4 ms·

Known Bad Email Clients

66 points by mike-cardwell 1y ago

tylerapplebaum 1y ago
Geary has been crashing with some regularity over the past few weeks anyway. Guess I’ll migrate to Thunderbird.
- theyknowitsxmas 1y ago
  I have that problem. Too bad there is no html client that isn't a massive RAM hog.
  - hexagonwin 1y ago
    seamonkey mail seems to work well for me
  - esseph 1y ago
    Do you often run out of memory? Want to understand this more. I know I'm talking from a position of privilege, but it's really hard to find a machine these days with less than 16 or 32GB of RAM from the factory. Even going back several years, DDR4 has been extremely cheap for a long time, and DDR5 is finally closer to general ram prices. Are you using mini PCs with soldered ram?
    - yjftsjthsd-h 1y ago
      > Want to understand this more. I know I'm talking from a position of privilege, but it's really hard to find a machine these days with less than 16 or 32GB of RAM from the factory. * Not everyone is using a new machine. * Right now, if I go to https://www.bestbuy.com/ https://www.bestbuy.com/ and scroll down until I hit a laptop, the first 2 have 16GB, and the third is https://www.bestbuy.com/site/hp-victus-15-6-144hz-full-hd-gaming-laptop-intel-core-i5-8gb-memory-nvidia-geforce-rtx-3050-512gb-ssd-mica-silver/6618924.p?skuId=6618924 https://www.bestbuy.com/site/hp-victus-15-6-144hz-full-hd-ga... with 8GB. It's not even cheap. * On my desk right now is a mini PC with 12GB, which I bought earlier this year. * Even if we pretend everyone has 16GB+, it would be nice if we could use that memory for other stuff instead of an email client hogging it.
      - esseph 1y ago
        Maybe, but email clients are basically web browsers these days.
        yjftsjthsd-h 1y ago
        Okay, but that's worse. Like, there's some argument about whether browsers should display documents vs being an entire operating system with an entire portable execution environment for arbitrary applications... but an email client has no such excuse.
        esseph 1y ago
        I'm not pointing out what I think it should be, I'm just acknowledging the reality of my inbox.
- mike-cardwell 1y ago
  I noticed that during my testing. Was difficult to keep it running for more than a few seconds at times. Thunderbird is a good choice.
- curt15 1y ago
  Isn't Geary basically a one-person show? I remember evaluating Geary a couple years ago and it looked like there was only one active developer. I ended up going with Thunderbird + Davmail.
thundarr 1y ago
If only he made that much effort to get Chromium to fix the issue. The source of the problem is with a dependency of the email clients, not the email clients themselves. He is bothering small free software projects so that those small free software projects ask Chromium to fix the issue.
- mike-cardwell 1y ago
  If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it. It's unacceptable to sit on a privacy affecting bug like this for 15 months. This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing: 1. Nothing to get the devs of that library to fix it 2. Nothing to fix the library themselves 3. Nothing to warn their users 4. Nothing in their local application to protect their users. This is not how secure development works.
  - Spivak 1y ago
    They have done #1 and the library is WebKit and so #2 isn't happening. Not the least of which because of the lack of expertise to patch that code base but because it's dynamically linked and in most deployment scenarios they get the webkit provided by the distro. If Evolution even tried to vendor WebKit downstream packagers would patch it out so that it links to the system lib and gets security patches along with the rest of the system.
    - jadamson 1y ago
      ...so strip the offending HTML before passing it to WebKit? What is this, kindergarten?
    - mike-cardwell 1y ago
      They really haven't done number 1. A bug report was submitted, and then it has stalled for 15 months. As of this point in time, nobody has explained to me why it would be a bad idea to add a "Do not rely on for privacy. More info" message next to the feature in Evolution Mail. That is 100% true. Users of Evolution Mail should not rely on that feature for privacy. Because Evolution Mail has chosen to add known flawed software to their application. And despite lacking the will or ability to fix that software, they are unwilling to take a different path to patch over the problem until it is fixed in the library, by sanitising the html and stripping problematic tags/attributes. These are all their choices. And all of their choices lead to end users being exposed to a privacy risk, and unaware of it.
shamiln 1y ago
Of course, no commercial ones like Outlook are on the list…
- mike-cardwell 1y ago
  The list is brand new. I will be updating it as I have time to test clients.
  - ipcress_file 1y ago
    Will you add a list of Known Good Email Clients? Or just "Tested Clients"? Since you can't possibly test them all, it would be nice to know which ones have been evaluated.
    - mike-cardwell 1y ago
      Yes. I will do that. Good idea.
- gruez 1y ago
  FWIW I tested with gmail a few weeks ago and it was fine.
Sophia95 1y ago
Evolution is the only client on Linux (that I’m aware of) that fully supports Microsoft exchange and Google out of the box without any plugins. I used thunderbird for a long time, however I got frustrated so many times after things broke after every update because essential plugins stopped working. Yes, you may say Evolution UI is old, but the software is rock solid and softwares in general are more than their GUI. It’s good to bring awareness about the tracking but I’m not so bothered by it, as its hard to find software that doesn’t track you these days
- nehal3m 1y ago
  >It’s good to bring awareness about the tracking but I’m not so bothered by it, as its hard to find software that doesn’t track you these days That's a non-sequitur. Just because it's common does not mean it's okay.
  - fsckboy 1y ago
    they didn't say it was ok, they said it was good to be informed about it, they were not personally bothered by it, and they added that it's difficult to find software that doesn't do it. there is no non sequitor
    - nehal3m 1y ago
      They said they're not bothered by it as it's difficult to find software that doesn't spy on you. I interpret that as 'I am not bothered by this because there are no alternatives'. So there is a non sequitur.
- zettabomb 1y ago
  I feel like I should note that Exchange support is indeed a plugin, and isn't installed by default on (for example) Fedora. However, I believe it's a first party plugin.
- forlorn 1y ago
