Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thunderbird 60.0 release

thunderbird.net

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Thunderbird 60.0 release

#41

Post by smsm42 »

hs86 wrote: post #25

Thunderbird is a great email client but I don't trust it when it comes to calendars and contacts. Syncing with CalDAV/CardDAV or Google Calendar/Contacts has always been problematic and apparently this is the very first version where you can edit single entries of an recurring calendar event. This does not help in building confidence in Thunderbird as a PIM.

Yep, same experience. I use Thunderbird for many years, and tried to migrate my calendar workflow to it many times, and it just does not work. I really like it as an email client, and I'd like to use it as scheduling tool too, but currently it's way too clunky to be of any practical use. Sync issues, UI issues, all kinds of issues. Hopefully they'd get their act together sometime.

Re: Thunderbird 60.0 release

#43

Post by dotancohen »

inanutshellus wrote: post #24
phyzome wrote: post #13

I currently have Thunderbird installed from apt but pinned to an ancient version that allows Lightning (the calendar tool) to work. (Newer versions broke Lightning on Linux, although I can't recall the failure mode.) Maybe I'll try out Thunderbird 60 on my work computer to see if it works better now... It's funny, I actually only use Thunderbird for its calendar these days, not for email.

I vaguely recall a point when Lightning wasn't working but that has been aaaaaaaages. It has been working fine for years on Linux.

I can confirm that Thunderbird and Lightning work fine on a CentOS 7 desktop. I use them every day.

Re: Thunderbird 60.0 release

#44

Post by [deleted] »

Borealid wrote: post #40
jcranmer wrote: post #12

Earlier quoted context omitted.

IMAP authentication is done within SSL, so you'd have to start with an SSL MITM to be able to access the password login anyways. If you're scared about people having access to that, there are quite a few password authentication schemes baked into IMAP that don't leak your password over the network (SCRAM-SHA-256, anybody?). That said, all IMAP servers in practice implement only plaintext auth, or maybe NTLM and Kerbe…

Or a brute-force attack guesses your app password. One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. With HOTP, you only get one guess before the goalposts move. The downside is that it's more vulnerable to DoS attacks when configured that way. An app password has no brute-…

[deleted]

Re: Thunderbird 60.0 release

#45

Post by CyberShadow »

Borealid wrote: post #40
jcranmer wrote: post #12

Earlier quoted context omitted.

IMAP authentication is done within SSL, so you'd have to start with an SSL MITM to be able to access the password login anyways. If you're scared about people having access to that, there are quite a few password authentication schemes baked into IMAP that don't leak your password over the network (SCRAM-SHA-256, anybody?). That said, all IMAP servers in practice implement only plaintext auth, or maybe NTLM and Kerbe…

Or a brute-force attack guesses your app password. One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. With HOTP, you only get one guess before the goalposts move. The downside is that it's more vulnerable to DoS attacks when configured that way. An app password has no brute-…

> One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over.

This is, again, wrong. Guessing a 6-digit number will take, on average, 500,000 tries; if the answer changes with each guess, it will take only twice as much (same as when picking random guesses instead of iterating through all possibilities in order).

In fact, you might as well try "000,000" over and over every said 30 seconds, and your guess will eventually be correct after about the above-mentioned 500,000 tries.

https://run.dlang.io/is/0A467x

Re: Thunderbird 60.0 release

#46

Post by nickserv »

Looks good but not seeing too many performance improvements unfortunately.

Which is a shame, I much prefer Thunderbird to Kmail UI wise, but when processing thousands of messages (deleting, moving, filtering, etc) it slows to a crawl then freezes. Kmail stays responsive.

This on 16 core 32 GB machine. But it doesn't look like the cores are used very effectively by TB as opposed to Kmail.

For normal usage though it's great. Maybe the next release will focus on performance optimization, in particular multicore.

Re: Thunderbird 60.0 release

#47

Post by grawlinson »

starik36 wrote: post #38

I was hoping that Thunderbird would become a unified desktop equivalent of Mail/Calendar/ToDo of the apps we have on the mobile that can handle all the major providers (exchange, gmail, icloud, yahoo, pop, imap, etc...). But it doesn't support a good chunk of these, which makes it difficult to adopt in my life.

I'm hoping that addons will spring up due to the renewed development efforts. As it is, I'm just using Nextcloud (Calendar & Contacts) alongside Rainloop for mail.

Re: Thunderbird 60.0 release

#48

Post by earenndil »

fermuch wrote: post #20
bberenberg wrote: post #3

Something overlooked, but which I have a lot of respect for is properly incrementing version numbers. It's rare to see semantic versioning properly work. Good job TB team.

What do you mean? Doesn't the jump go from 52 to 60?

I think that refers to the version of firefox/gecko that underlies it.

Re: Thunderbird 60.0 release

#49

Post by Borealid »

CyberShadow wrote: post #45
Borealid wrote: post #40

Earlier quoted context omitted.

Or a brute-force attack guesses your app password. One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. With HOTP, you only get one guess before the goalposts move. The downside is that it's more vulnerable to DoS attacks when configured that way. An app password has no brute-…

> One of the major benefits of TOTP is that you have only a certain time window (usually, 30 seconds) to guess a password before the thing you're trying to guess changes and you have to start over. This is, again, wrong. Guessing a 6-digit number will take, on average, 500,000 tries; if the answer changes with each guess, it will take only twice as much (same as when picking random guesses instead of iterating throug…

I don't think you've understood what has to be guessed. It's not the OTP alone; it's the OTP and the password, together.

If the OTP "000000" is correct with 50% probability after 500,000 attempts, you've just increased the number of attacks necessary to brute-force a password against a live server by (conservatively) 50,000,000%.

Post reply on HN