Firefox and Thunderbird: A Fork in the Road | Hacker News Reader

Firefox and Thunderbird: A Fork in the Road

marksurman.commons.ca

102 pointsrobin_reala75 comments

It's sad to see that Mozilla considers desktop email clients as outdated. It's true that most people use phone apps and webmail, but in enterprises the story is completely different. MS Outlook rules in many places, but I'd bet there are at least a few million people using Thunderbird as their desktop mail client, more so in a (slightly "hostile") MS Exchange environment.

If Thunderbird were to really evolve and provide what people have been asking for for a very, very, very long time, it is good calendaring that "just works" with MS Exchange (I know about the extensions and external applications available, but none of them provide a seamless experience or all features that are required for calendaring).

Post Edward Snowden's revelations, more people need a good way to do encrypted mails well too (that's complex and is also more of a user experience issue, but an organization like the erstwhile Mozilla Messaging could have spent a good amount of effort on it). Along with this, we would have encrypted chats (since chat is already part of Thunderbird), encrypted voice calls, etc. That would be phenomenal!

IMO, Mozilla really lost focus on Thunderbird long before it decided to shelve it as a "community driven project".

Mozilla of today is run by designers, webheads and "social" personas.

As for encrypted email, it could be made very simple. When you set up an account in Thunderbird, have it ask a simple question "do you have an encryption key?". If the user hits no, generate the key pair, and insert the public key by default.

Then starts harvesting public keys from incoming emails, and encrypt by default if sending to an address that has a known public key.

Doesn't this sort of abandon the trust model of PGP? If you make default encryption a part of the system and an elevator pitch bullet point, I don't think it's really fair to call it simple because a UI change would be needed to ensure that though email may be encrypted, users can't necessarily trust the identity of the sender.

And how will software ever help with that?

Put a signed image of the device user at time of sending?

You are pretty much walking into the same issue that big media has had with DRM. You can't trust something user facing to be doing the "right" thing unless the whole chain down to the individual chips are certified by entities you control.

Right now email is more like sending post cards than letters, yet people treat them like the latter. encryption by default would at least make them behave like letters while crossing the networks.

Figuring out if the sender is who he or she claims to be is a very different issue, and one that has plagued humanity since the dawn of correspondence.

My issue is not default encryption, which I think is a "good thing"™. It's that if you say "Thunderbird: Encrypted by Default"™, you give users a sense of security that is at least partially an illusion. This is something we would roundly criticize Google for if they were to say, for example, "your email and searching is secure because you are using SSL". I feel it's incumbent on an organization like Mozilla, one that I support at least partially because they are not building a platform to advance their own interests, to be very clear that email is encrypted en route, but not necessarily secure.

I'm guess I'm viewing it from a communications angle.

Here we are back at the varying definition of "security".

The encryption will defend against NSA style "grab everything, sort it out later" attacks.

but it will not defend against targeted attacks where someone had compromised the remote sender somehow.

The former is a boon for most people vs the present state, the latter is a hairy problem that has been with us since we first started sorting ourselves into ingroups and outgroups (how do you know that the email is not sent by someone with a gun pointed to their head?).

Or as i was reminded by a different comment: perfect becomes the enemy of good.

In the status quo nothing is verified or encrypted anyway. When we make the perfect the enemy of the good, we reinforce that status quo. As long as the trust model of PGP depends on everyone to get the same religion, we are stuck waiting for a messiah which will never come. If we have any hope of improving the status quo, we need some kind of bootstrap, and that bootstrap won't look exactly like the final result we want.

Ubiquitous email encryption would improve on the status quo, and prepare the ground for further improvements. People who don't care would still be generating more verifiable information than the status quo. People who want to use encryption wouldn't be forced to drop it in order to talk to family and friends. People who want to carefully manage their identities and use signing to build a web of trust could build that on top of ubiquitous encryption. This would get us closer to the PGP trust model than anyone has been able to do purely by evangelizing the PGP trust model.