  Thunderbird has reportedly added experimental Exchange support in 140. Though I haven't figured out how to enable and test it :)
qweqwe14 1y ago
[flagged]
zettabomb 1y ago
I wasn't aware of Balsa or Geary, but it's interesting to note that the author has mentioned that they are affected by GNOME's culture. I also have found the GNOME devs to have issues with admitting any fault at all, security or otherwise, but I wasn't aware of them being linked to any email clients other than Evolution - which I have been using. What's a good app for Exchange on Linux? I could use the web app, which my company has available, but I do appreciate having a dedicated email client sometimes, particularly for OS notifications (which will work without having the browser open).
- marcusb 1y ago
  Not defending the GNOME devs as being perfect, but I'd suggest reading this from the start: https://gitlab.gnome.org/GNOME/evolution/-/issues/3095 https://gitlab.gnome.org/GNOME/evolution/-/issues/3095 and then deciding if the author is really being affected by a "toxic development culture" at GNOME.
  - chucksmash 1y ago
    Reading the thread, I don't see how that's much of a defense. A GNOME foundation member going through the thread to decorate the reporter's posts with clown emoji reactions is not great. It seems reasonable to say "even if this is caused by one your library dependencies, users are using your application and you should try to find a mitigation." If you get in a wreck because your brakes fail, imagine the car manufacturer saying "oh that's not a problem with the car, it's a problem with the brakes. Talk to the brake manufacturer." "No warranty express or implied" and all that, but still.
    - zettabomb 1y ago
      Yeah ultimately the user doesn't install the dependencies, they install Evolution. So if there's a security issue, that's where they'll see it. There are also potential mitigation for this, for instance scrubbing the HTML (which it seems Geary actually does, just not for this).
  - ryandrake 1y ago
ChocolateGod 1y ago
If the library they depend on isnt getting fixed then it needs to be worked around (doable with HTML sanitisation) or use another library that's usable for the purpose of an email client. If neither of those are doable, the software needs a warning that it's vulnerable to a such a terrible privacy exploit. People over however many years this has been possible deserve to know that their email client has been allowing any random person in the internet to easily get their IP address or know they're on their computer. If you can't do this why are you maintaining software, it's unmaintained at that point. The replies to the bug report are just terrible attitude even if factually correct.
throw_a_grenade 1y ago
[flagged]
- mike-cardwell 1y ago
  You forgot to say anything about the fact that they've been sitting on a privacy bug for 15 months and have done nothing to address it. You forgot to say anything about the multiple things that the bug report says they can do, to warn their users and patch over the problem on their side. You forgot to say anything about how those suggestions were met with arrogant clown and face-palm emojis. You prefer to concentrate on the fact that I miss-directed my first bug report. You prefer to point at the fact that I requested submission to a bug bounty program, whilst ignoring the fact that I made effort to discover the issue and report it, without expecting a bounty. It takes time and money to run https://www.emailprivacytester.com https://www.emailprivacytester.com. I wont apologise for receiving the occasional bounty for doing it. Many email and webmail clients are more secure today than they would have been, thanks to my efforts. Your comment exists only to generate drama.
  - throw_a_grenade 1y ago
    [flagged]
- veeti 1y ago
  Evidently you did not read the linked issue very carefully as: 1. The issue still persists in the most recent upstream code of Evolution, having nothing to do with Debian or any other distribution 2. No patch is available to correct the security issue, and despite the puck passing it is not actually the responsibility of distro packagers to fix your own security bugs.
  - throw_a_grenade 1y ago
    In upstream-unsupported versions, which are bore than 2 years old? Sure it is responsibility of the distro. Even if it is unpatched upstream, it's perfectly fine to push the fix to master branch only and let distros backport. That's also why the bugs should be filed downstream, and distro maintainers will forward the bug upstream but only if not already fixed (so upstream won't get N duplicate bugs, where N is the number of packages). At in any case, distro maintainers tend to behave better in upstream bugtrackers.
ho_schi 1y ago
So much text instead of mentioning the WebKitGtk doesn't provides that feature (currently). WebKitGtk is a good engine but somebody should to address that issue. Feels like a developer had only Epiphany as web-browser in consideration and forgot, that mail-clients prefer to not load images. Evolution is a good mail client in general. PS: Prefer always text-mail. When sending. When receiving.
e-dant 1y ago
What's all this controversy with GNOME? I must be missing something. Isn't it perfectly reasonable to say that some security issue in a dependency (which is maintained and open and funded, like WebKit or Linux) is not the fault of someone down the line to fix? I can't imagine someone reporting a bug to one of my repos about some race condition in the kernel. Why the hell are you bothering me with that? Tell the LKML. That's not to say I'm not sympathetic, it's just, like, what do you expect me to do?
- dooglius 1y ago
  > what do you expect me to do? Off the top of my head: you could broadcast it more publicly that there is a known issue (particularly important if this is a security issue). You could change code to avoid whatever kernel features trigger the race. You could print a warning if you detect the kernel version is an unpatched one and/or has Kconfig in whatever state exposes the issue.
- yjftsjthsd-h 1y ago
  One the one hand: Yes, if it's not your code then it's not exactly your responsibility to fix. On the other hand: As a user, the takeaway isn't "well that's not their fault", the takeaway is "if I use this software, then I am vulnerable to this problem". The question of who's responsible or where the fault lies is irrelevant.
kkfx 1y ago
What I fails to understand it's why no one seems to offer the most logic MUE which is essentially offering the full download/sync of all accounts maildirs, like with OfflineIMAP, than offer powerful local indexing like notmuch/mu with a pre-made UI nice for end users. Slogan: own your own messages, own a local GMail. We have all the code except the UI

