13 ms·

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a leg

I get the impression that the article's author didn't really read the linked help page. It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. For good reasons, as described. That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. IMAP is definitely more functional, but has a successor - JMAP. So in some sense, it'd not even be entirely wrong to migrate. Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost.

mattgreenrocks 4y ago
Shaming people for not having HTTPS on their blog is not a great look. :/
- chowells 4y ago
  I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.
  - hsbauauvhabzb 4y ago
    Exactly what risk does it have being on a low profile blog?
    - oddlama 4y ago
      I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.
      - BeefWellington 4y ago
        I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page. Note: It's really, "see and modify undetected" what data you are exchanging with any server.
    - handsclean 4y ago
      It results in your browsing history being tracked and sometimes sold by your access point and ISP at a page level instead of just domain level, results in injected ads and banners on some access points, results in injected trackers on Verizon, and more broadly it permits unknown third parties to alter the content of your website.
      - mccorrinall 4y ago
        If someone wants to track you, they can just mark the frame. Marking packets isn’t anything new,
    - cesarb 4y ago
      Will it always be a "low profile blog"? It just got on the front page of HN, which is not exactly "low profile". As for what risk, two words: Great Cannon. For those who don't know, it's a well-known MITM attacker which injects JavaScript code on non-HTTPS pages, the injected JavaScript being used to do distributed denial of service attacks on other sites. Using HTTPS protects against these kinds of attacks.
  - rizky05 4y ago
  - bitwize 4y ago
    Your analogy is flawed because this is Hackernews and, superior beings that we are, we understand body odor to be a symptom of a microbiome that's out of whack due to "modern life". Accordingly, we don't bathe in order to cultivate healthy skin bacteria; some of us wallow in mud instead.
    - chowells 4y ago
      I'm not sure you read what I wrote. At no point did I say to bathe, or in fact proffer any treatment at all for body odor. I merely pointed out that refusing to deal with it when you're in close quarters with a large number of people is antisocial. If somehow wallowing in mud treats it for someone, then that's what they should be doing. The problem is knowing how to solve it and refusing to do so.
- Dylan16807 4y ago
  Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.
  - pvorb 4y ago
    You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.
    - Ferret7446 4y ago
    - sgtnoodle 4y ago
      I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitely wasn't trivial.
      - intelVISA 4y ago
        > but I am a highly experienced software engineer with a deep understanding of network protocols Thank you for your service
        sgtnoodle 4y ago
        Lol, thanks. I rarely work on stuff exposed to the Internet. I've implemented multiple bare metal IP stacks from scratch, including Ethernet, DHCP, ARP, ICMP, and UDP. I've run real-time safety critical packets over TCP links. I've tunneled IP traffic through the international space station. I've done unforgivable things with iptables and awk. The funny thing is that IPv6 short-circuits my brain. Why do I have four addresses, and where did they come from? Why isn't there a link-local address for loopback and wireguard?
- seanp2k2 4y ago
  What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)
  - vlovich123 4y ago
    So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.
    - bayindirh 4y ago
      > inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.
      - cortesoft 4y ago
        That is not possible. You would get a cert mismatch error.
        bayindirh 4y ago
        The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o disturbing the connection too much. So, having a HTTPS connection doesn't make it tamper resistant, but tamper evident, at most.
- hnbad 4y ago
  Fun fact: HTTPS is implicitly required by the GDPR because the user agent metadata is considered PII and websites are required to implement best current practices, which includes HTTPS. There is no exemption for (public) personal websites as they're still providing a publicly accessible service and processing PII to do so. The same goes for a privacy policy for that matter.
Angostura 4y ago
> That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. And one big advantage - it actually allows you retrieve and store e-mail locally - irrespective of any server allocation.
- josephg 4y ago
  JMAP works great for this too. It’s a shame JMAP isn’t widely implemented - it’s a lovely standard.
- loloquwowndueo 4y ago
  Um what? Nothing in IMAP prevents you from doing the same. Just because most client implementations assume you want to keep your mail on the server by default, does not mean the protocol doesn’t account for the other possibility. And to be fair, configuring most clients to retrieve and then delete, or keep a local copy in addition to the server one, is not difficult at all - these options are not hidden or anything.
  - Angostura 4y ago
    I would challenge you to show how you would configure a common IMAP client to keep email locally and delete it from the server.
    - Avamander 4y ago
      imapsync for example or drag'n'drop/filter in Thunderbird. Not that difficult.
  - megous 4y ago
    POP3 is exceedingly simple protocol compared to IMAP. I'd rather use the simplest tool for the job. In case the password leaks, attacker can only fetch new messages over POP3, and not plant them or fetch the entire archive from the server. (yeah, I can fetch and delete over IMAP too, but then what's the point of all the extra unused complexity of IMAP, it's just an extra risk)
