Hacker News new | past | comments | ask | show | jobs | submit login
Why Some Security Experts Use Mutt (vice.com)
158 points by secfirstmd on Sept 7, 2015 | hide | past | favorite | 157 comments



I don't know any security experts who do this. I do know a bunch of old-school nerds who use mutt because that's what they got started with.


I don't think people use mutt because of security (other than good PGP support). I think people use mutt because they like the efficiency of a lean, terminal based, email client.


That plus there aren't many good open source (non-web) options.

Thunderbird is pretty bad.


What's wrong with Thunderbird? Note that if you use it as an IMAP client for Gmail, that Gmail's IMAP implementation is -as I understand it- kinda bad, so you're gonna kinda have a bad time.


It's slow, it's bugged (occasionally it just spins up and uses 100% CPU for hours – or until your battery runs out, or you kill it), and most importantly, its keyboard workflow is poor.


> its keyboard workflow is poor.

Try the Nostalgy add-on.


There is nothing wrong with thunderbird, but it's a very different user experience from a terminal-based application.

Side note: I use mutt with gmail imap and have no problem whatsoever. http://wiki.linuxwall.info/doku.php/en:ressources:astuces:mu...


I find that it hasn't really been designed for keyboard-only use. Some features, such as switching folders for instance, seem to require a mouse, or at least I haven't been able to find a shortcut for doing it. It's also kind of hard to avoid accidentally composing html emails - it cannot be disabled completely. I still use thunderbird myself though, as I haven't been able to find a better alternative for Linux. claws-mail comes close, but it does too much work in the ui thread, which grinds everything to a halt whenever it fetches email. Why do mail clients all seem to suck so much, given how much people use email?


To switch folders with the keyboard :

- install Nostalgy addon

- press "g"

- type/select folder name

- profit$


Perfect! That seems to fix the main issues I have with Thunderbird :). Thanks!


For switching folders in Thunderbird: Alt-g-o and select new folder with arrow keys

Composing HTML emails need to be disabled for every account. Never had a problem with it.


That sounds like a lot of work if you have a non-trivial number of folders or labels.

In the end, mutt vs. Thunderbird is pretty much like vim vs. gedit. gedit is far easier to use out of the box, but vim allows you to define your own (complex) commands, allowing you to basically make your own editor.

E.g. I like GMail shortcuts, so I added macros like the following to my muttrc[1]:

    macro index,pager gl "<change-vfolder>?/"
    macro index,pager gi "<change-vfolder>inbox<enter>" "go to the inbox"
    macro index,pager ga "<change-vfolder>archive<enter>" "go to the archive"
For instance, gl immediately gives me a list of vfolders and does the keystrokes to start a search. So, like GMail, I can immediately start typing a name of a folder.

[1] Note: I use mutt-kz


I agree with you here. Further, I'll add that it being 100kloc and not Thunderbird etc tells us nothing about its security. It will have plenty of flaws that show up when hackers decide it's worth the time just maybe less. I do like simple, console apps for all the security tech I can easily use with them. Doubt the mutt users are doing that outside MAC, jails, etc.

But just using mutt is giving up much usability and features with little benefit in security. They're better off using good config and sandboxing with a client that gets more audits and bug fixes.


Honestly, depending on what you're comparing to, i consider mutt a step forward in terms of usability. How long does your search for a specific email take using the Gmail interface? I bet it's longer than using an indexing backend like notmuch or mu locally :)


I generally agree with you (I use a text-based mua myself), but your specific example isn't great. Gmail -- probably rather predictably -- does search as well as or better than anyone in the world, including your local installation of mu. In Gmail specifically, it's instant.


I find the Gmail interface slows down dramatically when i'm in the train without an internet connection. Mu, on the other hand, keeps on trucking.

/s :)


If anyone wants to compare, I just searched my gmail for a project I did back in 2008. It took ~400 ms retrieve and render the search results.


I just tried a search in Gmail. Took a fraction of a second. I tried one in Claws email client which pulls local copies of the emails. Happened instantly as you predicted. Caching speeds up search indeed. Now, what does a fraction of a second improvement on search have to do with security and usability of email? That would have very little impact on my choice of email client.


You're right about it being irrelevant to security. Somewhere else in this thread i pointed out that this isn't a motivation for me, so i agree with you there. The only reason i bring up search speed is to rebut the assertion elsewhere in the thread that my email client is a step backwards in usability/features.

For me, the advantages are: works all over (e.g., i can find out my buddy's apartment address from an email in 2008 even if i'm nowhere near wifi), it's snappy, keyboard-driven (like, really -- Google Mail with their cute mnemonics or Thunderbird with shortcuts don't count), text-only (because i'm a nerd, and perhaps you could argue vague hand-wavey security stuff here), and because i can Elisp my way out of sticky situations. Especially the Elisp.