66 points by mike-cardwell 1y ago

tylerapplebaum 1y ago

Geary has been crashing with some regularity over the past few weeks anyway. Guess I’ll migrate to Thunderbird.

theyknowitsxmas 1y ago
I have that problem. Too bad there is no html client that isn't a massive RAM hog.
- hexagonwin 1y ago
  seamonkey mail seems to work well for me
- esseph 1y ago
  Do you often run out of memory? Want to understand this more. I know I'm talking from a position of privilege, but it's really hard to find a machine these days with less than 16 or 32GB of RAM from the factory. Even going back several years, DDR4 has been extremely cheap for a long time, and DDR5 is finally closer to general ram prices. Are you using mini PCs with soldered ram?
  - yjftsjthsd-h 1y ago
    > Want to understand this more. I know I'm talking from a position of privilege, but it's really hard to find a machine these days with less than 16 or 32GB of RAM from the factory. * Not everyone is using a new machine. * Right now, if I go to https://www.bestbuy.com/ https://www.bestbuy.com/ and scroll down until I hit a laptop, the first 2 have 16GB, and the third is https://www.bestbuy.com/site/hp-victus-15-6-144hz-full-hd-gaming-laptop-intel-core-i5-8gb-memory-nvidia-geforce-rtx-3050-512gb-ssd-mica-silver/6618924.p?skuId=6618924 https://www.bestbuy.com/site/hp-victus-15-6-144hz-full-hd-ga... with 8GB. It's not even cheap. * On my desk right now is a mini PC with 12GB, which I bought earlier this year. * Even if we pretend everyone has 16GB+, it would be nice if we could use that memory for other stuff instead of an email client hogging it.
    - esseph 1y ago
      Maybe, but email clients are basically web browsers these days.
      - yjftsjthsd-h 1y ago
        Okay, but that's worse. Like, there's some argument about whether browsers should display documents vs being an entire operating system with an entire portable execution environment for arbitrary applications... but an email client has no such excuse.
        esseph 1y ago
        I'm not pointing out what I think it should be, I'm just acknowledging the reality of my inbox.
mike-cardwell 1y ago
I noticed that during my testing. Was difficult to keep it running for more than a few seconds at times. Thunderbird is a good choice.
curt15 1y ago
Isn't Geary basically a one-person show? I remember evaluating Geary a couple years ago and it looked like there was only one active developer. I ended up going with Thunderbird + Davmail.

