Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Known Bad Email Clients

emailprivacytester.com

Post reply on HN
Print view View original

11–20 of 69 posts

Re: Known Bad Email Clients

#11

Post by 1over137 »

thundarr wrote: post #3

If only he made that much effort to get Chromium to fix the issue. The source of the problem is with a dependency of the email clients, not the email clients themselves. He is bothering small free software projects so that those small free software projects ask Chromium to fix the issue.

>The source of the problem is with a dependency of the email clients, not the email clients themselves.

For ends users, that's a distinction without a difference. Programmers are responsible for their choice of dependencies. If you've chosen to depend on it, it becomes your problem. Chromium is open source, no? So the email client programmer can fix that bug himself.

Re: Known Bad Email Clients

#12

Post by ipcress_file »

mike-cardwell wrote: post #8
shamiln wrote: post #4

Of course, no commercial ones like Outlook are on the list…

The list is brand new. I will be updating it as I have time to test clients.

Will you add a list of Known Good Email Clients? Or just "Tested Clients"? Since you can't possibly test them all, it would be nice to know which ones have been evaluated.

Re: Known Bad Email Clients

#13

Post by mike-cardwell »

ipcress_file wrote: post #12
mike-cardwell wrote: post #8

Earlier quoted context omitted.

The list is brand new. I will be updating it as I have time to test clients.

Will you add a list of Known Good Email Clients? Or just "Tested Clients"? Since you can't possibly test them all, it would be nice to know which ones have been evaluated.

Yes. I will do that. Good idea.

Re: Known Bad Email Clients

#15

Post by Spivak »

mike-cardwell wrote: post #7
thundarr wrote: post #3

If only he made that much effort to get Chromium to fix the issue. The source of the problem is with a dependency of the email clients, not the email clients themselves. He is bothering small free software projects so that those small free software projects ask Chromium to fix the issue.

If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it. It's unacceptable to sit on a privacy affecting bug like this for 15 months. This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing: 1. Nothing to get the devs of that library to fix it 2.…

They have done #1 and the library is WebKit and so #2 isn't happening. Not the least of which because of the lack of expertise to patch that code base but because it's dynamically linked and in most deployment scenarios they get the webkit provided by the distro. If Evolution even tried to vendor WebKit downstream packagers would patch it out so that it links to the system lib and gets security patches along with the rest of the system.

Re: Known Bad Email Clients

#16

Post by zettabomb »

Sophia95 wrote: post #6

Evolution is the only client on Linux (that I’m aware of) that fully supports Microsoft exchange and Google out of the box without any plugins. I used thunderbird for a long time, however I got frustrated so many times after things broke after every update because essential plugins stopped working. Yes, you may say Evolution UI is old, but the software is rock solid and softwares in general are more than their GUI. I…

I feel like I should note that Exchange support is indeed a plugin, and isn't installed by default on (for example) Fedora. However, I believe it's a first party plugin.

Re: Known Bad Email Clients

#17

Post by curt15 »

tylerapplebaum wrote: post #2

Geary has been crashing with some regularity over the past few weeks anyway. Guess I’ll migrate to Thunderbird.

Isn't Geary basically a one-person show? I remember evaluating Geary a couple years ago and it looked like there was only one active developer. I ended up going with Thunderbird + Davmail.

Re: Known Bad Email Clients

#18

Post by astrobe_ »

thundarr wrote: post #3

If only he made that much effort to get Chromium to fix the issue. The source of the problem is with a dependency of the email clients, not the email clients themselves. He is bothering small free software projects so that those small free software projects ask Chromium to fix the issue.

Just my opinion, but the dependency on Chromium is a problem in itself. You don't need a full-blown browser to render HTML email. The fact that it is no more viable for a client to ignore HTML nowadays is something unfortunate, to say the least. Real people only need Emoji support at best (or at worst), because nowadays every from your bank to your local security expert tells you "don't click on links in emails", and your local privacy expert tells you to turn off every convenience feature related to HTML.

On another note, TFA talks about a "GNOME toxic development culture", which looks like a blanket statement. Does it really exist?

Re: Known Bad Email Clients

#19

Post by zettabomb »

I wasn't aware of Balsa or Geary, but it's interesting to note that the author has mentioned that they are affected by GNOME's culture. I also have found the GNOME devs to have issues with admitting any fault at all, security or otherwise, but I wasn't aware of them being linked to any email clients other than Evolution - which I have been using.

What's a good app for Exchange on Linux? I could use the web app, which my company has available, but I do appreciate having a dedicated email client sometimes, particularly for OS notifications (which will work without having the browser open).

Re: Known Bad Email Clients

#20

Post by ChocolateGod »

If the library they depend on isnt getting fixed then it needs to be worked around (doable with HTML sanitisation) or use another library that's usable for the purpose of an email client.

If neither of those are doable, the software needs a warning that it's vulnerable to a such a terrible privacy exploit. People over however many years this has been possible deserve to know that their email client has been allowing any random person in the internet to easily get their IP address or know they're on their computer.

If you can't do this why are you maintaining software, it's unmaintained at that point. The replies to the bug report are just terrible attitude even if factually correct.

Post reply on HN