Live data from Hacker News

Why Some Security Experts Use Mutt

motherboard.vice.com

31–40 of 160 posts

Re: Why Some Security Experts Use Mutt

#31
post #8

Another reason is that it spawns a text editor. Typing emails in a text widget without proper editing capabilities can be irritating.

In Firefox, you can use It's All Text! to edit the current text area in a proper editor. https://addons.mozilla.org/en-us/firefox/addon/its-all-text/

That works less and less as more websites offer "improved" text editing capabilities through javascript.

Re: Why Some Security Experts Use Mutt

#32
Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying messages. You can leave it in plain text mode and, in the event you really need to view HTML, switch it to "Simple" or full HTML. It also can block remote images and, I think, all JavaScript.

The wonderful Nostalgy add-on provides a very responsive keyboard interface.

https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/

I don't know if current Thunderbird versions include all that, however.

Re: Why Some Security Experts Use Mutt

#33
post #18

I still use mutt (and default to text), but I don't see anyone else doing this, even in my geek coworkers or friends. So I'm a bit surprised by this article. I use mutt because it's very very fast, and quite customizable (I maintain a kind of 0-inbox through a set of hotkeys, + spamassin + procmail). To handle numerous mailing-lists with medium volume, it's so far the best I've seen. I tried many email clients (on Wi…

I've been using mutt exlusively for many years, and I got a fair amount of flack for it every now and then. While I like to believe that it's more secure than any full-featured bloated mail-client (hello Thunderbird), my reason for using mutt is simpler. I like the speed, efficiency and customization aspects of mutts, plus being able to use vim to compose my mails. Quite frankly, I don't get how people rave about text editors but then fail to include them in their mail workflow, which is where people spend quite a bit of time nowadays.

The other reason I like mutt is because it still conforms to the UNIX principle: One thing and one thing well. True, you could use mutt for SMTP/IMAP, but there are better tools for that. I use mutt with offlineimap, msmtp and mu (for searching).

Re: Why Some Security Experts Use Mutt

#36
post #19

Earlier quoted context omitted.

You can use mutt with Exchange servers and Gmail servers

Mutt and Exchange? Bliss! Would you happen to have a doc link handy?

Mutt doesn't support retrieving mail very well, but you can use sync programs (getmail, offlineimap, isync, exchange2mbox) to create local mailboxes and make mutt use the local mailbox directory instead.

you can send email using external programs (local smtp server and openxchange for exchange).

Mutt is not a traditional mail client, it is more of a glue between multiple programs so you can have one interface for all of your emails need.

Re: Why Some Security Experts Use Mutt

#37

Earlier quoted context omitted.

Mutt and Exchange? Bliss! Would you happen to have a doc link handy?

IIRC Exchange does offer IMAP and SMTP...

Exchange server sometimes choose to not provide smtp which is a pain. Their IMAP support is sometimes lacking too (i.e. imap-mail.outlook.com times out alot).

Re: Why Some Security Experts Use Mutt

#38

I'm not sure I buy the reasoning on "surface area", at least not the specific comparisons in the article. It seems unfair to count Chrome but not Unix. For that matter, shouldn't we count the surface area of everything that touches the email as it hops around, including routers, etc? And isn't that the whole problem with email that the protocol does not require secure transport? So, seems like the only way to make th…

Right. "Let's switch from an email client written in a safe high level language that's also running inside multiple sandboxes and which has a full time security team (e.g. gmail) to ...... a mail client written in C" Doesn't seem like a great approach.

(Preemptive N.B.—I'm far from an expert, but I'm very interested in seeing this aspect of the topic discussed further by folks who might be experts.)

Isn't the general premise here that one can choose to package up any program in as many deeply nested (virtual or physical) sandboxes as one would like, but there's an inherent benefit to the piece of software inside all those boxes exposing to one's adversary as few avenues as possible to attempt to escape them (specifically as it pertains to people in the business of painting targets on their backs e.g. Soghoian)?

Put another way, of course Gmail and Chrome have dedicated security teams, but they won't ever have prevent $GIVEN_INFOSEC_RESEARCHER's box from getting owned teams.

Re: Why Some Security Experts Use Mutt

#40
I've used mutt for ages, but a couple of years ago I switched to Karel Zak's mutt-kz branch (https://github.com/karelzak/mutt-kz), which integrates notmuch into mutt. The setup is a little fussy (although well documented), but the results are spectacular. Mutt's search was never horrible but with notmuch its nutty fast, and the tagging feature makes dealing with search and mailing lists very convenient.
Post reply on HN