bayindirh 4y ago
> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide whether JMAP is worthy of the effort to replace IMAP. Having a IETF RFC is a good start, but let's see...
- cortesoft 4y ago
  > If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.
  - bayindirh 4y ago
    Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.
    - cortesoft 4y ago
      They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.
      - deleted 4y ago
        [deleted]
      - josephcsible 4y ago
        And if you're using TLS ECH, then they wouldn't even know the host name.
1vuio0pswjnm7 4y ago
"Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost." This blog can be read over TLS using gemini://. printf 'gemini://gemini.conman.org/boston/2022/09/22.1\r\n' \ |openssl s_client -connect 71.19.142.20:1965 -ign_eof Also https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/09/22.1 https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...
- shadowgovt 4y ago
  Do either of these address the underlying problem that without https there's no guarantee that the blog content hasn't been modified in transit? Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right?
  - shakna 4y ago
    > Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right? All Gemini is signed. [0] It's mandatory. That's why the parent piped through openssl to connect. For example, the page that we're looking at is signed. [1] (Using a bridge to show the certificate, but you can verify it yourself, as well.) [0] https://gemini.circumlunar.space/docs/specification.html https://gemini.circumlunar.space/docs/specification.html [1] https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/09/22.1?crt=1 https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...
    - yardstick 4y ago
      Is that signature from the original author, or from an intermediary/Gemini proxy?
      - shakna 4y ago
        The authour. You can see their domain in the email that makes the signature. > CA/emailAddress=ca@conman.org > CN=gemini.conman.org/emailAddress=sean@conman.org
johnklos 4y ago
The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.
- rendaw 4y ago
  This has already happened! My school promised email for life, and uses Microsoft's Office365. A couple months ago they sent out emails saying if you don't update your client to use "modern auth" (which was a new term for me) I'd lose the ability to check my email. Well Microsoft blocks the Thunderbird embedded browser, so you can't complete the Oauth2 login. I've been effectively locked out of my account since (I'm not going to use the webmail just for this account - set up a forwarding email and told everyone to use my new address).
  - amaccuish 4y ago
    Microsoft doesn't by default block the embedded Thunderbird browser. An admin can however enable that setting.
    - magicalhippo 4y ago
      Guess it would be nice with a fall-back option in Thunderbird to use the system browser.
  - kevin_thibedeau 4y ago
    So spoof the user agent.
- Meph504 4y ago
  That letter isn't from microsoft though, I manage several tenants, and none of our end users or admin got that letter. specifically what is missing, is that email using basic auth won't disconnected OCT 1st because of the tons and tons of machine that do things like email faxes, and scans that do not support modern authentication. This looks like whoever "enterprise services" is, they wrote a brief message that wasn't very accurate.
Ajedi32 4y ago
Are there any non-Microsoft email clients that support different authentication protocols with IMAP connections to Exchange Online? The message from Microsoft certainly makes it seem like IMAP itself is being deprecated.
trasz 4y ago
>It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. Problem is, it is being replaced by solution that decreases security.
wizofaus 4y ago
Didn't know about JMAP - had been looking recently for open JSON-API-over-HTTP protocols, good to know.
megous 4y ago
What downsides POP3 has? Looks like a terribly simple protocol and does the job of moving messages from one place to another quite well for me. Having to use anything more complex would be a downgrade. More complex to setup on server and client side, with more options and more problems to take care of. I like to use the simplest tool for the job.
- Avamander 4y ago
  > What downsides POP3 has? Looks like a terribly simple protocol Exactly that, it's terribly simple. People have multiple devices, that alone makes POP3 an annoying protocol to use.
  - ReallyOldLurker 4y ago
    >> ... multiple devices, that alone... A big assumption. POP3 works perfectly fine and is preferable in my situation.
    - Avamander 4y ago
      No, not an assumption. Also, good for you.
- billpg 4y ago
  The UIDL command is specified as an optional command, but it's really required. https://billpg.com/pop3-uidl/ https://billpg.com/pop3-uidl/ The workload required to poll is heavy. You need to reconnect TCP, TLS and login. Once you find you have no messages, you have start over to check again. https://billpg.com/pop3-commit-refresh/ https://billpg.com/pop3-commit-refresh/ Clients and servers need to keep a short-term "message id" to long-term "unique-id" map. https://billpg.com/pop3-message-ids/ https://billpg.com/pop3-message-ids/ Deletes are batched and only committed at the end of a connection. Unless you're willing to close and reopen a connection right away, any messages you delete are in a not-quite-deleted limbo until you close the connection. https://billpg.com/pop3-deli/ https://billpg.com/pop3-deli/
denton-scratch 4y ago
> It's basic auth that's getting deprecated I missed that, because I don't jump down every linked rabbithole. Thanks. Basic auth shouldn't be used for anything; I'm surprised it isn't already deprecated to hell and back. The letter says that Microsoft intends to deprecate IMAP and POP because some people use them with Basic auth. That doesn't make sense.

