Why Open Source Matters For Sensitive Email

Paranoia abound by Anonymous Coward · 2014-12-10 14:03 · Score: 4, Interesting

Can you really trust your email provider?

Yes, because I'm not a paranoid idiot. If someone wanted to do something malicious with your email, they probably could anyway, because so much of the world's email servers transmit in plaintext, the provider (other than the choice of one that does encrypt when possible) is the least of my concerns.

Re:Paranoia abound by Dutch+Gun · 2014-12-10 17:16 · Score: 4, Insightful

Even beyond that, e-mail can be encrypted client-side when necessary, meaning you don't have to trust anyone. There's no reason to trust your e-mail provider in the first place if the contents are truly sensitive. For everything else, e-mail should be considered about as secure as a postcard.
If you need to protect the metadata as well as the content, then e-mail shouldn't even be used for that sort of correspondence. E-mail has never been secure. It probably never will be either, at least not for what we consider "e-mail" today, because there's too much legacy crap that would break if we lock it down (at least if we are trying to secure metadata).
If we're OK with simply encrypting content as needed, then there are ways of building that sort of infrastructure into the system. We're seeing a lot of 3rd party messaging solutions that are using very good "trust no one" client-side encryption technologies and methods, such as What's App (now that they've integrated Open Whisper Systems security) or Threema.

--
Irony: Agile development has too much intertia to be abandoned now.
Re:Paranoia abound by Jack+Griffin · 2014-12-10 17:30 · Score: 2

And since we KNOW we can't trust our ISPs or Govt, then you may as well give up on using security as a requirement. And since there really is only one product in the Enterprise email/calendar/collaboration space worth a damn and it isn't open source, then this argument isn't worth having.
Re:Paranoia abound by jbolden · 2014-12-11 02:47 · Score: 1

since there really is only one product in the Enterprise email/calendar/collaboration space worth a damn

Come on. There are many products that handle email/calendar/collaboration which are better than Outlook. Outlook is a very good standard and rather feature rich for an email client. It is designed to work well with a popular enterprise email solution. But it is far from the richest solution and further still from the only solution. There is even a fairly good solution which is rather close to Outlook feature wise which is open source from VMWare: http://www.zimbra.com/
Re:Paranoia abound by Jack+Griffin · 2014-12-11 16:06 · Score: 1

Zimbra like Linux on the desktop is a me too solution that's almost there but always not quite. I've been on plenty of projects evaluating Email/Calendar/Collab solutions and Exchange/Outlook shits on everything each time, it's not pure chance that every major corporate network runs it. Lotus Notes is the next closest competitor and it sucks balls.
Re:Paranoia abound by jbolden · 2014-12-11 16:50 · Score: 1

Every major corporate network does not run Outlook. I've worked with enterprises that use in house solutions. There are corporations on Google. I've worked with many major corporations that use Lotus Notes example BTI. Texas Instruments uses Zimbra which is a major corporation. Novell Groupwise is used by corporations. Mirapoint & CriticalPath are still in use and migrating their customers not to Outlook / Exchange but to Open-Exchange. I know several hospitals that were on Scalix up till a few years ago.
You are simply wrong on the facts.
Re:Paranoia abound by Jack+Griffin · 2014-12-13 17:17 · Score: 1

Yeah quite obviously IBM use Lotus Notes and Google use Gmail, I was making a point that Exchange/Outlook still takes the lion's share of the market, and there is a reason for that.
Re:Paranoia abound by jbolden · 2014-12-13 17:41 · Score: 1

"it's not pure chance that every major corporate network runs it." is not "Exchange/Outlook still takes the lion's share of the market,"
Those are very different statements. You were defending the statement, " there really is only one product in the Enterprise email/calendar/collaboration space worth a damn " which is why you had to make the case it was the unique solution.
The fact is Exchange/Outlook is a pretty good solution. But it is far from the only solution or only viable solution. The big features that Exchange offers like shared calendaring just about every piece of groupware offers. Outlook is a good mail client and certainly office integration is the best of any of them. That probably is why it is so heavily used.
Your "sucks balls", "worth a damn"... is well beyond the actual situation.
Re:Paranoia abound by Jack+Griffin · 2014-12-14 20:22 · Score: 1

Yes you certainly got me there. You must be fun at parties...