On that last point, you might well contend that if i used an email client to your liking i wouldn't need to Elisp my way out of anything, but i think that's beside the point. For the first time in years (i've been using mu4e for a year now, and before that mutt, starting 2006) i've actually been able to make my client do exactly what i want using a real programming language -- certain formatting hacks, PGP to certain people in certain circumstances, email address completion the way i want it, etc.

But anyway, it's probably not for everyone :). There's also no such thing as a "best" email client, probably -- i'm just partial to the create-your-own-MUA kit that i've found in mu4e :).

This is waaaay off-topic though, i'm not even talking about mutt any more. Sorry, i got a little carried away :).


Oh, it's OK: it was an interesting comment and relevant to why people still use things like this. Keyboard-driven, works in low bandwidth, and hackable are definite advantages. I could see geeks (even me) enjoying something like that. I also agree that the "best" client is relative to the needs of the user.


I still use mutt (and default to text), but I don't see anyone else doing this, even in my geek coworkers or friends. So I'm a bit surprised by this article.

I use mutt because it's very very fast, and quite customizable (I maintain a kind of 0-inbox through a set of hotkeys, + spamassin + procmail). To handle numerous mailing-lists with medium volume, it's so far the best I've seen.

I tried many email clients (on Windows, OSX and Linux), but I always come back to mutt, because it's the fastest to handle the high-volume of email I have...


I've been using mutt exlusively for many years, and I got a fair amount of flack for it every now and then. While I like to believe that it's more secure than any full-featured bloated mail-client (hello Thunderbird), my reason for using mutt is simpler. I like the speed, efficiency and customization aspects of mutts, plus being able to use vim to compose my mails. Quite frankly, I don't get how people rave about text editors but then fail to include them in their mail workflow, which is where people spend quite a bit of time nowadays.

The other reason I like mutt is because it still conforms to the UNIX principle: One thing and one thing well. True, you could use mutt for SMTP/IMAP, but there are better tools for that. I use mutt with offlineimap, msmtp and mu (for searching).


Same here. I can sort through 300 emails in a few minutes, removing/organizing the cruft into folders, and keeping only a handful of them I need to reply to.

That, plus excellent PGP support, just makes mutt a much better email client that any other existing ones, local or web.


I'm also a mutt user. Love being able to edit documents with Vim, stable PGP support, and the mnemonic hot keys. However, I wish I knew more (or could remember more) about how it works...and I can't seem to get folders to synchronize properly from `offlineimap` (though `procmail` lets me search my mail rather easily).


Subscribe to LKML or one of the subsystem mailing lists (e.g. dri-devel). Pretty much the majority of Linux kernel developers seem to be using Mutt. (Disclosure: Me too, since 1997 in fact when I needed to replace ELM.)


Great article on getting started with Mutt on OS X: http://stevelosh.com/blog/2012/10/the-homely-mutt/


Most "Security Experts" are working for consultancy, tech firms, and government agencies so they probably use plenty of other clients. The majority will probably run Outlook since Exchange is the defacto mail-server standard for any organization (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born), the rest will probably use Gmail or any other web-based mail that their smaller company is using. Most "experts" don't necessarily follow their own advice just as alcohol, drug use and smoking is more common in Doctors than any other diploma based profession out there, so can security "experts" run just as much as a shitty setup as everyone else and think that slightly better common sense and opsec will keep them safe which more often than not it would.


You can use mutt with Exchange servers and Gmail servers


I think the idea is that a security professional should use, on a regular basis, multiple email clients.

It's a funny trick of the english language that when we say someone uses an email client, it comes across as an exclusive use. We need an explicit patch.


Do you wind up with plaintext emails that look gross when opened in Outlook?


It is HTML emails that are gross, not plain text.


Not necessarily for the Outlook users. The default setting of my Outlook was to ignore double line breaks and (paragraphs), which makes plain text mails less readable.


Same for me, I cannot think of the use case for this - maybe it was introduced in the embrace/extend/extinguish era to nudge people into using Rich Text format emails?


It is Outlook that is gross.


Unfortunately, sometimes in the real world we don't all get to always choose our own tools.


Sure, but you still shouldn't blame plain text for Outlook's failures.


I didn't lay blame at all. I just asked: "Do you wind up with plaintext emails that look gross when opened in Outlook?"

My presumption, based on your defensiveness/evasiveness, is that the answer is "yes."


Fine, but Outlook does not make plain text emails look nice.


Mutt and Exchange? Bliss! Would you happen to have a doc link handy?


Mutt doesn't support retrieving mail very well, but you can use sync programs (getmail, offlineimap, isync, exchange2mbox) to create local mailboxes and make mutt use the local mailbox directory instead.

you can send email using external programs (local smtp server and openxchange for exchange).

