8 ms·

Thunderbird Time Machine: Windows XP and Thunderbird 1.0

TakeBlaster16 4y ago
I'm all for nostalgia, but I can't say I recommend putting your email credentials into 20-year-old software running on a 20-year-old OS connected to the internet. EDIT: why the downvotes? Windows XP can be infected with malware merely by plugging in a network cable with no user action. If you follow this blog post you're likely to lose your account. https://security.stackexchange.com/questions/185642/how-can-malware-immediately-infect-a-windows-xp-computer-as-soon-as-it-goes-onli https://security.stackexchange.com/questions/185642/how-can-...
- giancarlostoro 4y ago
  Oh what's the worse that could happen! :)
  - superkuh 4y ago
    Your private data gets accessed by a random person instead of by a megacorp.
    - ranger_danger 4y ago
      Same thing happens whenever you use any of those alternative "frontends" for sites like reddit, youtube, twitter etc.
    - giancarlostoro 4y ago
      Twas sarcasm
- jcranmer 4y ago
  If memory serves correctly, in the Thunderbird 1.0 era, all of the passwords would have been saved via encryption via NSS's secret decoder ring methods. So if you set up a master password, then the contents would be encrypted on-disk. (Even if you didn't, they're still not stored in plaintext--I just think it's encrypted with something like an empty password instead, but I'm not certain.) Additionally, I'm pretty sure even 20 years ago, Thunderbird would have still thrown up resistance at trying to connect to an email server without using STARTTLS or SSL.
  - yjftsjthsd-h 4y ago
    I wouldn't worry too much about encryption at rest, if nothing else then because it's only being stored on a local device that you control. What I would worry about is that those credentials are then going to be sent to a server and a system of that age probably doesn't speak any modern version of TLS.
  - TakeBlaster16 4y ago
    I wouldn't be worried about encryption. I'd be worried about any of the hundreds of widely-known vulnerabilities that were patched between 2002 and today. https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.html?vendor_id=452 https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.... https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp....
    - badsectoracula 4y ago
      Yes but there is a difference between possibility and probability: it is technically possible to hit these vulnerabilities, but the chances are practically zero, especially in the context here where someone might try it once like mentioned in the article. It isn't like there are many malware authors out there trying to infect people running 20 year old software (outside of targeted attacks). I think you are more likely to be affected by a vulnerability bug in some random modern macOS application with its own autoupdater than a vulnerability in a 20 year old Windows program. Remember that these issues existed when that software was actually mainstream and yet the overwhelming majority of people wasn't affected by them during the peak of their popularity.
      - TakeBlaster16 4y ago
        The difference is back then, the vulnerabilities weren't even discovered yet. Today, metasploit scanners are running 24/7 scanning the entire IPv4 address space for thousands of vulnerabilities at a time - including automated chaining of exploits through e.g. routers with misconfigured UPnP. You don't need to be targeted. As mentioned above, you can be exploited with no user action merely by plugging in an ethernet cable. But then again, I'm not your mom. If you really want to do this I can't stop you. Go ahead.
- Aeolun 4y ago
  As opposed to say, logging into Google?
- mixmastamyk 4y ago
  Target audience is likely running it in a VM and behind a NAT, if they even have a copy of XP. SP3 wasn't as bad as folks remember, look into "slipstream" for the install. Also, there are not swarms of infected XP machines around to attack as there were back in the day. Likely no active attacks for TB 1.0 as well. Worst case something might sniff an email password from an old version of SSL. Don't log in to important accounts I'd say.
- boomboomsubban 4y ago
  >why the downvotes? The blog post wasn't recommending putting your credentials into ancient software. It said if you're feeling adventurous you could fiddle around with it yourself by downloading it from the archives.
  - TakeBlaster16 4y ago
    Perhaps, but I can't imagine how you would fiddle around with an email client without adding an account, unless you just wanted to look at an empty list.
    - boomboomsubban 4y ago
      The few interested are already willing to go through the trouble of setting up a VM with an ancient OS. Presumably they could find some old database or virtualize a mail server for it or some other workaround I'm not imagining. I doubt anyone is going to read that and say "what a good idea, let's install Windows 98 on my hardware and muck about."
- floren 4y ago
  If you're a ProtonMail user, you could run the Proton Bridge on a Linux system in your network, then use PuTTY on Win XP to forward the ports from there to Windows. Then Thunderbird is only sending bridge-specific passwords unencrypted to localhost, and it's all modern encryption from there on out.
fimdomeio 4y ago
