Thunderbird security issues

[Patrick]

http://desktoplinux.com/news/NS2733158090.html

Not good as Thunderbird is my favorite email client. I'm going to try out Evolution again and see if it's improved since I used it last.

[greggh]

This seems like a simple quick fix...

The brute-force solution is simply to make sure that JavaScript is never enabled in Thunderbird. Unlike in Web browsers, where disabling JavaScript is far more serious in that it also disables some JavaScript-dependent Web sites, there's seldom any call for using JavaScript with HTML-formatted e-mail messages.

[Tsuroerusu]

http://desktoplinux.com/news/NS2733158090.html

Not good as Thunderbird is my favorite email client. I'm going to try out Evolution again and see if it's improved since I used it last.

Pat, just curious, what do you think of KMail? That's what I use all the time, and I'm really happy with it.

This seems like a simple quick fix...

The brute-force solution is simply to make sure that JavaScript is never enabled in Thunderbird. Unlike in Web browsers, where disabling JavaScript is far more serious in that it also disables some JavaScript-dependent Web sites, there's seldom any call for using JavaScript with HTML-formatted e-mail messages.

I would call that a workaround, as you're just disabling the vulnerable functionality. Even though I don't think any email client ought to even support running Javascript code embedded in the email body, just disabling it is not fixing the vulnerability. Especially in a XUL-based program I am concerned about this not having been fixed yet. The XUL interface language relies heavily on Javascript and XML, so a security problem related to Javascript, could potentially have a deeper impact, if some cleaver bad guy found a different approach to take advantage of this problem. As far as I know, this is not the case, so I don't want to sound like I am spreading FUD, but it's something to keep in mind. Leaving security problems unfixed is a really bad habit to get into, especially since one of the things that Thunderbird really has going for it in Windows land, is that it's generally more secure than Outlook/Outlook Express.

[Patrick]

Pat, just curious, what do you think of KMail? That's what I use all the time, and I'm really happy with it.

I like Kmail. The last time I used it extensively it was crashing a little too often for my tastes. I'll try it again on my workstation to see how it's faring these days.

[Tsuroerusu]

Pat, just curious, what do you think of KMail? That's what I use all the time, and I'm really happy with it.

I like Kmail. The last time I used it extensively it was crashing a little too often for my tastes. I'll try it again on my workstation to see how it's faring these days.

I think I remember you talking about that, and at the same time using it for like 45 mins. to write a long-ass email to Chess
I remember thinking something like "He must have gotten a bad build" or something like that.

I would give it another shot. KDE 3.5.9 which will come out here in February will introduce the new, so called, enterprise-branch of KDEPIM into the mainstream KDE, so that should be even better, and it has a few more features, yes I know, hard to imagine, because KMail already can scratch your back and cook pizza!

[snarkout]

I had major issues with kmail when I had enabled (by default - I never even knew about it) auto indexing on my arch build. Since I've never seen that option anywhere else I've never had that issue. No problems for ages, here, though.