mattgreenrocks 4y ago

Shaming people for not having HTTPS on their blog is not a great look. :/

chowells 4y ago
I don't see the problem. HTTPS is basic internet hygiene. It's no worse than telling people they should mind their body odor when they're in a space with a lot of other people. Possibly indelicate, but undoubtedly true.
- hsbauauvhabzb 4y ago
  Exactly what risk does it have being on a low profile blog?
  - oddlama 4y ago
    I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page.
    - BeefWellington 4y ago
      I for example just wouldn't like anyone to be able to see what data I exchange with any server, be it small profile blog or a login page. Note: It's really, "see and modify undetected" what data you are exchanging with any server.
  - handsclean 4y ago
    It results in your browsing history being tracked and sometimes sold by your access point and ISP at a page level instead of just domain level, results in injected ads and banners on some access points, results in injected trackers on Verizon, and more broadly it permits unknown third parties to alter the content of your website.
    - mccorrinall 4y ago
      If someone wants to track you, they can just mark the frame. Marking packets isn’t anything new,
  - cesarb 4y ago
    Will it always be a "low profile blog"? It just got on the front page of HN, which is not exactly "low profile". As for what risk, two words: Great Cannon. For those who don't know, it's a well-known MITM attacker which injects JavaScript code on non-HTTPS pages, the injected JavaScript being used to do distributed denial of service attacks on other sites. Using HTTPS protects against these kinds of attacks.
- rizky05 4y ago
- bitwize 4y ago
  Your analogy is flawed because this is Hackernews and, superior beings that we are, we understand body odor to be a symptom of a microbiome that's out of whack due to "modern life". Accordingly, we don't bathe in order to cultivate healthy skin bacteria; some of us wallow in mud instead.
  - chowells 4y ago
    I'm not sure you read what I wrote. At no point did I say to bathe, or in fact proffer any treatment at all for body odor. I merely pointed out that refusing to deal with it when you're in close quarters with a large number of people is antisocial. If somehow wallowing in mud treats it for someone, then that's what they should be doing. The problem is knowing how to solve it and refusing to do so.
Dylan16807 4y ago
Noting an amusing interaction with the context isn't shaming. Though if someone can set it up in less than 15 minutes, and doesn't, I reserve the right to snark. It's not a bad look in cases like that.
- pvorb 4y ago
  You can do it in 15 minutes if you've already done it before. If you didn't, you'd be very lucky doing it in such a short time frame.
  - Ferret7446 4y ago
  - sgtnoodle 4y ago
    I set it up for my home server maybe a year ago. I'm not a web developer or system admin, but I am a highly experienced software engineer with a deep understanding of network protocols. The documentation didn't seem the greatest, basically being, "copy/paste this if you use Apache." My particular configuration was quirkier than the example assumed, and I had to go through a few rounds of troubleshooting. It definitely wasn't trivial.
    - intelVISA 4y ago
      > but I am a highly experienced software engineer with a deep understanding of network protocols Thank you for your service
      - sgtnoodle 4y ago
        Lol, thanks. I rarely work on stuff exposed to the Internet. I've implemented multiple bare metal IP stacks from scratch, including Ethernet, DHCP, ARP, ICMP, and UDP. I've run real-time safety critical packets over TCP links. I've tunneled IP traffic through the international space station. I've done unforgivable things with iptables and awk. The funny thing is that IPv6 short-circuits my brain. Why do I have four addresses, and where did they come from? Why isn't there a link-local address for loopback and wireguard?
seanp2k2 4y ago
What traffic between a blog without user auth for comments needs to be encrypted? Why? I understand that Let’s Encrypt exists and it’s “easy” to set up (for people with root access to the system hosting their site + a decent level of technical sysadmin proficiency)
- vlovich123 4y ago
  So that middlemen can’t spy on which part of the blog you’re visiting / alter the content of the blog / inject ads. There’s also all sorts of vulnerabilities that crop up if you use HTTP and HTTPS on the same site. All of this was present in the 90s and early 2000s so not really theoretical attacks.
  - bayindirh 4y ago
    > inject ads. If you believe that your ISP or a middleman can't inject ads without breaking the S in HTTPS, I have a bridge to sell you. They can just push the content into a frame and inject the content outside that frame. I encountered this more than once.
    - cortesoft 4y ago
      That is not possible. You would get a cert mismatch error.
      - bayindirh 4y ago
        The overall connection will drop to "mixed status", but the inner frame will still be HTTPS. My ISP used to do that when they started deploying DPI hardware as a technology demo. They'll hijack your traffic and inject full ads w/o redirection or added (bill) warning banners or ads sporadically to retrieved pages. My mobile carrier sometimes injects SMS & Notifications arriving to my modem if they find the chance w/o disturbing the connection too much. So, having a HTTPS connection doesn't make it tamper resistant, but tamper evident, at most.
hnbad 4y ago
Fun fact: HTTPS is implicitly required by the GDPR because the user agent metadata is considered PII and websites are required to implement best current practices, which includes HTTPS. There is no exemption for (public) personal websites as they're still providing a publicly accessible service and processing PII to do so. The same goes for a privacy policy for that matter.