I don't know if it's nostalgia, if it's XP being the pinacle of user interface design, or if it was the thunderbird designers, but the screenshot looks better than current thunderbird. The balance between the items and how much that ask for your attention feels just right
- boomboomsubban 4y ago
  I'm think it's a combination of nostalgia and familiarity. Those were the kinds of UI's I used when I took classes about computer programs and spent a lot of time independently learning programs. All those hours spent makes it feel more comfortable though it may not actually be better.
  - jrm4 4y ago
    I think ""preferred familiarity" over time is literally the only meaningful definition of "better." I'm growing quite tired of the deeply stupid idea that these UX/UI people understand how I work better than I do.
    - boomboomsubban 4y ago
      "Preferred familiarity" is a subjective thing, and since you've developed your preferences there have been a billion new computer users who are more familiar with the modern designs. That's why the designs change, things like Thunderbird aren't the trend setters. Ideally both UI gets maintained, but that's not always feasible.
      - jrm4 4y ago
        Sure, but lets keep clear what you're saying: "Despite the existence of working preferences, so called modern-designers spend their days changing things for potentially no reason -- but even if there is a good reason -- they're also breaking backward compatibility." In other words, let's not pretend how design-fashion is executed is always good or even neutral in operation in terms of helping people.
captainmuon 4y ago
What's interesting to me is that I actually like the old interface better than the current one. But the part that matters, the actual email list, has barely changed in 20 years. This is the place where I feel they need to modernize most. Thunderbird needs a robust, clean conversation view, like GMail or macOS Mail.app (That app is actually one of the main reasons I use a Mac right now. If there was an on par OSS version I would probably use Linux.) Also, I miss proper Outlook (Office365/Exchange) integration. I hate it, but if you use it at work it has to work. There is an integration, but it is a paid plugin. That said, I really hope Thunderbird succeeds and becomes relevant again. If you have a certain amount of mail, a real mail client is just so much better than webmail, and it is great to have an OSS version.
- mixmastamyk 4y ago
  > conversation view One webmail I use has this, but shows only one line per message, with giant headers. I have to expand the thread anyway so don't see the point. Maybe if it could show most of each message like a chat client it would be useful. > becomes relevant again Been using it since it was called "Netscape Mail."
- heldergg 4y ago
  > the actual email list, has barely changed in 20 years That's about to change: https://developer.thunderbird.net/planning/roadmap https://developer.thunderbird.net/planning/roadmap
haunter 4y ago
I'd pay for a modern (secure) Eudora port. It was a great software and 7.1 source code is available https://computerhistory.org/blog/the-eudora-email-client-source-code/ https://computerhistory.org/blog/the-eudora-email-client-sou... There was a Thunderbird Eudora client (well it was an extension) but got abandoned quickly https://en.wikipedia.org/wiki/Eudora_OSE https://en.wikipedia.org/wiki/Eudora_OSE
- throwaway2309n 4y ago
  I still use Eudora as my primary client for both home & work email use. IMAPS, POP3S, TLSv1.2, etc. The biggest help in accomplishing this was a project from few years back... https://sourceforge.net/projects/hermesmail https://sourceforge.net/projects/hermesmail You basically need 3 DLL & 1 P7B files to patch the default 7.1.0.9 install to gain the required functionality for using a modern secure mail server.
rob-olmos 4y ago
Still beats Gmail's UI/UX 20 years later
- gnuj3 4y ago
  What’s email provider got to do with a software provider?
kergonath 4y ago
> Visually, it prided itself on having a pretty consistent look across Windows, Mac OS X, and Linux distributions like CentOS 3.3 or Red Hat. That’s probably one reason why it never was very successful on OS X.
jonathantf2 4y ago
Not related to Thunderbird but I think it's a testament to Microsoft's backwards compatibility that you can just run a program from 2003 with no issues whatsoever.
- mxuribe 4y ago
  See, I'm torn on this. Part of me feels that the ability to use older hardware and hence older software (without being forced to upgrade both HS and SW) is liberating, fun, and gosh darn useful! ...And it helps with folks who financially lack the means to constantly keep upgrading. But, then, the other side of my brain says: there are some legitimate reasons for *some* upgrades like security updates, simpler ways of doing the same processes, etc. Also, developing software without needing to be too backwards-compatible does make it so many more people can participate in development without too much burden. I imagine some yound person new dev and full of creative new ideas need not to learn tons of legacy code only for backwards compatibility. That approach of freshness can be liberating too!
- hulitu 4y ago
  Let's not exagerate. You can run some programs, not all.
insane_dreamer 4y ago
yes, I recall eagerly installing Mozilla + Thunderbird 1.0 in 2004 but on Hoary Hedgehog (Ubuntu 5.04) not WinXP.

