Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Known Bad Email Clients

emailprivacytester.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Known Bad Email Clients

#41

Post by e-dant »

What's all this controversy with GNOME? I must be missing something. Isn't it perfectly reasonable to say that some security issue in a dependency (which is maintained and open and funded, like WebKit or Linux) is not the fault of someone down the line to fix?

I can't imagine someone reporting a bug to one of my repos about some race condition in the kernel. Why the hell are you bothering me with that? Tell the LKML.

That's not to say I'm not sympathetic, it's just, like, what do you expect me to do?

Re: Known Bad Email Clients

#42

Post by akerl_ »

mike-cardwell wrote: post #7
thundarr wrote: post #3

If only he made that much effort to get Chromium to fix the issue. The source of the problem is with a dependency of the email clients, not the email clients themselves. He is bothering small free software projects so that those small free software projects ask Chromium to fix the issue.

If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it. It's unacceptable to sit on a privacy affecting bug like this for 15 months. This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing: 1. Nothing to get the devs of that library to fix it 2.…

You’re welcome to submit a request for a refund of the purchase price for Evolution.

Your Gitlab issue is a textbook example of why open source devs quit. And now you’re wandering around trying to drum up a mob to further pressure people to do free work for you.

Re: Known Bad Email Clients

#43

Post by KetoManx64 »

dotancohen wrote: post #35
zettabomb wrote: post #19

I wasn't aware of Balsa or Geary, but it's interesting to note that the author has mentioned that they are affected by GNOME's culture. I also have found the GNOME devs to have issues with admitting any fault at all, security or otherwise, but I wasn't aware of them being linked to any email clients other than Evolution - which I have been using. What's a good app for Exchange on Linux? I could use the web app, which…

A few years ago while working at a company that required Exchange, I was using Thunderbird with an addon called Owl. It was a paid addon, I think in the neighborhood of $10 to $20, and very much worth it. Full calendar integration and everything. Outlook users would be interested in my setup.

I'm using this at the moment, works very smoothly. $10/year, with full support for calendar, shared mailboxes and accepting teams event invites.

Re: Known Bad Email Clients

#44

Post by jadamson »

akerl_ wrote: post #42
mike-cardwell wrote: post #7

Earlier quoted context omitted.

If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it. It's unacceptable to sit on a privacy affecting bug like this for 15 months. This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing: 1. Nothing to get the devs of that library to fix it 2.…

You’re welcome to submit a request for a refund of the purchase price for Evolution. Your Gitlab issue is a textbook example of why open source devs quit. And now you’re wandering around trying to drum up a mob to further pressure people to do free work for you.

If your response to the idea of sanitizing HTML is a clown emoji, I don't simply not care if you quit open source, I actively want you out of the entire industry.

Hope that helps.

Re: Known Bad Email Clients

#45

Post by veeti »

throw_a_grenade wrote: post #40
veeti wrote: post #29

Earlier quoted context omitted.

Evidently you did not read the linked issue very carefully as: 1. The issue still persists in the most recent upstream code of Evolution, having nothing to do with Debian or any other distribution 2. No patch is available to correct the security issue, and despite the puck passing it is not actually the responsibility of distro packagers to fix your own security bugs.

In upstream-unsupported versions, which are bore than 2 years old? Sure it is responsibility of the distro. Even if it is unpatched upstream, it's perfectly fine to push the fix to master branch only and let distros backport. That's also why the bugs should be filed downstream, and distro maintainers will forward the bug upstream but only if not already fixed (so upstream won't get N duplicate bugs, where N is the nu…

I don't see how any of that is relevant. Instead of addressing the fact that GNOME/evolution security issue number #2727 (https://gitlab.gnome.org/GNOME/evolution/-/issues/2727) about remote content leakage remains open and valid to this very moment, you are grasping onto straws about the author initially reporting the bug from an old version. However, the issue has been reproduced on newer versions, and no patch is available to fix it.

It all really boils down to one thing: the Evolution mail client makes a promise of protecting your privacy, and then fails to uphold that promise. Whether the fault lies in the WebKit project, somewhere in the GTK bindings or the Evolution client's source code is utterly irrelevant. Instead of throwing their hands in the air and hoping that WebKit maybe fixes the issue one day someone needs to take responsibility and mitigate the issue.