Because EVERYONE is qualified to read code by Anonymous Coward · 2014-12-10 14:05 · Score: 1

Especially encryption code necessary to truly protect your email.

Jeez, what color is the sky on your planet?

Re:Because EVERYONE is qualified to read code by Neil+Boekend · 2014-12-10 20:31 · Score: 1

Brownish white with some moisture stains in the corner over there.

--
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.

Open Source not a silver bullet by i+work+on+computers · 2014-12-10 14:06 · Score: 5, Insightful

We've seen over the last year many open source, power in numbers projects have critical vulnerabilities waiting to be exposed. Those defects were sitting there for years, yet being open source didn't magically fix them. I use many open source tools, but I've never inspected the code myself. Even if I did, I'm not going to be finding these hard-to-find defects that the people in the project can't find. I'm not going to implicitly trust an open source project just because it's open source. How do I know who's really contributing? At least if Apple is doing something naught with my iCloud email, at least in theory I can join a class action lawsuit and get a free download from iTunes. If the NSA is inserting nefarious code into an SSL project, there's really no recourse for action. Over the last year, I've learned that the key to internet security is that it doesn't exist. If there's something that really so sensitive, maybe you shouldn't email it.

Re: Open Source not a silver bullet by Anonymous Coward · 2014-12-10 14:17 · Score: 3, Insightful

Also of import: what's the status of turnkey open source email packages these days anyway? What is out there that exchange admins can switch to that won't make them hack on features or make their users ask WTF they just did? That is the elephant in the room and the million dollar question.
Re:Open Source not a silver bullet by Anonymous Coward · 2014-12-10 14:28 · Score: 1

How do you know you aren't just a brain in a vat? You can't trust anything, man!
Re:Open Source not a silver bullet by Anonymous Coward · 2014-12-10 16:00 · Score: 1

We've seen over the last year many open source, power in numbers projects have critical vulnerabilities waiting to be exposed. Those defects were sitting there for years, yet being open source didn't magically fix them.
Precisely! In theory it could be more secure but in practice, as we have seen, you could have a critical bug sitting there, unbeknownst to users, being exploited for decades before somebody fixes it. Open source is not a silver bullet for security!
I really genuinely wish people would stop tarnishing the name of open source with these garbage articles about theoretical benefits. Open source has many significant advantages, this is not one of them and crap like this is going to lead to dismissal of open source on the basis that its supposed benefits are unfounded.
Re:Open Source not a silver bullet by Artifakt · 2014-12-10 16:14 · Score: 2

How do you know there's a real vat?

--
Who is John Cabal?
Re:Open Source not a silver bullet by Yaztromo · 2014-12-10 16:15 · Score: 1

I use many open source tools, but I've never inspected the code myself. Even if I did, I'm not going to be finding these hard-to-find defects that the people in the project can't find.
From a security perspective, even just having and being able to inspect the code is insufficient if you need top-notch security: you had better also be compiling that code yourself. It is nearly impossible to be able to verify that a binary blob didn't contain additional/modified code than what the sources contain without compiling it yourself. And even with being able to compile everything yourself, you're still at the mercy of the build chain and all of its dependencies (unless you audit/build them yourself too).
Open Source is still better in this regard than closed source, of course -- at least you have the ability to compile it yourself if security is that critical. I think the problem for a lot of organizations is that security isn't critical enough for them to hire people to a) audit the code and b) build, test, and verify it for their own internal use. In which case, it would (at least form outward appearances) be cheaper/easier to go with a closed-source solution, with someone behind it whom you can blame/sue if things go sideways.
Yaz
Re:Open Source not a silver bullet by exomondo · 2014-12-10 16:24 · Score: 3, Insightful