I'm all for nostalgia, but I can't say I recommend putting your email credentials into 20-year-old software running on a 20-year-old OS connected to the internet. EDIT: why the downvotes? Windows XP can be infected with malware merely by plugging in a network cable with no user action. If you follow this blog post you're likely to lose your account. https://security.stackexchange.com/questions/185642/how-can-malware-immediately-infect-a-windows-xp-computer-as-soon-as-it-goes-onli https://security.stackexchange.com/questions/185642/how-can-...

giancarlostoro 4y ago
Oh what's the worse that could happen! :)
- superkuh 4y ago
  Your private data gets accessed by a random person instead of by a megacorp.
  - ranger_danger 4y ago
    Same thing happens whenever you use any of those alternative "frontends" for sites like reddit, youtube, twitter etc.
  - giancarlostoro 4y ago
    Twas sarcasm
jcranmer 4y ago
If memory serves correctly, in the Thunderbird 1.0 era, all of the passwords would have been saved via encryption via NSS's secret decoder ring methods. So if you set up a master password, then the contents would be encrypted on-disk. (Even if you didn't, they're still not stored in plaintext--I just think it's encrypted with something like an empty password instead, but I'm not certain.) Additionally, I'm pretty sure even 20 years ago, Thunderbird would have still thrown up resistance at trying to connect to an email server without using STARTTLS or SSL.
- yjftsjthsd-h 4y ago
  I wouldn't worry too much about encryption at rest, if nothing else then because it's only being stored on a local device that you control. What I would worry about is that those credentials are then going to be sent to a server and a system of that age probably doesn't speak any modern version of TLS.
- TakeBlaster16 4y ago
  I wouldn't be worried about encryption. I'd be worried about any of the hundreds of widely-known vulnerabilities that were patched between 2002 and today. https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.html?vendor_id=452 https://www.cvedetails.com/product/3678/Mozilla-Thunderbird.... https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp....
  - badsectoracula 4y ago
    Yes but there is a difference between possibility and probability: it is technically possible to hit these vulnerabilities, but the chances are practically zero, especially in the context here where someone might try it once like mentioned in the article. It isn't like there are many malware authors out there trying to infect people running 20 year old software (outside of targeted attacks). I think you are more likely to be affected by a vulnerability bug in some random modern macOS application with its own autoupdater than a vulnerability in a 20 year old Windows program. Remember that these issues existed when that software was actually mainstream and yet the overwhelming majority of people wasn't affected by them during the peak of their popularity.
    - TakeBlaster16 4y ago
      The difference is back then, the vulnerabilities weren't even discovered yet. Today, metasploit scanners are running 24/7 scanning the entire IPv4 address space for thousands of vulnerabilities at a time - including automated chaining of exploits through e.g. routers with misconfigured UPnP. You don't need to be targeted. As mentioned above, you can be exploited with no user action merely by plugging in an ethernet cable. But then again, I'm not your mom. If you really want to do this I can't stop you. Go ahead.
Aeolun 4y ago
As opposed to say, logging into Google?
mixmastamyk 4y ago
Target audience is likely running it in a VM and behind a NAT, if they even have a copy of XP. SP3 wasn't as bad as folks remember, look into "slipstream" for the install. Also, there are not swarms of infected XP machines around to attack as there were back in the day. Likely no active attacks for TB 1.0 as well. Worst case something might sniff an email password from an old version of SSL. Don't log in to important accounts I'd say.
boomboomsubban 4y ago
>why the downvotes? The blog post wasn't recommending putting your credentials into ancient software. It said if you're feeling adventurous you could fiddle around with it yourself by downloading it from the archives.
- TakeBlaster16 4y ago
  Perhaps, but I can't imagine how you would fiddle around with an email client without adding an account, unless you just wanted to look at an empty list.
  - boomboomsubban 4y ago
    The few interested are already willing to go through the trouble of setting up a VM with an ancient OS. Presumably they could find some old database or virtualize a mail server for it or some other workaround I'm not imagining. I doubt anyone is going to read that and say "what a good idea, let's install Windows 98 on my hardware and muck about."
floren 4y ago
If you're a ProtonMail user, you could run the Proton Bridge on a Linux system in your network, then use PuTTY on Win XP to forward the ports from there to Windows. Then Thunderbird is only sending bridge-specific passwords unencrypted to localhost, and it's all modern encryption from there on out.