Angostura 4y ago

> That aside, POP should really be considered legacy, it comes with many downsides that hinder people's e-mail usage. And one big advantage - it actually allows you retrieve and store e-mail locally - irrespective of any server allocation.

josephg 4y ago
JMAP works great for this too. It’s a shame JMAP isn’t widely implemented - it’s a lovely standard.
loloquwowndueo 4y ago
Um what? Nothing in IMAP prevents you from doing the same. Just because most client implementations assume you want to keep your mail on the server by default, does not mean the protocol doesn’t account for the other possibility. And to be fair, configuring most clients to retrieve and then delete, or keep a local copy in addition to the server one, is not difficult at all - these options are not hidden or anything.
- Angostura 4y ago
  I would challenge you to show how you would configure a common IMAP client to keep email locally and delete it from the server.
  - Avamander 4y ago
    imapsync for example or drag'n'drop/filter in Thunderbird. Not that difficult.
- megous 4y ago
  POP3 is exceedingly simple protocol compared to IMAP. I'd rather use the simplest tool for the job. In case the password leaks, attacker can only fetch new messages over POP3, and not plant them or fetch the entire archive from the server. (yeah, I can fetch and delete over IMAP too, but then what's the point of all the extra unused complexity of IMAP, it's just an extra risk)

bayindirh 4y ago

> Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost. If you're not doing anything requiring security, you don't need HTTPS, IMHO. > POP should really be considered legacy I know people who knowingly use POP to keep their remote boxes empty, and keep everything local, so I don't think we should decide for people that swiftly. Similarly, I'll let the wisdom of "Teh Internetz" to decide whether JMAP is worthy of the effort to replace IMAP. Having a IETF RFC is a good start, but let's see...

cortesoft 4y ago
> If you're not doing anything requiring security, you don't need HTTPS, IMHO. I disagree, for a lot of reasons. For one thing, I don't want some random WI-FI to know every page I visit, even insecure pages. I also don't want to leak any information about my browsing habits. Using https everywhere limits the information you leak about how much of your traffic is sensitive.
- bayindirh 4y ago
  Unless you use DNS over HTTPS, all the effort there is moot. Even then, a flow server can trace all the point to point IP traffic passing over it. Yes, it limits the obtained data a lot (no hostnames to begin with), but a proper traffic analyzer is rarely blinded completely by HTTPS.
  - cortesoft 4y ago
    They would know the IP address and host name from SNI, but they wouldn't know which articles on the blog I read.
    - deleted 4y ago
      [deleted]
    - josephcsible 4y ago
      And if you're using TLS ECH, then they wouldn't even know the host name.