From a security perspective, even just having and being able to inspect the code is insufficient if you need top-notch security: you had better also be compiling that code yourself.
With a verified compiler no less. We have seen ever more sophisticated malware these days, certainly a malicious compiler could easily slip vulnerabilities into the binary.
Re:Open Source not a silver bullet by Anonymous Coward · 2014-12-10 17:14 · Score: 1

The trouble with proprietary software is that those defects will persist forever. And, if the NSA inserts nefarious code into a proprietary TLS/SSL project, you'll still never know, and you'll still have no recourse. If it was open source, at least there's a chance it will get noticed and fixed.
Someday, we might have formally verified open source security software. But, that's not really a valid point until we start seeing it, and making formally verified software is hard.
Re:Open Source not a silver bullet by BarbaraHudson · 2014-12-10 17:33 · Score: 2

How do you know there's a real vat?
How do I know YOU are real?

--
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
Re:Open Source not a silver bullet by Dutch+Gun · 2014-12-10 18:04 · Score: 2

And even with being able to compile everything yourself, you're still at the mercy of the build chain and all of its dependencies (unless you audit/build them yourself too).
It seems a bit foolish to worry about purely theoretical security issues when we've got so many real ones to deal with. Ken Thompons' compiler infection demonstration was an interesting experiment designed to make a particular point, but I don't think it's wise to consider tool-chain hacking a legitimate threat, as we've never seen anything remotely like this in the wild, as far as I'm aware. And frankly, I question whether it's even realistically possible beyond a very simplistic demonstration.
At some point, theory has to give way to practicality, and you have to use some good judgment and common sense. Humans have to use a "chain of trust" at some point, because if you took the time to independently verify everything yourself (even assuming you had the expertise), you'd never get anything practical done. In fact, just about everything we do in our society at a high level of technology or craftsmanship ultimately requires relying on and trusting in others to assist you, at least to some degree. Security is no different. You have to weigh the probabilities of hypothetical threats versus limited resources to deal with those threats and do the best you can with the resources available. Diverting your attention on unrealistic threats will ultimately make you less secure, not more.

--
Irony: Agile development has too much intertia to be abandoned now.
Re:Open Source not a silver bullet by Yaztromo · 2014-12-10 18:09 · Score: 1

With a verified compiler no less. We have seen ever more sophisticated malware these days, certainly a malicious compiler could easily slip vulnerabilities into the binary.
Yup -- I intended that to be considered part of the build chain. Compiler, standard libs, any 3rd party library dependencies, the build tools themselves (have to make sure they're using the libs you expect them to...), the OS kernel...right on down the chain.
Yaz
Re:Open Source not a silver bullet by Yaztromo · 2014-12-10 18:30 · Score: 2

It seems a bit foolish to worry about purely theoretical security issues when we've got so many real ones to deal with. Ken Thompons' compiler infection demonstration was an interesting experiment designed to make a particular point, but I don't think it's wise to consider tool-chain hacking a legitimate threat, as we've never seen anything remotely like this in the wild, as far as I'm aware. And frankly, I question whether it's even realistically possible beyond a very simplistic demonstration.
First off, naturally the level of security I'm talking about would probably only be reserved for national governmental agencies intended to protect ultra-sensitive data. For them, that level of security is necessary, and they will spend the money and resources to audit and verify everything if necessary (which is why we have SELinux).
Additionally, the build chain comprises not only the compiler, but the standard libraries and any third-party libraries as well. If not verified, these could easily have unexpected code inserted into them, that compromises your product once linked against them. You wouldn't expect to see such compromised libraries "in the wild", as they would probably part of a targeted attack. This is hardly unprecedented; while not done at build time, Stuxnet uses DLL replacement on Windows to add extra routines to the operating system, which are used to inject code being uploaded into a PLC.
Again, most organizations don't care to undertake the kind of expense required to protect against such attacks; they use the chain-of-trust you describe. However, national security organizations do work at this level, and if you need that level of security, pre-compiled binaries, whether they come with source or not, is insufficient.
Yaz
Re:Open Source not a silver bullet by Dutch+Gun · 2014-12-10 21:36 · Score: 1