Of course these are probably unpaid volunteers just hacking on open source so I don't want to dunk on anyone in particular. But as a whole the GNOME project positions itself as a competitor to proprietary software, and this sort of myopic security attitude to the end product does not inspire confidence in their offering. It should not come as any surprise that people giving you full access to their inbox will warn others about the known insecurity of your product.

I think I'll stick to Thunderbird, where security reports aren't met with such indifferent handwaving. But you can keep engaging in academic thought exercises whether the bug should have been reported by the blessed Debian maintainer or something.

Re: Known Bad Email Clients

#46

Post by npodbielski »

zettabomb wrote: post #19

I wasn't aware of Balsa or Geary, but it's interesting to note that the author has mentioned that they are affected by GNOME's culture. I also have found the GNOME devs to have issues with admitting any fault at all, security or otherwise, but I wasn't aware of them being linked to any email clients other than Evolution - which I have been using. What's a good app for Exchange on Linux? I could use the web app, which…

I like using edge for that. Desktop notifications works and I can log off from work by closing entire window. When I change company I am getting rid of profile.

Re: Known Bad Email Clients

#47

Post by mike-cardwell »

akerl_ wrote: post #42
mike-cardwell wrote: post #7

Earlier quoted context omitted.

If only the developers of Evolution Mail made any effort to get the issue fixed in the 15 months they've known about it. It's unacceptable to sit on a privacy affecting bug like this for 15 months. This continously repeated bullshit that the source of the problem lies elsehwere is tiring. They're knowingly using a library with a security bug, and they're doing: 1. Nothing to get the devs of that library to fix it 2.…

You’re welcome to submit a request for a refund of the purchase price for Evolution. Your Gitlab issue is a textbook example of why open source devs quit. And now you’re wandering around trying to drum up a mob to further pressure people to do free work for you.

I don't care if it's free or paid. If it has privacy flaws, they should be fixed, or people should be informed of them. Evolution Mail isn't interested in doing either of those things. So I'll do it for them. If you think that informing people is, "drumming up a mob", then you are wrong.

Re: Known Bad Email Clients

#48

Post by chucksmash »

marcusb wrote: post #27
zettabomb wrote: post #19

I wasn't aware of Balsa or Geary, but it's interesting to note that the author has mentioned that they are affected by GNOME's culture. I also have found the GNOME devs to have issues with admitting any fault at all, security or otherwise, but I wasn't aware of them being linked to any email clients other than Evolution - which I have been using. What's a good app for Exchange on Linux? I could use the web app, which…

Not defending the GNOME devs as being perfect, but I'd suggest reading this from the start: https://gitlab.gnome.org/GNOME/evolution/-/issues/3095 and then deciding if the author is really being affected by a "toxic development culture" at GNOME.

Reading the thread, I don't see how that's much of a defense.

A GNOME foundation member going through the thread to decorate the reporter's posts with clown emoji reactions is not great.

It seems reasonable to say "even if this is caused by one your library dependencies, users are using your application and you should try to find a mitigation."

If you get in a wreck because your brakes fail, imagine the car manufacturer saying "oh that's not a problem with the car, it's a problem with the brakes. Talk to the brake manufacturer."

"No warranty express or implied" and all that, but still.

Re: Known Bad Email Clients

#50

Post by dooglius »

e-dant wrote: post #41

What's all this controversy with GNOME? I must be missing something. Isn't it perfectly reasonable to say that some security issue in a dependency (which is maintained and open and funded, like WebKit or Linux) is not the fault of someone down the line to fix? I can't imagine someone reporting a bug to one of my repos about some race condition in the kernel. Why the hell are you bothering me with that? Tell the LKML.…

> what do you expect me to do?

Off the top of my head: you could broadcast it more publicly that there is a known issue (particularly important if this is a security issue). You could change code to avoid whatever kernel features trigger the race. You could print a warning if you detect the kernel version is an unpatched one and/or has Kconfig in whatever state exposes the issue.

Post reply on HN