> When we make the perfect the enemy of the good, we reinforce that status quo.

Story of present day FOSS right there.

After so many years of email that's entirely in the free and clear, I'd consider any steps nearer encryption as beneficial. Even if fundamentally weak improvements with annoucements littered with caveats for those in the know.

I'd like for encrypted email to become a standard thing in my lifetime. We are no nearer than when I trialled PGP in the 90s.

Then we can think about email that doesn't leak all your meta-data.

I seem to recall that this is exactly what a brand new installation of Thunderbird with Enigmail will do. I don't know if the newly generated public key is published anywhere, but that's a simple configuration change.

Yep, but Enigmail is not part of the default Thunderbird package. It has to specifically be installed by the user after installing and running Thunderbird.

Email encryption isn't mainstream and it isn't Thunderbird's fault, but GPG's. It's an antiquated protocol with an antique implemention and it's hard to understand and hard to setup. Thunderbird including the implementation by default would only confuse users. Those who want Enigmail already know to search for the plugin. Those who don't know what it is wouldn't know what to do with it.

What's antiquated about the protocol?

I actually installed Thunderbird and Enigmail at the same time through my operating system's packet manager. You do not have to start Thunderbird before installing Enigmail.

Turning a extension into a disto package, ye deities...

So what? They're just files.

Thunderbird has been the poor, forgotten relation over at Mozilla for a long time now. Given the endless stream of ridiculous decisions for Firefox, over the last few years, I can't bring myself to see that as a bad thing.

I'd like to hope that Thunderbird can thrive in a new home, but somehow I'm not optimistic.

And when you say "enterprise", think also of small and medium businesses. There are many advantages to webmail, but I keep running into smalls and mediums who use shared hosting for email (IMAP and (shudder) POP3), but can't truly leverage "Horde" or other open source webmails. Their options are Outlook if they have enough licenses ($$), or Thunderbird if they don't.

Yes, many move to Google's infrastructure if they can, but not everyone is able to or wants to. Thunderbird is one of the remaining alternatives.

I can't edit my comment now, but when I mentioned "enterprise" and "at least a few million people", I did have small and medium businesses in mind as well. :)

A problem I foresee is Firefox's attempts to move away from XUL.[0] Firefox might just about manage that move, but who will do that work for Thunderbird? And once Firefox moves away from XUL, who will maintain XUL for Thunderbird's sake?

[0] Firefox is still XUL-based for now, but I think the writing's on the wall given the security issues with XUL and XPCOM, and Firefox's move away from XUL/XPCOM-based extensions.

Not only that, but I'm also concerned about the future of addons like Pentadactyl [0] and Vimperator [1] that use XUL.

I know the user base of these addons is not anywhere as big as Thunderbird, but I can't really imagine using Firefox without Vimperator; and it's already started to break in Firefox 45.

[0]: https://github.com/5digits/dactyl

[1]: https://github.com/vimperator/vimperator-labs

  but I can't really imagine using Firefox without Vimperator

I can second that (s/vimperator/pentadactyl/). pentadactyl at least still works in Firefox 45.

I'll jump in and mention VimFx [0] here because, having the same concerns, I recently switched over from vimperator. It's lighter than vimperator but gives much of the similar functionality, without completely revamping the browser. And it should continue to work as Firefox moves ahead.

[0] https://github.com/akhodakivskiy/VimFx

VimFx (and Vimium for Chrome -- XUL deprecation and the loss of Pentadactyl migth be what finally pushes to switch from Firefox to Chromium) are nice addons but feature wise they do only a small subset of what Vimperator/Pentadactyl do. I use Pentadactyl and I get a lot of use out of writing my own plugins, using autocommands to trigger different actions on different pages, using quickmarks, and using ":js" on the command line to debug javascript code.