Yes, national security agencies probably think at that level, because they can afford to think at that level - same with top industry security experts such as Bruce Schneider. Even so, I'd still posit that it's still very much a hypothetical threat or method of attack. It's fun to theorize about what-ifs, but we should probably recognize it as such, with the understanding that it's not really relevant to nuts-and-bolts security issues in the real world. There's a pretty significant difference between "this is theoretically possible" versus "this has a reasonable chance of ever occurring".
BTW, even early and very rudimentary viruses such as the old "happy99" virus replaced a Windows DLL to inject itself into outbound traffic. Unless I'm misunderstanding something, I don't think that's really an example of what we're talking about here. Stuxnet was hella impressive for a lot of other reasons, of course.

--
Irony: Agile development has too much intertia to be abandoned now.
Re:Open Source not a silver bullet by mrchaotica · 2014-12-11 03:19 · Score: 1

...and bootstrap the whole thing by cross-compiling on several unrelated kinds of hardware (ideally including some old enough that maybe nobody had thought to put backdoors in it yet), and then checking that the resulting binaries are identical. Maybe use a 386, an ARM or PowerPC, and something Chinese, for example.

--
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Re:Open Source not a silver bullet by organgtool · 2014-12-11 03:22 · Score: 1

We've seen over the last year many open source, power in numbers projects have critical vulnerabilities waiting to be exposed. Those defects were sitting there for years, yet being open source didn't magically fix them.
I can't deny that - the "many eyes" argument hasn't quite held up over the years. However, the reason I prefer an open source solution is because they tend to acknowledge and fix the issue much faster than their closed source counterparts. Most of the serious security issues in open source software have a fix released within 24 hours. It takes many closed source organizations much longer than that to even admit that the problem exists. Worse yet, some vendors will deny the problem indefinitely or tell you to migrate to their new platform (which is obviously incredibly costly). With open source, you're free to fix the issue in-house or contract someone to do the work if the vendor is uncooperative.

Over the last year, I've learned that the key to internet security is that it doesn't exist.
That's the sad reality and it's completely independent of the licensing model of the software you use.
Re:Open Source not a silver bullet by steveg · 2014-12-11 06:42 · Score: 1

Ken Thompson modified the original C compiler to put a back door into the Unix login program, as well as to modify any compiler that was compiled with that compiler to include the backdoor function. So for generations of code, and backdoor was inserted, with no evidence of its existence in any code you could examine.
http://cm.bell-labs.com/who/ke...

--
Ignorance killed the cat. Curiosity was framed.

Not really ... by BarbaraHudson · 2014-12-10 14:07 · Score: 3, Insightful

Unless you're using encryption, it doesn't matter, since there are many points of 'interest" between the sender and receiver.

--
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.

Re:Not really ... by Kjella · 2014-12-10 14:44 · Score: 2

Unless you're using encryption, it doesn't matter, since there are many points of 'interest" between the sender and receiver.
Yeah, for external mail no doubt. But for internal mail you probably wouldn't bother, then it's a pretty huge juicy target for sensitive information. Even when you're not passing the juiciest details by email like blueprints and source code there'll be tons of business information in attached presentations and so on.

--
Live today, because you never know what tomorrow brings
Re: Not really ... by Anonymous Coward · 2014-12-10 16:30 · Score: 1

Internal mail is easier to encrypt if your clients use provisioned SMIME certs. Set up an internal CA and push its root to all devices, thrn generate keys for users and push them to the right places for your OS/mail app combo, and most mail apps will use them automatically or with some minimal config that you can push to your network. Keep a backup of employees keys for data retention policies so you can recover subpoenaed mail. You can still be defeated by a determined adversary who gets the private keys from the computers or installs keyloggers, but you're a much, much harder target.

