Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Some Security Experts Use Mutt

motherboard.vice.com

Post reply on HN
Print view View original

101–110 of 160 posts

Re: Why Some Security Experts Use Mutt

#101

Post by mobiuscog »

therealmarv wrote: post #85

Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care." So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for…

> What about mail on a mobile phone (I guess security experts do not use them)?

Just to note that I'm not a security expert, but I never check email on my phone. Just don't need to.

Whilst I realise mobile devices are very popular, there are a lot of people who don't require checking email when they're not at a desk.

Re: Why Some Security Experts Use Mutt

#102

Post by josteink »

therealmarv wrote: post #85

Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care." So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for…

> So who cares if you write your email in text mode but browse the web with Chrome/Firefox?

On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim.

Now try that with a privately owned and administered server.

Re: Why Some Security Experts Use Mutt

#103

Post by DanBC »

josteink wrote: post #102
therealmarv wrote: post #85

Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care." So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for…

> So who cares if you write your email in text mode but browse the web with Chrome/Firefox? On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim. Now try that with a privately owned and administered server.

You think the US government doesn't have full access to your private server? If it's located within the US they have full physical access. If it's located outside the US it's a valid target for all the TLAs.

If the government is on your list of threats you need a lot more than "private mail server".

Re: Why Some Security Experts Use Mutt

#104

Post by josteink »

DanBC wrote: post #103
josteink wrote: post #102

Earlier quoted context omitted.

> So who cares if you write your email in text mode but browse the web with Chrome/Firefox? On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim. Now try that with a privately owned and administered server.

You think the US government doesn't have full access to your private server? If it's located within the US they have full physical access. If it's located outside the US it's a valid target for all the TLAs. If the government is on your list of threats you need a lot more than "private mail server".

> If it's located within the US they have full physical access.

If I were to live in the US, I would know when my server went missing. With Google or other cloud-providers they can do it behind your back.

> If it's located outside the US it's a valid target for all the TLAs.

And then can't seize it. It's physically secure. It may not be bullet-proof security-wise (what is?) but they can't rubber-stamp their way into it.

And for some people that's quite an important aspect.

Re: Why Some Security Experts Use Mutt

#105

Post by benmmurphy »

mike_hearn wrote: post #26
methehack wrote: post #16

I'm not sure I buy the reasoning on "surface area", at least not the specific comparisons in the article. It seems unfair to count Chrome but not Unix. For that matter, shouldn't we count the surface area of everything that touches the email as it hops around, including routers, etc? And isn't that the whole problem with email that the protocol does not require secure transport? So, seems like the only way to make th…

Right. "Let's switch from an email client written in a safe high level language that's also running inside multiple sandboxes and which has a full time security team (e.g. gmail) to ...... a mail client written in C" Doesn't seem like a great approach.

C is not too bad in this situation. If you implement DEP + ASLR correctly and do not give the attacker access to an interpreter (javascript/fonts/xslt/etc) then it is quite difficult (impossible except for luck?) for an offline attacker to gain code execution. You need to leak information about the programs memory layout in order to bypass DEP but how do you do that with an email?

The best vector is probably taking control of the IMAP/POP server Mutt is connecting to and finding a vuln that will leak an address back to the server and another vuln that will take control over the instruction pointer.

Or alternatively hope there is some broken shell command injection lurking in Mutt.

Re: Why Some Security Experts Use Mutt

#106

Post by pbhjpbhj »

thanksgiving wrote: post #4
yeukhon wrote: post #2

The title carries sarcasm as soon as you finish the article half-way. I totally agree that usability is damn important. One reason I stopped using Ubuntu Desktop version is exactly the poor usability of Unity, and I now prefer headless (and if I ever need browser I'd use X-windows). For email client I either use Thunderbird, or Outlook 2013, simply because graphical interface is easier to work with. I code using VIM…

I'd prefer things that need formatting be an attachment such as rtf or pdf leaving the email in plain text. There is no reason why personally written email needs rich text.

Do you apply an extreme minimalist styling to other areas of your daily life - like "there's no need to clothes to be any other colour than gray"? or "there's no need for food to have a flavour as long as it's nutritious".

Genuine question.

Most people use some form of flourish even in handwriting - an underline, all-caps, increased letter size or spacing, a personally preferred colour; isn't it weird to not have the facility for that in email?

Re: Why Some Security Experts Use Mutt

#107

Post by mappu »

simoncion wrote: post #69
sanatgersappa wrote: post #63

Wish it was more user friendly and ran well on Windows (yes, I'm that guy). A good example of something that is user friendly, fast, secure and runs almost everywhere is the messaging client Telegram. Would be great if there were more programs like it.

> Wish [mutt] was more user friendly and ran well on Windows... I would be shocked if Cygwin's mutt port didn't run just as well on Windows as it did on Linux. Remember that UNIX software that you compile with Cygwin becomes a native Windows executable.

Software you compile with Cygwin's GCC becomes a native Cygwin executable, with its own concepts of paths, processes, symlinks and environment. All binaries compiled with Cygwin always inherit GPL virality. The Cygwin OS is coincidentally hosted on Windows and mostly plays nice with it.

Software you compile with Mingw(-w64)'s GCC becomes a native Windows executable.

Re: Why Some Security Experts Use Mutt

#108

Post by 0XAFFE »

As I'm a emacs person, I tried once wanderlust[1] and got hooked up to it. Wanderlust is mail client which supports a wide variety of protocols. For me the biggest advantages are the blazing fast IMAP support and the whole emacs thing (Keybindings, Help (C-h b for all keybindings in this buffer, priceless I have to say), the possibility to run it either in GUI or in a terminal, etc). Recently the devs uploaded it to melpa[2] which makes it even more easy to get started. I would definitly recommend it, to people who are already using emacs, its such a joy!

[1] https://github.com/wanderlust/wanderlust

[2] http://melpa.org/#/wanderlust

Re: Why Some Security Experts Use Mutt

#109

Post by mappu »

bigger_cheese wrote: post #58
thanksgiving wrote: post #4

Earlier quoted context omitted.

I'd prefer things that need formatting be an attachment such as rtf or pdf leaving the email in plain text. There is no reason why personally written email needs rich text.

I use outlook at my work for email and its not uncommon to send screenshots and similar. A common workflow for me is to hit print screen paste into the message compose window, crop the image and super impose annotations onto it using the office drawing tools (circle, arrows, text box etc). I also like the integration with Communicator and calendar, Having notification about when people are online in meetings and whic…

Does that really crop the image, or just hide parts of it? I ask because cropping in Word can be undone by another recipient.

Re: Why Some Security Experts Use Mutt

#110

Post by rekado »

0XAFFE wrote: post #108

As I'm a emacs person, I tried once wanderlust[1] and got hooked up to it. Wanderlust is mail client which supports a wide variety of protocols. For me the biggest advantages are the blazing fast IMAP support and the whole emacs thing (Keybindings, Help (C-h b for all keybindings in this buffer, priceless I have to say), the possibility to run it either in GUI or in a terminal, etc). Recently the devs uploaded it to…

Another Emacs person here. I'm using offlineimap+msmtp together with mu4e. I prefer not to do IMAP sync or mail delivery in Emacs itself.
Post reply on HN