I plan to use VimFx/Vimium in the future though because those keyboard patterns are ingrained in me now. Pentadactyl development has dried up over the last few years and it seems unlikely that such a huge change as XUL deprecation will be addressed. The developers have been asked about this several times through different media and not responded. I'm not sure about Vimperator. The developers are still active but porting is a lot of work and currently all of the necessary API's do not exist. Hopefully, I can cobble together something resembling Pentadactyl/Vimperator by using a few other extensions in addition to VimFx/Vimium.

Well, they either have to rewrite Thunderbird's UI, or maintain a fork of Gecko that still supports XUL. I have no idea which one of these would be less work.

My between-the-lines reading of this post is that this is really what is leading the split between firefox and thunderbird. Not enough people at mozilla care about thunderbird and so either they split and stay with xul or die.

Of course I don't know for sure (I don't even use thunderbird).

Come over to Pale Moon [https://www.palemoon.org/] (firefox fork continuing XUL) and FossaMail [https://www.fossamail.org/] (thunderbird fork based on Pale Moon Goanna engine).

These products aren't perfect, but they allow the traditional strengths of firefox (powerful extensions based on XUL/XPCOM) as opposed to the new chromification of the firefox extension api. Also, you don't have the mozilla politics and constant moral hectoring (if you read the firefox start page or go to mozilla's website, I think you might know what I mean).

I don't personally have a problem with Mozilla trying to defend the open web. If anything should be their mission, that's a good one.

And while XUL is the base that many extensions have been built on, Mozilla are quite right to throw it out. If Firefox chucks it, I doubt forks of it will manage to maintain it well. It's half-dead already.

Killing XUL is not a problem in itself, what's not clear is whether WebExtensions will support the same advanced features, and the goal of keeping compatibility with Chrome implies it won't.

Chrome compatibility isn't a major goal, IIRC. WebExtensions are based on the Chrome API but will neither necessarily implement all Chrome features, nor be restricted to the set implemented by Chrome, AIUI.

Well, it sounded like a major goal in their announcing blog post:

We would like add-on development to be more like Web development: the same code should run in multiple browsers according to behavior set by standards, with comprehensive documentation available from multiple vendors. To this end, we are implementing a new, Blink-compatible API in Firefox called WebExtensions. Extension code written for Chrome, Opera, or, possibly in the future, Microsoft Edge will run in Firefox with few changes as a WebExtension.

https://blog.mozilla.org/addons/2015/08/21/the-future-of-dev...

Killing XUL is actually a significant issue. It affects:

-Thunderbird

-Instantbird

-Nightingale

-Celtx

-Blue Griffon

-Pencil project

-Komodo IDE

And others.

Fair enough, I meant to Firefox itself.

Frankly I am pondering going back to Seamonkey (what used to be the Netscape/Mozilla application suite).

I use Seamonkey as my newsreader, works pretty well.

SeaMonkey likely has even fewer resources to maintain the mail engine within than Thunderbird does.

Considering that Pale Moon strips out accessibility in the first place, I'm not sure an extension designed to increase keyboard accessibility would be the best fit.

Other enterprises have built and shipped standalone applications built on XUL/XPCOM. Curious how the roadmap for XUL looks like in the midterm future.

Yes, this is why the issue has become urgent right now. Thunderbird barely has the resources to keep up with the underlying changes to Gecko with each release. It has nowhere near the resources needed to deal with the deprecation of XUL. I am grateful to the Thunderbird community for continuing to maintain a stable email client over the years, but it has been a long time since a new release has brought any new feature that impacted me. From following bugs on some features I would like to see, I get the impression that the code base is old and full of overly intertwined components that make changes difficult. One example is this bug opened eight years ago about making it possible to write emails in a new tab rather than a separate window: https://bugzil.la/449299

I hope that once the Thunderbird code base is split from Firefox the churn for the developers will be reduced and they can spend more time on improving performance and adding new features. I do worry though that Thunderbird could become less secure over time without the Firefox team maintain security issues in XUL.