Trust by Michael+Woodhams · 2014-12-10 14:12 · Score: 3, Insightful

Sigh. Now somebody is going to bring up Ken Thompson's "Reflections on Trusting Trust" in 3... 2... oops, too late.

--
Quattuor res in hoc mundo sanctae sunt: libri, liberi, libertas et liberalitas.

Re:Trust by Anonymous Coward · 2014-12-10 17:01 · Score: 1

What are Bennet Hasselton's thoughts on Ken Thompson's "Reflections on Trusting Trust"?

Fucking Clickbait by Anonymous Coward · 2014-12-10 14:36 · Score: 1

There was no informational value at the linked page. All of those arguments have been made/refuted many times over the years. If you're actually worried about email security then a self-hosted open-source mail server isn't going to help you... you need to be using encrypted mail.

Re:Fucking Clickbait by BarbaraHudson · 2014-12-10 14:48 · Score: 2

What do you expect? The guy who wrote this is just a marketing troll.

Olivier Thierry is the chief marketing officer of Zimbra, and has more than 30 years of experience increasing market visibility and developing go-to-market strategies for high-volume software organizations,

--
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.

Stupid article is stupid by Anonymous Coward · 2014-12-10 14:51 · Score: 5, Insightful

Open source is a source licensing model. It has no magic powers for creating secure solutions to anything.

Stupid headline: Why open source matters for sensitive email
Stupid headline: Why closed-source matters for sensitive email
Smart headline: Why security matters for sensitive email

Code audits for security defects can happen regardless of source licensing model.
Coders authoring a service, no matter how security conscious, and no matter how many eyeballs they have, will likely miss many exploitable defects.

Re:Stupid article is stupid by chromaexcursion · 2014-12-10 16:11 · Score: 2

Sadly this was posted by an Anonymous Coward. Few will ever see it. The default is to view at +1. cowards post at 0. Took modding for me to learn that.
It points out yet again people are mistaking open source with security.
You'd think after heartbleed a few would have caught on.
Re:Stupid article is stupid by AmiMoJo · 2014-12-11 00:38 · Score: 1

Open source does matter for any security sensitive software, which these days is pretty much all of it. It's not that open source is inherently more secure than closed source, it's that the support is better.
When a vulnerability is found in closed source software someone has to contract the vendor. That in itself can be difficult. Then they take some time to fix the problem, maybe months or years, and until then the problem remains secret. With open source it's usually easy to contact the developers, the person who found the problem can often go to them with a patch to fix it ready for testing, and the issue becomes public quickly so people can take action.
In addition, it's much easier to trust source code you can compile yourself than a closed source binary blob. There might still be backdoors, but the risk of them being found is much greater.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC

FOSS email LONG before Exchange, most mail FOSS by raymorris · 2014-12-10 15:23 · Score: 4, Informative

Email was flowing through open source systems for DECADES before Exchange came out. Today, the vast majority of mail is handled by open source systems.

If you're accustomed to Exchange and want to get that same bloated feeling without the six figure license fees, there are many open source packages designed,for that. Examples include OpenChange, Open X-change, Zumbra, Citadel ...

Of course the vast majority of mail is handled more in the Unix philosophy, rather than one software package that thinks it's a file server (SMB), an MTA, an MDA, a groupware calendar, an IMAP server, and six other things it does poorly, the normal Unix way is if you want IMAP, you install a good IMAP server by clicking on or typing "dovecot". It doesn't have a buggy, insecure file server sticking the out the side that you never asked for.

X.org? by nickovs · 2014-12-10 16:13 · Score: 2

If I was publishing an article talking about how huge numbers of eyeballs solves security problem I'm not sure that I'd choose to publish it the day after it was announced that the X window server code has had some serious security bugs for 25 years that have only just been discovered. Clearly open source code can have serious security holes that go unnoticed for a very long time.

--
If intelligent life is too complex to evolve on its own, who designed God?

