Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Some Security Experts Use Mutt

motherboard.vice.com

Post reply on HN
Print view View original

51–60 of 160 posts

Re: Why Some Security Experts Use Mutt

#51

Post by mfincham »

kjs3 wrote: post #48
mfincham wrote: post #29

There are several slightly less hardcore alternatives to Mutt for those wanting a more modern e-mail experience without the security baggage of running an entire browser. Sylpheed for instance is a very pleasant text-only MUA ( http://sylpheed.sraoss.jp/en/ ). For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be…

For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access. Do you have an example? Sounds like a pretty awesome setup that you should share.

I will see if I can get it tidied up enough I'd be comfortable sharing :)

Re: Why Some Security Experts Use Mutt

#52

Post by JohnTHaller »

hackuser wrote: post #49
JohnTHaller wrote: post #42

Earlier quoted context omitted.

I use Thunderbird and keep it set as text only for sending and remote images loading is disabled by default (as it should be). JavaScript in emails is not loaded or run.

Thanks. > I use Thunderbird and keep it set as text only for sending Is that an option for viewing messages? That's where the security risk mostly exists.

View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext.

Loading of external images is fully disabled by default. You can enable it per-email by clicking as well as per-sender (which I don't personally do or recommend).

Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is significantly reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity. That wipes out the vulnerabilities used in the vast majority of attacks right off the bat. Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.

Re: Why Some Security Experts Use Mutt

#53

Post by siegecraft »

methehack wrote: post #16

I'm not sure I buy the reasoning on "surface area", at least not the specific comparisons in the article. It seems unfair to count Chrome but not Unix. For that matter, shouldn't we count the surface area of everything that touches the email as it hops around, including routers, etc? And isn't that the whole problem with email that the protocol does not require secure transport? So, seems like the only way to make th…

You want to reduce the "surface area" of your email client so that the act of viewing an email doesn't own your system. It has nothing to wo dith the privacy of your email.

Re: Why Some Security Experts Use Mutt

#54

Post by Steltek »

totony wrote: post #36
hibbelig wrote: post #24

Earlier quoted context omitted.

Mutt and Exchange? Bliss! Would you happen to have a doc link handy?

Mutt doesn't support retrieving mail very well, but you can use sync programs (getmail, offlineimap, isync, exchange2mbox) to create local mailboxes and make mutt use the local mailbox directory instead. you can send email using external programs (local smtp server and openxchange for exchange). Mutt is not a traditional mail client, it is more of a glue between multiple programs so you can have one interface for all…

Be careful with which Exchange servers you try offlineimap with. There was a severely bad interaction in Exchange with how offlineimap operates. Exchange used a global database with a small limit (I want to say 2^16) for unique message headers. Offlineimap injected unique headers for synchronization purposes. This quickly led to resource exhaustion and essentially blocked the server.

Re: Why Some Security Experts Use Mutt

#56

Post by tomphoolery »

jbk wrote: post #18

I still use mutt (and default to text), but I don't see anyone else doing this, even in my geek coworkers or friends. So I'm a bit surprised by this article. I use mutt because it's very very fast, and quite customizable (I maintain a kind of 0-inbox through a set of hotkeys, + spamassin + procmail). To handle numerous mailing-lists with medium volume, it's so far the best I've seen. I tried many email clients (on Wi…

I'm also a mutt user. Love being able to edit documents with Vim, stable PGP support, and the mnemonic hot keys. However, I wish I knew more (or could remember more) about how it works...and I can't seem to get folders to synchronize properly from `offlineimap` (though `procmail` lets me search my mail rather easily).

Re: Why Some Security Experts Use Mutt

#57

Post by spacehome »

dogma1138 wrote: post #10

Most "Security Experts" are working for consultancy, tech firms, and government agencies so they probably use plenty of other clients. The majority will probably run Outlook since Exchange is the defacto mail-server standard for any organization (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born), the rest will probably use Gmail or any other web-based…

Lawyers have higher rates of alcoholism by far.

Re: Why Some Security Experts Use Mutt

#58

Post by bigger_cheese »

thanksgiving wrote: post #4
yeukhon wrote: post #2

The title carries sarcasm as soon as you finish the article half-way. I totally agree that usability is damn important. One reason I stopped using Ubuntu Desktop version is exactly the poor usability of Unity, and I now prefer headless (and if I ever need browser I'd use X-windows). For email client I either use Thunderbird, or Outlook 2013, simply because graphical interface is easier to work with. I code using VIM…

I'd prefer things that need formatting be an attachment such as rtf or pdf leaving the email in plain text. There is no reason why personally written email needs rich text.

I use outlook at my work for email and its not uncommon to send screenshots and similar.

A common workflow for me is to hit print screen paste into the message compose window, crop the image and super impose annotations onto it using the office drawing tools (circle, arrows, text box etc).

I also like the integration with Communicator and calendar, Having notification about when people are online in meetings and which building they are in (my work has multiple sites) is handy. I don't usually like Microsoft products but Outlook is pretty solid in my opinion. The only alternative I've really seen is Lotus Notes.

Re: Why Some Security Experts Use Mutt

#59

Post by purpleorange »

hackuser wrote: post #32

Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying messages. You can leave it in plain text mode and, in the event you really need to view HTML, switch it to "Simple" or full HTML. It also can block remote images and, I think, all JavaScript. The wonderful Nostalgy add-on provides a very responsive keyboard inter…

thunderbird is love, thunderbird is life

Re: Why Some Security Experts Use Mutt

#60

Post by douche »

dogma1138 wrote: post #10

Most "Security Experts" are working for consultancy, tech firms, and government agencies so they probably use plenty of other clients. The majority will probably run Outlook since Exchange is the defacto mail-server standard for any organization (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born), the rest will probably use Gmail or any other web-based…

> (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born)

Those blood magic spells seem to be wearing off hard in the last year or so. I've been seeing a huge number of our customers migrate from the Lotus stack to Office365. Of course, IBM has already put their software divisions out in the back yard, and are popping the cartridges into their rifle to put the old girl down.

Post reply on HN