1vuio0pswjnm7 4y ago

"Lack of HTTPS on the author's site also adds a nice subtle flavour to the blogpost." This blog can be read over TLS using gemini://. printf 'gemini://gemini.conman.org/boston/2022/09/22.1\r\n' \ |openssl s_client -connect 71.19.142.20:1965 -ign_eof Also https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/09/22.1 https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...

shadowgovt 4y ago
Do either of these address the underlying problem that without https there's no guarantee that the blog content hasn't been modified in transit? Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right?
- shakna 4y ago
  > Neither Gemini nor the Internet Archive have access to the content through a channel other than the insecure HTTP endpoint, right? All Gemini is signed. [0] It's mandatory. That's why the parent piped through openssl to connect. For example, the page that we're looking at is signed. [1] (Using a bridge to show the certificate, but you can verify it yourself, as well.) [0] https://gemini.circumlunar.space/docs/specification.html https://gemini.circumlunar.space/docs/specification.html [1] https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/09/22.1?crt=1 https://portal.mozz.us/gemini/gemini.conman.org/boston/2022/...
  - yardstick 4y ago
    Is that signature from the original author, or from an intermediary/Gemini proxy?
    - shakna 4y ago
      The authour. You can see their domain in the email that makes the signature. > CA/emailAddress=ca@conman.org > CN=gemini.conman.org/emailAddress=sean@conman.org

johnklos 4y ago

The linked help page doesn't make up for what the letter says. The letter is just plainly misleading. Read it again - they're unambiguously saying that non-Microsoft email programs that rely on SMTP, POP and/or IMAP will "stop functioning when Microsoft chooses to disable these protocols". That the linked help clarifies a little doesn't mean this is a flatly misleading letter.

rendaw 4y ago
This has already happened! My school promised email for life, and uses Microsoft's Office365. A couple months ago they sent out emails saying if you don't update your client to use "modern auth" (which was a new term for me) I'd lose the ability to check my email. Well Microsoft blocks the Thunderbird embedded browser, so you can't complete the Oauth2 login. I've been effectively locked out of my account since (I'm not going to use the webmail just for this account - set up a forwarding email and told everyone to use my new address).
- amaccuish 4y ago
  Microsoft doesn't by default block the embedded Thunderbird browser. An admin can however enable that setting.
  - magicalhippo 4y ago
    Guess it would be nice with a fall-back option in Thunderbird to use the system browser.
- kevin_thibedeau 4y ago
  So spoof the user agent.
Meph504 4y ago
That letter isn't from microsoft though, I manage several tenants, and none of our end users or admin got that letter. specifically what is missing, is that email using basic auth won't disconnected OCT 1st because of the tons and tons of machine that do things like email faxes, and scans that do not support modern authentication. This looks like whoever "enterprise services" is, they wrote a brief message that wasn't very accurate.

Ajedi32 4y ago

Are there any non-Microsoft email clients that support different authentication protocols with IMAP connections to Exchange Online? The message from Microsoft certainly makes it seem like IMAP itself is being deprecated.

trasz 4y ago

>It's basic auth that's getting deprecated, due to being considered a legacy authentication protocol. Problem is, it is being replaced by solution that decreases security.

wizofaus 4y ago

Didn't know about JMAP - had been looking recently for open JSON-API-over-HTTP protocols, good to know.

megous 4y ago

What downsides POP3 has? Looks like a terribly simple protocol and does the job of moving messages from one place to another quite well for me. Having to use anything more complex would be a downgrade. More complex to setup on server and client side, with more options and more problems to take care of. I like to use the simplest tool for the job.

Avamander 4y ago
> What downsides POP3 has? Looks like a terribly simple protocol Exactly that, it's terribly simple. People have multiple devices, that alone makes POP3 an annoying protocol to use.
- ReallyOldLurker 4y ago
  >> ... multiple devices, that alone... A big assumption. POP3 works perfectly fine and is preferable in my situation.
  - Avamander 4y ago
    No, not an assumption. Also, good for you.
billpg 4y ago
The UIDL command is specified as an optional command, but it's really required. https://billpg.com/pop3-uidl/ https://billpg.com/pop3-uidl/ The workload required to poll is heavy. You need to reconnect TCP, TLS and login. Once you find you have no messages, you have start over to check again. https://billpg.com/pop3-commit-refresh/ https://billpg.com/pop3-commit-refresh/ Clients and servers need to keep a short-term "message id" to long-term "unique-id" map. https://billpg.com/pop3-message-ids/ https://billpg.com/pop3-message-ids/ Deletes are batched and only committed at the end of a connection. Unless you're willing to close and reopen a connection right away, any messages you delete are in a not-quite-deleted limbo until you close the connection. https://billpg.com/pop3-deli/ https://billpg.com/pop3-deli/

denton-scratch 4y ago

> It's basic auth that's getting deprecated I missed that, because I don't jump down every linked rabbithole. Thanks. Basic auth shouldn't be used for anything; I'm surprised it isn't already deprecated to hell and back. The letter says that Microsoft intends to deprecate IMAP and POP because some people use them with Basic auth. That doesn't make sense.