fimdomeio 4y ago

I don't know if it's nostalgia, if it's XP being the pinacle of user interface design, or if it was the thunderbird designers, but the screenshot looks better than current thunderbird. The balance between the items and how much that ask for your attention feels just right

boomboomsubban 4y ago
I'm think it's a combination of nostalgia and familiarity. Those were the kinds of UI's I used when I took classes about computer programs and spent a lot of time independently learning programs. All those hours spent makes it feel more comfortable though it may not actually be better.
- jrm4 4y ago
  I think ""preferred familiarity" over time is literally the only meaningful definition of "better." I'm growing quite tired of the deeply stupid idea that these UX/UI people understand how I work better than I do.
  - boomboomsubban 4y ago
    "Preferred familiarity" is a subjective thing, and since you've developed your preferences there have been a billion new computer users who are more familiar with the modern designs. That's why the designs change, things like Thunderbird aren't the trend setters. Ideally both UI gets maintained, but that's not always feasible.
    - jrm4 4y ago
      Sure, but lets keep clear what you're saying: "Despite the existence of working preferences, so called modern-designers spend their days changing things for potentially no reason -- but even if there is a good reason -- they're also breaking backward compatibility." In other words, let's not pretend how design-fashion is executed is always good or even neutral in operation in terms of helping people.

captainmuon 4y ago

What's interesting to me is that I actually like the old interface better than the current one. But the part that matters, the actual email list, has barely changed in 20 years. This is the place where I feel they need to modernize most. Thunderbird needs a robust, clean conversation view, like GMail or macOS Mail.app (That app is actually one of the main reasons I use a Mac right now. If there was an on par OSS version I would probably use Linux.) Also, I miss proper Outlook (Office365/Exchange) integration. I hate it, but if you use it at work it has to work. There is an integration, but it is a paid plugin. That said, I really hope Thunderbird succeeds and becomes relevant again. If you have a certain amount of mail, a real mail client is just so much better than webmail, and it is great to have an OSS version.

mixmastamyk 4y ago
> conversation view One webmail I use has this, but shows only one line per message, with giant headers. I have to expand the thread anyway so don't see the point. Maybe if it could show most of each message like a chat client it would be useful. > becomes relevant again Been using it since it was called "Netscape Mail."
heldergg 4y ago
> the actual email list, has barely changed in 20 years That's about to change: https://developer.thunderbird.net/planning/roadmap https://developer.thunderbird.net/planning/roadmap

haunter 4y ago

I'd pay for a modern (secure) Eudora port. It was a great software and 7.1 source code is available https://computerhistory.org/blog/the-eudora-email-client-source-code/ https://computerhistory.org/blog/the-eudora-email-client-sou... There was a Thunderbird Eudora client (well it was an extension) but got abandoned quickly https://en.wikipedia.org/wiki/Eudora_OSE https://en.wikipedia.org/wiki/Eudora_OSE

throwaway2309n 4y ago
I still use Eudora as my primary client for both home & work email use. IMAPS, POP3S, TLSv1.2, etc. The biggest help in accomplishing this was a project from few years back... https://sourceforge.net/projects/hermesmail https://sourceforge.net/projects/hermesmail You basically need 3 DLL & 1 P7B files to patch the default 7.1.0.9 install to gain the required functionality for using a modern secure mail server.

rob-olmos 4y ago

Still beats Gmail's UI/UX 20 years later

gnuj3 4y ago
What’s email provider got to do with a software provider?

kergonath 4y ago

> Visually, it prided itself on having a pretty consistent look across Windows, Mac OS X, and Linux distributions like CentOS 3.3 or Red Hat. That’s probably one reason why it never was very successful on OS X.

jonathantf2 4y ago

Not related to Thunderbird but I think it's a testament to Microsoft's backwards compatibility that you can just run a program from 2003 with no issues whatsoever.

mxuribe 4y ago
See, I'm torn on this. Part of me feels that the ability to use older hardware and hence older software (without being forced to upgrade both HS and SW) is liberating, fun, and gosh darn useful! ...And it helps with folks who financially lack the means to constantly keep upgrading. But, then, the other side of my brain says: there are some legitimate reasons for *some* upgrades like security updates, simpler ways of doing the same processes, etc. Also, developing software without needing to be too backwards-compatible does make it so many more people can participate in development without too much burden. I imagine some yound person new dev and full of creative new ideas need not to learn tons of legacy code only for backwards compatibility. That approach of freshness can be liberating too!
hulitu 4y ago
Let's not exagerate. You can run some programs, not all.

insane_dreamer 4y ago

yes, I recall eagerly installing Mozilla + Thunderbird 1.0 in 2004 but on Hoary Hedgehog (Ubuntu 5.04) not WinXP.