Earlier quoted context omitted.
Am I the only one using outlook and loving it?
Outlook on Mac consumes outrageous amounts of ram...
Absolutely. Mail.app on Windows instead is pretty lightweight /s
Zero click vulnerability in Apple’s macOS Mail
31–40 of 269 posts
Re: Zero click vulnerability in Apple’s macOS Mail
#32That's gonna be devastating to the three people who use Mail.app
I switched to it with the first release of OS X and have been pretty happy with it.
Amazingly I have a handful of messages from the late 70s (a couple of jokes and a couple of personal messages from friends who passed away young) that have survived the file format transitions since then but I couldn't imagine could appear in something like google or yahoo mail. TBH I haven't made that many transitions: EMACS (BABYL) on ITS, then TOPS-20; Interlisp and Smalltalk clients to Grapevine back end; Lispm to TOPS-20 back end; GNU Emacs (rmail?) to IMAP; and then Apple Mail (macOS and iOS) -> IMAP. Emacs is the most powerful but these days still hard to put in your pocket.
In general a web browser seems like the worst interface to most services and activities as the UI can't be dedicated to the task at hand; instead you have system UI, Browser UI and only then the application UI. And a lot of mouse activity is expected.
Re: Zero click vulnerability in Apple’s macOS Mail
#33It's hardly surprising, you can run into memory corruption bugs just using desktop mail.app the way it's intended (there's been a bug that corrupts the account list for probably a decade which just hasn't been fixed.)
Mutt may look old but at least it actually works.
Re: Zero click vulnerability in Apple’s macOS Mail
#34I thought macOS mail rules could also run a snippet of AppleScript. Wouldn't that make this an RCE?
Or maybe the script has to exist in some folder this vulnerability doesn't have access to?
Re: Zero click vulnerability in Apple’s macOS Mail
#35Please don't use "zero" and "vulnerability" in the same sentence, unless you mean a zero-day one. The author could have said "no click vulnerability" with the same meaning. Almost caused me a concern with that title! :D :D
Re: Zero click vulnerability in Apple’s macOS Mail
#36Earlier quoted context omitted.
It’s my main email client, what’s wrong with it?
What’s right with it? I tried it a few times and always returned to web-based clients (on desktop) and third-party apps (outlook, gmail, protonmail) on iOS.
Web gmail sucks when you have multiple accounts.
Re: Zero click vulnerability in Apple’s macOS Mail
#37I thought macOS mail rules could also run a snippet of AppleScript. Wouldn't that make this an RCE? Or maybe the script has to exist in some folder this vulnerability doesn't have access to?
Thats what I thought first too (I am the author). And your guess for the reason is right. AppleScripts need to be stored in ~/Library/Application Scripts/com.apple.mail directory which is outside of the sandbox.
Re: Zero click vulnerability in Apple’s macOS Mail
#38Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)?
Or is it just security theater ?
Re: Zero click vulnerability in Apple’s macOS Mail
#39Please don't use "zero" and "vulnerability" in the same sentence, unless you mean a zero-day one. The author could have said "no click vulnerability" with the same meaning. Almost caused me a concern with that title! :D :D
Sorry about that. But thats the term what is used by Apple to these type of bugs: https://developer.apple.com/security-bounty/ ( Zero-click unauthorized access to sensitive data )
Re: Zero click vulnerability in Apple’s macOS Mail
#40Is it true that Apple devices are more secure than good Android devices(like Google's Pixel)? Or is it just security theater ?
Apple's entire business model is based on appearances. To be fair so is Microsoft's and many others.
Security is usually the last priority for nearly every for profit entity because it doesn't drive revenue.