thundarr 1y ago

If only he made that much effort to get Chromium to fix the issue. The source of the problem is with a dependency of the email clients, not the email clients themselves. He is bothering small free software projects so that those small free software projects ask Chromium to fix the issue.

mike-cardwell 1y ago
If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it. It's unacceptable to sit on a privacy affecting bug like this for 15 months. This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing: 1. Nothing to get the devs of that library to fix it 2. Nothing to fix the library themselves 3. Nothing to warn their users 4. Nothing in their local application to protect their users. This is not how secure development works.
- Spivak 1y ago
  They have done #1 and the library is WebKit and so #2 isn't happening. Not the least of which because of the lack of expertise to patch that code base but because it's dynamically linked and in most deployment scenarios they get the webkit provided by the distro. If Evolution even tried to vendor WebKit downstream packagers would patch it out so that it links to the system lib and gets security patches along with the rest of the system.
  - jadamson 1y ago
    ...so strip the offending HTML before passing it to WebKit? What is this, kindergarten?
  - mike-cardwell 1y ago
    They really haven't done number 1. A bug report was submitted, and then it has stalled for 15 months. As of this point in time, nobody has explained to me why it would be a bad idea to add a "Do not rely on for privacy. More info" message next to the feature in Evolution Mail. That is 100% true. Users of Evolution Mail should not rely on that feature for privacy. Because Evolution Mail has chosen to add known flawed software to their application. And despite lacking the will or ability to fix that software, they are unwilling to take a different path to patch over the problem until it is fixed in the library, by sanitising the html and stripping problematic tags/attributes. These are all their choices. And all of their choices lead to end users being exposed to a privacy risk, and unaware of it.

shamiln 1y ago

Of course, no commercial ones like Outlook are on the list…

mike-cardwell 1y ago
The list is brand new. I will be updating it as I have time to test clients.
- ipcress_file 1y ago
  Will you add a list of Known Good Email Clients? Or just "Tested Clients"? Since you can't possibly test them all, it would be nice to know which ones have been evaluated.
  - mike-cardwell 1y ago
    Yes. I will do that. Good idea.
gruez 1y ago
FWIW I tested with gmail a few weeks ago and it was fine.

Sophia95 1y ago

Evolution is the only client on Linux (that I’m aware of) that fully supports Microsoft exchange and Google out of the box without any plugins. I used thunderbird for a long time, however I got frustrated so many times after things broke after every update because essential plugins stopped working. Yes, you may say Evolution UI is old, but the software is rock solid and softwares in general are more than their GUI. It’s good to bring awareness about the tracking but I’m not so bothered by it, as its hard to find software that doesn’t track you these days

nehal3m 1y ago
>It’s good to bring awareness about the tracking but I’m not so bothered by it, as its hard to find software that doesn’t track you these days That's a non-sequitur. Just because it's common does not mean it's okay.
- fsckboy 1y ago
  they didn't say it was ok, they said it was good to be informed about it, they were not personally bothered by it, and they added that it's difficult to find software that doesn't do it. there is no non sequitor
  - nehal3m 1y ago
    They said they're not bothered by it as it's difficult to find software that doesn't spy on you. I interpret that as 'I am not bothered by this because there are no alternatives'. So there is a non sequitur.
zettabomb 1y ago
I feel like I should note that Exchange support is indeed a plugin, and isn't installed by default on (for example) Fedora. However, I believe it's a first party plugin.
forlorn 1y ago
Thunderbird has reportedly added experimental Exchange support in 140. Though I haven't figured out how to enable and test it :)

qweqwe14 1y ago

[flagged]

zettabomb 1y ago

I wasn't aware of Balsa or Geary, but it's interesting to note that the author has mentioned that they are affected by GNOME's culture. I also have found the GNOME devs to have issues with admitting any fault at all, security or otherwise, but I wasn't aware of them being linked to any email clients other than Evolution - which I have been using. What's a good app for Exchange on Linux? I could use the web app, which my company has available, but I do appreciate having a dedicated email client sometimes, particularly for OS notifications (which will work without having the browser open).