I find it hard to believe that another organization would be a better home for Thunderbird than Mozilla, but some of the language in the blog post and report is disappointing to me. Mainly, the points about Thunderbird needing to be self-funding and use its own infrastructure. If the code bases split and Mozilla focuses its advocacy around Firefox, surely that should be enough to unencumber Firefox and give it a (in my opinion slim) chance to remain relevant. Mozilla really values Thunderbird so little that it can't give it any resources at all? Even when it has all of the infrastructure needed by Thunderbird already set up?

I honestly hope that LibreOffice will take over the development of Thunderbird. They seem to be doing an excellent job at running a successful open source project and Mozilla looks like it lost its course a couple of years ago (before someone asks me why I think that: https://blog.r3bl.me/en/mozilla-dissatisfaction/)

There are some parallels between LibreOffice and Thunderbird that make The Documentation Foundation's adoption of Thunderbird attractive.

1. Both LibreOffice and Thunderbird are desktop implementations of applications for which most of the recent momentum has been behind web-based implementations (Google docs, GMail, Office 365, etc.). So TDF is used to the desktop vs. web dynamic.

2. Both LibreOffice and Thunderbird has large installations in business/government environments.

3. Both LibreOffice and Thunderbird started out being governed by different organizations and would be adopted by TDF (slightly different situation for LibreOffice which was a fork, though Thunderbird will be forking off its shared base with Firefox). So TDF is used to adopting legacy code and continuing to evolve it.

That said, I hope the TDF scrutinizes Thunderbird and only takes it on if it is confident that Thunderbird fits into its overall mission and infrastructure. In recent times I have liked what I have seen from TDF and been somewhat disappointed by Mozilla, so I wouldn't Thunderbird to hamper LibreOffice's momentum.

I get the sense that Thunderbird doesn't have cohesive vision or leadershihp: All the big organizational moves seem to be Mozilla's initiative; I don't hear about much happening at Thunderbird, technically or organizationally; and Simon Phipps' report[1] says the following when considering an independent Thunderbird Foundation, and the implication I take is that these issues can't be resolved now:

    *   Creating a new entity involves resolving all of the
        issues currently facing Thunderbird and its community
        and then making them concrete in legallybinding bylaws
        and articles of association.  As such, it is a step best
        taken after these things have been resolved, rather than
        before.

    *   With all these things taken into account, I would not
        recommend this option as a first step.  However, it may
        become appropriate in the future for Thunderbird to
        separate from its new host and become a full independent
        entity, and the ability to do this should be considered
        in selecting a new home.

But my concern is based on only an intution plus a few observataions; does anyone know? I don't mean it critically; it's hard to organize and find leadership resources for a volunteer project. Mostly, I'm just concerned about Thunderbird.

[1] https://blog.mozilla.org/thunderbird/files/2016/04/Finding-a...

Mozilla is a weird organization.

Thunderbird makes client-side PGP encryption a little easier at a time in the world where not only governments are harvesting every cat-gif email we send, but also those Valley companies who harvest and analyze practically everything we do, just to send us "better ads".

I do commend those volunteers who didn't sit on the internet and makes comments like the rest of us, but took charge and kept Thunderbird alive.

Mozilla lives on money from the ad industry, so in a way they are all part of the same system.

It seems like the whole modern connected infrastructure we rely on relies on money from the ad industry. Google, webmail services, free websites, all of them rely on a small subset of companies that buy eyeballs. From an outsider, it certainly seems like Mozilla is the only company in the space that's trying to make the Internet better, rather than making the browser a path into their own ecosystem of services (and consequently ads).

Firefox was created to be a browser in which the developers and the community can have a voice, rather than having all decisions made by the enterprise. I know there are many heroic stories and tales, but after all those are the two goals.