Re:X.org? by Neil+Boekend · 2014-12-10 20:36 · Score: 2

In that the main difference with closed source is that open source shows it's dirty laundry. Why do you think a closed source solution would not have flaws of similar severity?

--
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.

Re:Can you really trust open source? by BronsCon · 2014-12-10 16:18 · Score: 1

At the very least, no less than I can trust closed source.

--
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.

Re: FOSS email LONG before Exchange, most mail FOS by Anonymous Coward · 2014-12-10 16:23 · Score: 1

Zimbra. There are probably others: five minutes of Googling will net you answers. Or install an IMAP mail server and a separate calendaring program on the same server, and your clients won't notice that they're two programs. Ports are just standard interfaces for standard APIs.

All- OpenChange, Citadel, Zimbra .. + RSS Faceboo by raymorris · 2014-12-10 16:32 · Score: 2

All of the packages I mentioned provide that. Not being tied to Microsoft's ecosystem, they can also integrate your Facebook, Twitter, rss, or other notifications.

Open source client does by iamacat · 2014-12-10 16:48 · Score: 2

Truly sensitive e-mails should be encrypted, so open source and other characteristics of the service do not matter.An ideal client would support zero knowledge multihop forwarding so that even sender/recipient metadata can not be analyzed.

Re:All- OpenChange, Citadel, Zimbra .. + RSS Faceb by jrumney · 2014-12-10 17:47 · Score: 1, Informative

You've got that backwards. Exchange is the one that requires proprietary clients (it just happens that the major smartphone vendors include proprietary ActiveSync clients out of the box). The others listed use standard IMAP+LEMONADE extensions (which admittedly isn't widely supported by desktop clients, because they generally don't need it).

Email is not suitable for sensitive material by dbIII · 2014-12-10 17:48 · Score: 2

If you are using email for sensitive material then you are ignoring decades of warnings from everyone with a clue about email.

Re:Paranoia is actually warranted these days by Anonymous Coward · 2014-12-10 17:58 · Score: 2, Insightful

Trust? Let me tell you about trust, there is no more trust...
You cannot trust Microsoft, or Google or anyone else with your mail for that matter. Every commercial mail provider and software maker is either already in bed with your adversary, or subject to your adversaries whim. For that matter, you cannot trust the 1.5 BILLION transistors in your CPU. But let's ignore that for now.
You CAN generally trust open source software for your MUA and MSA/MTA, and for your crypto.
You NEED crypto.
Then, you cannot send your encrypted mail through stupid commercial mail providers. It STILL exposes who you are mailing, from where, when, and the subject line, when your recipient was on to get it, etc, etc.
And you CANNOT use stupid "webmail' that says they will encrypt your mail for you, because you are either giving up your keys to them or letting them take control of your browser... exactly like the safe-mail.net debacle, you're going to get screwed.
So you both MUST use crypto AND use an anonymous Peer-to-Peer direct messaging service.
Think I2P-Bote, or ImperialViolet's Pond, or BitMessage... something where your message is sent directly over the anonymizing network straight to your recipient, or so that only they can see any part of it... NOT off to sit on some centralized server that will get subpoenaed and snooped and raided.
In summary, get this straight folks....

USE crypto AND use an anonymous Peer-to-Peer direct messaging service.
It is the ONLY way your messages will ever be private to only you and your correspondent over the wire.

Why marketers should not write articles. by bloodhawk · 2014-12-10 19:04 · Score: 1

Perhaps rename article. "An Example, Why marketers should not write articles"

Trust is of utmost value by thegarbz · 2014-12-10 19:10 · Score: 1

What an absurd statement this is making. I like the one about "Trust is of utmost value". No, not at all and let me explain why.

If I use open source software I use binaries. I have no more faith in those binaries than any other piece of closed source software, there's no guarantee that the binary matches the source, even if the source is somehow magically free of bugs because as we all know open source is infallible.

