-ish programs. The plugin system is in my opionion important (like for browsers) functionality, so popularity of a client is a significant factor, in order to have plugins available. Evolution is possibly the only valid competitor, however, it's not cross-platform as Thunderbird.
mappu 6y ago
Backstory: GnuPG is a program, not a library, and attempts to use it as one involve parsing its stdout (e.g. using GPGME) Thunderbird renders untrusted HTML content and therefore is subject to a steady stream of CVEs and must stay absolutely up-to-date with Gecko Gecko scaled back XUL and extension support, and WebExtensions are not sufficient to allow an Enigmail extension to run an installed binary.
- im3w1l 6y ago
  Which version of HTML is used for email? No javascript for instance right? Possible to make a reduced parser for which it is easier to verify correctness?
  - freeone3000 6y ago
    There is no standard HTML version for email, the same way there is no standard HTML version for a website. The contents can reasonably be anything.
    - im3w1l 6y ago
      Follow up question: What parts of html do you need implement to render 99% of emails decently accurately?
      - freeone3000 6y ago
        For a very long time, the limit was Outlook on Windows, which used the Word 2003 parser. So, whatever was supported by Word 2003. But, more recently, mail campaigns have instead targeted Gmail, so "whatever Gmail renders" (this is not everything a browser renders, but is close). It's not feasible to implement a subset for this and do parallel CVE fixes.
        emilsedgh 6y ago
        Unfortunately Outlook has a pretty big market share in corporate world and if you're serious about your emails, you still have to support it. It's worse than IE6. And to help your sanity, use mjml.

qzw 6y ago

Right, but then Thunderbird regularly prompts you to update to 78.x, and I’ve almost clicked ok several times already. I assume there’s probably a setting one can toggle in the config editor to turn off the prompt, but there should really be an option in the UI.

forgotmypw17 6y ago
When this type of stuff starts happening, I take it as a sign that the software has reached "critical mass", is now in a runaway cycle of increasing abuse of its users, and migrate away as quickly as possible. Thunderbird, years ago for me. If a human acts abusive towards me, it is logical to end the relationship, even if it is years old. I am a tolerant person, so once or twice I may accept excuses and justifications, but after that, it's time to distance myself. I don't see why it should be any different from software. If I feel like I am dependent on it and "can't" move away, all the more reason to prioritize finding alternatives. It is irrelevant whether the causes are incompetence, malice, or "accidental", the result is all the same, and I cannot allow it.
- selestify 6y ago
  Sounds like a pretty reasonable personal choice to me, I don’t know why you’re being downvoted without any explanatory comments.
- arsome 6y ago
  There is still, somehow, nothing I've found that's better than Thunderbird for an open source desktop GUI email client. Little choice but to allow it for many users like myself. Worse still - even many of the proprietary ones now rely on 3rd party servers for "cloud" features, or are bloated and ugly electron apps.
  - lmm 6y ago
    KMail is pretty great IME.
- pizza234 6y ago
  There's not much in the email clients landscape; almost nothing in Linux, actually. I suppose that this is because nowadays almost all the users read email from web clients. For me TB just works (especially because I'm locked at the ESR version, 68), however, I've never been extremly happy of it.
  - forgotmypw17 6y ago
    "I know I shouldn't stay with them, but they are a good person, and even if they beat me, I just don't know if there are any better options out there." No offense intended, that's what your comment sounds like. If you start looking, I bet you will find some options.
    - theamk 6y ago
      I did start looking, and I didn’t find anything’ better. It seems most of the people who cared about local mail clients moved to either: - online services, which are way worse Re: auto-updates, they do not even ask. - mail clients with limited HTML support, which are not usable with many online stores I want to use. Which mail client are you using?
    - pizza234 6y ago
      There is a variety of desktop mail clients, but the vast majority (of cross platform _and_ open source) is small-ish unkown-ish programs. The plugin system is in my opionion important (like for browsers) functionality, so popularity of a client is a significant factor, in order to have plugins available. Evolution is possibly the only valid competitor, however, it's not cross-platform as Thunderbird.

mappu 6y ago

Backstory: GnuPG is a program, not a library, and attempts to use it as one involve parsing its stdout (e.g. using GPGME) Thunderbird renders untrusted HTML content and therefore is subject to a steady stream of CVEs and must stay absolutely up-to-date with Gecko Gecko scaled back XUL and extension support, and WebExtensions are not sufficient to allow an Enigmail extension to run an installed binary.

im3w1l 6y ago
Which version of HTML is used for email? No javascript for instance right? Possible to make a reduced parser for which it is easier to verify correctness?
- freeone3000 6y ago
  There is no standard HTML version for email, the same way there is no standard HTML version for a website. The contents can reasonably be anything.
  - im3w1l 6y ago
    Follow up question: What parts of html do you need implement to render 99% of emails decently accurately?
    - freeone3000 6y ago
      For a very long time, the limit was Outlook on Windows, which used the Word 2003 parser. So, whatever was supported by Word 2003. But, more recently, mail campaigns have instead targeted Gmail, so "whatever Gmail renders" (this is not everything a browser renders, but is close). It's not feasible to implement a subset for this and do parallel CVE fixes.
      - emilsedgh 6y ago
        Unfortunately Outlook has a pretty big market share in corporate world and if you're serious about your emails, you still have to support it. It's worse than IE6. And to help your sanity, use mjml.