Why are there laundromat, 99 cent store, Deli place and a bus stop next to a street full of homes? Next to a college campus you'd find Deli and street food vendors? Of course one can give out free food and you can always choose to work from home so you never have to deal with pedestrian jam or the smoke coming from the grill. For example I can skip WSJ paywall by not registering any account and not reading any WSJ online articles. That's fine and the anology of this is finding a suburban home. The public Internet is like New York City, so many people, so many business, so much to navigate (but of course as a NY resident I can get tired of the city myself). If you want no ads, you have to lobby a group of politicians (actually companies) and convenience them your plan is better and is more profitable. The thing is that once there is a collation of business opportunity, uniting that knot is very difficult because everyone has a piece in it. Few people want to bet on new plan.

> Firefox was created to be a browser in which the developers and the community can have a voice, rather than having all decisions made by the enterprise. I know there are many heroic stories and tales, but after all those are the two goals.

While I like these ideas, this isn't quite accurate. That may describe Mozilla Application Suite (now Seamonkey) to some extent, but not Firefox. Mozilla's mission is to promote the open Internet, as opposed to the proprietary one (originally represented by IE's market dominance):

https://www.mozilla.org/en-US/mission/

Firefox disrupted browser market and now Chrome/IE are making a trio not too far from each other, it is now a uphill battle for Mozilla.

Thunderbird is the only choice across platform for Desktop usage. I use it daily and don't mind paying for it.

On the other hand, since Microsoft is porting everything to Linux nowadays it may one day port Outlook to Linux, who knows though I have never trusted them and I have not used it for centuries.

Please keep Thunderbird evolving ahead.

Not likely. All MS have done towards Linux have been aimed at Linux on the server/cloud.

Their latest move is about retaining web devs that use Ubuntu LXD for their cloud servers by giving them a desktop development environment within Window that match their cloud environment.

Full blown Linux on desktop, and mobile (hello android), is still under attack.

I depend on Thunderbird and have for many years. It's a great mail client. I hope it continues to be a great mail client.

I do too and I don't know what I would replace it with if it becomes no longer viable.

What other "serious" email clients are out there for Mac?

Airmail[0] is my favorite Mac Email client, really wish it would add support for Android and Windows, but for now it works perfectly on my Mac.

[0]: http://airmailapp.com/

The last time I looked, the most interesting email clients were based on Thunderbird (I looked for Windows clients). Nothing was very compelling though.

It feels like the future of email is either on crappy local clients or very good web clients. If you want something great that runs locally, there's nothing.

Postbox is a pretty great Thunderbird derivative. https://www.postbox-inc.com/

I love Airmail, but require something cross-platform. Postbox isn't as pretty, but is cross platform, priced right, and has great default config out of the box.

I'd recommend against PostBox. It's a Thunderbird derivative, so it has the same security vulnerabilities as Thunderbird does. But it's not updated regularly. The current build of PostBox was last updated in November 2015. It appears to bundle Gecko (Mozilla rendering engine) 7.0.1 which was a part of Firefox/Thunderbird 7 back in 2011. And the only version of Lightning (calendar and tasks) for PostBox is "experimental and unsupported" and was last updated in 2012.

You're better served using Thunderbird and any extensions you'd like to tweak things a bit.

Postbox is not cross platform to Linux.

After a brief flirtation with Outlook Express when I got my first computer in the late 90s, I started using Netscape’s mail client. Over the years since then, I used Seamonkey and briefly played with Eudora before settling on Thunderbird when it came out. I’ve been a very happy user until a few months ago when I decided to try out Mutt, a command-line email client.

It has every feature you could desire in a mail client and a correspondingly steep learning curve. It’s biggest strength is that it is terminal-based so it runs on all Unix-like platforms (including Cygwin on Windows) and requires very few system resources. It’s biggest weakness is that it runs in the terminal so you’re limited to whichever mono-spaced font your terminal application uses.

Steve Losh has written a great HOWTO for OS X users (it’s also very helpful for users of other platforms) to get started: http://stevelosh.com/blog/2012/10/the-homely-mutt/

Me too, since Netscape days, although I also used Outlook Express and Pine a lot.