Ok so there's the potential for me to do an audit. So I have the choice, I could sit down and decompile the binary and audit it against the original source code, or I could download the source code and compile from source. Which now raises the question:

"Who in their right mind would go to this much effort securing software used to send plain text data over unsecured servers scattered around the internet?"

Open Source == DOES get a fine tooth comb. by Dr.+Crash · 2014-12-11 00:44 · Score: 1

I am the prime author of CRM114 (the spam filter) and IT DEFINITELY GOT CHECKED BY SMART PEOPLE. There were at least a dozen people who would dependably read the code, and they'd find the pickiest things (luckily, not anything serious; thank you Valgrind!)

So, it's absolutely, demonstrably, provably (read the mail archive!) the case that at least SOME mail-oriented open source gets the all-orifices examination, and that examination is effective.

Whether or not security software gets the same thing, I can't say for sure, but I'd be surprised that it didn't. The recent set of security vulnerabilities only shows that old code didn't get the same care as newer code.

Open Source matters for sensitive *anything* by Qbertino · 2014-12-11 00:44 · Score: 1

Captain Obvious submitted again.

Open Source matters for sensitive anything. In fact, I, and any professional I've talked to, would say if it's not FOSS or at least using a free open standard in data format, it's of no use for anything sensitive or mission critical. We've arrived at the point where critical systems that are not FOSS aren't even considered to be enterprise ready by a large portion if not even the majority of IT experts. Which is a good thing, IMHO.

For instance, anybody nowadays talking Unix and not thinking of a FOSS *nix but suggesting something other (exotic I guess you'd call it today) would be laughed out of the room. One of the reasons I find RMSes insistence on the GNU/Linux term a tad backwards - although he is right about most of the important things.

--
We suffer more in our imagination than in reality. - Seneca

Completely making that up by raymorris · 2014-12-11 01:40 · Score: 1

Now you're just completely making stuff up. How do you think email worked for the 25 years before Microsoft said "me to"?

Re:IMAP PUSH, RFC 3501 by Anonymous Coward · 2014-12-11 14:07 · Score: 1

RFC 3501is the standard for imap, including PUSH.

It uses IDLE, which, given the amount of overhead, is not suitable for mobile devices which is why P-IMAP and Lemonade are in development. Do you understand that? Probably not.

You call Exchange Activesync "a de facto standard" - IMAP is an ACTUAL standard, and it includes push.

The IMAP standard contains IDLE which is inappropriate for mobile devices, which is why they dont support it. Oh but you didnt know that did you, that is why you just provided your stupid incorrect reply.

Btw, you called it ActiveSync, but that's the name of an older,mostly unrelated protocol, used with a PDA cradle connected to the serial port. You're thinking of Exchange ActiveSync.

I said "Microsoft brought ActiveSync with Exchange", clearly that is what I meant, in fact you even stated it "you call Exchange Activesync...". I wouldn't expect to need to iterate every little detail because mouthbreathers such as yourself cannot comprehend context.

Don't pretend you don't know what I'm talking about when you explicitly stated in the previous sentence that you do, if the context provided confusion you would have asked but you know the context made it clear which is why you didn't.

and wrong again by raymorris · 2014-12-11 14:47 · Score: 1

> It uses IDLE, which, given the amount of overhead, is not suitable for mobile devices which is why P-IMAP and Lemonade are in development

And wrong again. Per the current draft, P-IMAP devices are REQUIRED to support IDLE. SMS and WAP are optional. P-IMAP uses doesn't replace IDLE, it uses IDLE.

Also note Exchange ActiveSync uses a heartbeat protocol very similar to IDLE - with pretty much the same problems. The content of the packets are a bit different, the overall scheme is rather similar.

You're on Slashdot, not at the bowling alley. Here, some of us actually know a bit about this stuff. Some of us are even IETF members and help write the standards that you've apparently never heard of, much less read.

Slashdot Mirror

Why Open Source Matters For Sensitive Email

54 of 73 comments (clear)