marcusb 1y ago
Not defending the GNOME devs as being perfect, but I'd suggest reading this from the start: https://gitlab.gnome.org/GNOME/evolution/-/issues/3095 https://gitlab.gnome.org/GNOME/evolution/-/issues/3095 and then deciding if the author is really being affected by a "toxic development culture" at GNOME.
- chucksmash 1y ago
  Reading the thread, I don't see how that's much of a defense. A GNOME foundation member going through the thread to decorate the reporter's posts with clown emoji reactions is not great. It seems reasonable to say "even if this is caused by one your library dependencies, users are using your application and you should try to find a mitigation." If you get in a wreck because your brakes fail, imagine the car manufacturer saying "oh that's not a problem with the car, it's a problem with the brakes. Talk to the brake manufacturer." "No warranty express or implied" and all that, but still.
  - zettabomb 1y ago
    Yeah ultimately the user doesn't install the dependencies, they install Evolution. So if there's a security issue, that's where they'll see it. There are also potential mitigation for this, for instance scrubbing the HTML (which it seems Geary actually does, just not for this).
- ryandrake 1y ago

ChocolateGod 1y ago

If the library they depend on isnt getting fixed then it needs to be worked around (doable with HTML sanitisation) or use another library that's usable for the purpose of an email client. If neither of those are doable, the software needs a warning that it's vulnerable to a such a terrible privacy exploit. People over however many years this has been possible deserve to know that their email client has been allowing any random person in the internet to easily get their IP address or know they're on their computer. If you can't do this why are you maintaining software, it's unmaintained at that point. The replies to the bug report are just terrible attitude even if factually correct.

throw_a_grenade 1y ago

[flagged]

mike-cardwell 1y ago
You forgot to say anything about the fact that they've been sitting on a privacy bug for 15 months and have done nothing to address it. You forgot to say anything about the multiple things that the bug report says they can do, to warn their users and patch over the problem on their side. You forgot to say anything about how those suggestions were met with arrogant clown and face-palm emojis. You prefer to concentrate on the fact that I miss-directed my first bug report. You prefer to point at the fact that I requested submission to a bug bounty program, whilst ignoring the fact that I made effort to discover the issue and report it, without expecting a bounty. It takes time and money to run https://www.emailprivacytester.com https://www.emailprivacytester.com. I wont apologise for receiving the occasional bounty for doing it. Many email and webmail clients are more secure today than they would have been, thanks to my efforts. Your comment exists only to generate drama.
- throw_a_grenade 1y ago
  [flagged]
veeti 1y ago
Evidently you did not read the linked issue very carefully as: 1. The issue still persists in the most recent upstream code of Evolution, having nothing to do with Debian or any other distribution 2. No patch is available to correct the security issue, and despite the puck passing it is not actually the responsibility of distro packagers to fix your own security bugs.
- throw_a_grenade 1y ago
  In upstream-unsupported versions, which are bore than 2 years old? Sure it is responsibility of the distro. Even if it is unpatched upstream, it's perfectly fine to push the fix to master branch only and let distros backport. That's also why the bugs should be filed downstream, and distro maintainers will forward the bug upstream but only if not already fixed (so upstream won't get N duplicate bugs, where N is the number of packages). At in any case, distro maintainers tend to behave better in upstream bugtrackers.

ho_schi 1y ago

So much text instead of mentioning the WebKitGtk doesn't provides that feature (currently). WebKitGtk is a good engine but somebody should to address that issue. Feels like a developer had only Epiphany as web-browser in consideration and forgot, that mail-clients prefer to not load images. Evolution is a good mail client in general. PS: Prefer always text-mail. When sending. When receiving.

e-dant 1y ago

What's all this controversy with GNOME? I must be missing something. Isn't it perfectly reasonable to say that some security issue in a dependency (which is maintained and open and funded, like WebKit or Linux) is not the fault of someone down the line to fix? I can't imagine someone reporting a bug to one of my repos about some race condition in the kernel. Why the hell are you bothering me with that? Tell the LKML. That's not to say I'm not sympathetic, it's just, like, what do you expect me to do?

dooglius 1y ago
> what do you expect me to do? Off the top of my head: you could broadcast it more publicly that there is a known issue (particularly important if this is a security issue). You could change code to avoid whatever kernel features trigger the race. You could print a warning if you detect the kernel version is an unpatched one and/or has Kconfig in whatever state exposes the issue.
yjftsjthsd-h 1y ago
One the one hand: Yes, if it's not your code then it's not exactly your responsibility to fix. On the other hand: As a user, the takeaway isn't "well that's not their fault", the takeaway is "if I use this software, then I am vulnerable to this problem". The question of who's responsible or where the fault lies is irrelevant.

kkfx 1y ago

What I fails to understand it's why no one seems to offer the most logic MUE which is essentially offering the full download/sync of all accounts maildirs, like with OfflineIMAP, than offer powerful local indexing like notmuch/mu with a pre-made UI nice for end users. Slogan: own your own messages, own a local GMail. We have all the code except the UI