I can't really stand the webmail clients, other than a quick check at an Internet café, and profit from email aggregation.

Well, it's not like it'll just stop working. I'm still using Alpine, despite the main dev team having abandoned a decade ago.

Keep hard charging on Firefox, Mozilla. If all you have resources and focus for is the browser, then so be it.

Firefox is your iOS -- if you need to gut the Lion team for a year or three in order to ship a stable world-beater, then DO THAT!

Maybe circle back to email in a few years after Firefox stabilizes, that would be cool too.

"Success for Firefox means continued relevance in the mass consumer market as a way for people to access, shape and feel safe across many devices."

Gah! No! It should mean that Firefox continues to be an awesome, customizable web browser! Why does all this wishy-washy "feelings" crap have to creep into their mission statement?

Because that doesn't differentiate Firefox from their competitors. Chrome is an awesome, customizable web browser.

It is, but only so much. There are huge gaps in Chrome's addon library (no streamrippers, for example) and it seems Google is more interested in Chrome as an app platform. Trojan horse design

Firefox started humble, as a lightweight alternative to the Mozilla Suite -- it needs to return to its roots. (As did Chrome, actually, and it too needs to go back to that). Mozilla should focus their innovation on speed and versatility, and not on disgustingly touchy-feely "mass market" feelings. Ew ew ew ew ew.

"feel safe" is not "wishy-washy "feelings" crap". It has all sorts of implications - privacy, security...

Ya, well I'd rather be safe than feel safe.

Yes, it is. Security theater is real.

I think they rolled all of your sentiments up into the word "shape". It kinda makes you want to vomit.

I'm not surprised Thunderbird is breaking off considering how much the Web-only approach to just about every service is in full effect. How do you serve up ads in an email client without pissing everyone off? Obviously you can't do it so Thunderbird has to go!

Also, for most people the email address they have isn't for legitimate correspondence considering how many people use Snap Chat, FB Messenger, WeChat, and the like to keep in contact with people. Why bother making an email client even it's available in the app store (phone) when folks will sooner install an IM app? It's not to say email, conceptually as a form of communication, has no uses. It's just that email as it stands today sorely needs refactoring to include everything from IMs (multimedia based or just pure text) to long form correspondence with varying degrees of confidentiality (encryption) and possibly including some form of file-sharing linking (not so much directly tied into the client/server protocols). I'm not sure the current email server and client protocols can handle such a refactoring without breaking backwards compatibility (therefore pissing off everyone who is still using email). Some email clients do some of the things I'm already suggesting. Some of them do it very well, but honestly am I off the mark on this line of thought? I have to think possibly I am, but I'll leave it to you all to consider.

Can someone here comment on why creating & maintaining a solid local desktop email client is such a costly, moving target, such that it has required an organization the size of Mozilla to pursue it and get it "nearly" right? Is the bulk of Thunderbird maintenance work happening in its "HTML render/js component(s)"? If so, could we stabilize on a Thunderbird without HTML render/js support, providing it only as optional add-on?

Because email is a decades old technology that, thanks to its decentralization and such a wide spread usage, is impossible to improve.

I highly recommend this blog post about a guy trying to make its own email client and failing to do so miserably because emails are such a mess : http://www.slate.com/articles/technology/technology/2015/02/...

Edit: removed the Pocket redirect from the URL.

KDE is not the right place for Thunderbid

http://www.elpauer.org/2016/04/kde-is-not-the-right-place-fo...

Seems to have been deleted?

I guess the main question is who will actually own the Thunderbird license after the split? If the ownership of most of the code remains at Mozilla but Mozilla doesn't care, what would be the motivation of any funded entity to continue the development of Thunderbird?

to create a business model like airmail, but for the android counterpart. It would be cool!

thunderbird used to be a great mail client, but became extremely sluggish and I think it's also bloated. So I moved to claws-mail and mutt, they are lighting fast.

Reply on news.ycombinator.com