Mutt is not a traditional mail client, it is more of a glue between multiple programs so you can have one interface for all of your emails need.


If Mutt is not a traditional mail client, then what is? heirloom-mailx?

I read my mail with less. That's a nontraditional mail client.


"I read my mail with less."

How? Sounds like you just grep your way through the mailbox?


Yes.


When I first started in the industry my colleagues told me that I should be using the read-mail program. It has a mode that allows you to use regexps to read your mail really fast. I was told that the normal way to run read-mail with the "really fast" mode was:

rm -rf *

Disclaimer: For the Unix impaired, this is an "expert only" utility. I am not responsible for the loss of all the files in your home directory should you attempt to use it.


Do NOT suggest people try a command which will recursively remove all files ignoring file permissions. Most people will be aware of the hazard. Those who aren't will suffer irreparable harm.


Be careful with which Exchange servers you try offlineimap with. There was a severely bad interaction in Exchange with how offlineimap operates. Exchange used a global database with a small limit (I want to say 2^16) for unique message headers. Offlineimap injected unique headers for synchronization purposes. This quickly led to resource exhaustion and essentially blocked the server.


each email is supposed to have a globally unique Message-Id header, offlineimap or not.


No, this was a unique header name, X-offlineimap-????; not a value. My understanding is the DB table was a list of unique header names.


I'm not sure about builtin support but there is always davmail (http://davmail.sourceforge.net/) for exchange


IIRC Exchange does offer IMAP and SMTP...


Exchange has supported IMAP, MAPI, POP, and SMTP for at least a decade.

In large implementations (such as Exchange Online in Office365) they may not support some of those services. IMAP can be very resource intensive and bog down a CAS or storage server.


Exchange server sometimes choose to not provide smtp which is a pain. Their IMAP support is sometimes lacking too (i.e. imap-mail.outlook.com times out alot).


Off-topic:

> [...] just as alcohol, drug use and smoking is more common in Doctors than any other diploma based profession out there [...]

What I could find with a quick search pointed in the other direction. Do you have some evidence?


I can attest to that. When my sister was in med school (in Switzerland), I got to see just how much this is true.


> (that isn't tied to Lotus because 45 years ago the CEO had to sacrifice a goat to appease IBM to spare his 1st born)

Those blood magic spells seem to be wearing off hard in the last year or so. I've been seeing a huge number of our customers migrate from the Lotus stack to Office365. Of course, IBM has already put their software divisions out in the back yard, and are popping the cartridges into their rifle to put the old girl down.


Even IBM is moving off Notes for email. It remains to be seen if the "cloud" replacement is an improvement.


Lawyers have higher rates of alcoholism by far.


Security Experts... let me quote Linus Torvalds: "the security community tends to be very black and white. Either it's security or it's not. And if it is security, they care deeply. And if it is not, they don't care."

So who cares if you write your email in text mode but browse the web with Chrome/Firefox? No offense against Mutt... I can understand that some terminal pros like it but I cannot understand using it for security sake. So what happens if you want to view a html email? What about mail on a mobile phone (I guess security experts do not use them)?

And mutt has other attack surface because it is using the terminal. Look here for a Ubuntu security notice about mutt: http://www.ubuntu.com/usn/usn-2440-1/ Now I smile because gmail is not affected by that!

This is all not practical for 99,9% of normal users out there.

If you care about security do not let the paranoia control you. We need to improve security for the normal users out there. Just my opinion.


You can read html emails in mutt with decent support, using "links" or a somilar app. Mutt let's you define application that generate dumps for a given MIME type.

See: https://www.debian-administration.org/article/75/Reading_HTM...


I used to use mutt (now i use mu4e) and indeed i do not own a mobile phone capable of more than GSM. Also, as mentioned elsewhere, HTML rendering works fine in mutt and mu4e (although perhaps this opens me up to various nefarious things).

I don't do this because i'm a security expert (i'm not), i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard.

EDIT: Oh yeah, and i'd never trust my web browser with my PGP key...


> i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard.

The trouble is that most people who say this end up doing 6 things that take 200 ms each (with the keyboard) instead of 1 thing that takes 1 second (with the mouse), and feel like they're zooming along in hyperspace. You feel like a leet hacker, but are you really getting anything done more efficiently?


> are you really getting anything done more efficiently?

Maybe not, but is that 200ms improvement when using the mouse really worth it if i get all warm and fuzzy-feeling by being able to type something? :p Intangible benefits, yo.

More seriously though, i also feel (personally -- maybe i'm an outlier) like switching from keyboard to mouse and back is a bit of a performance hit, so i tend to concentrate my workflow around the keyboard as much as possible. And yeah, maybe (99% certainly!) i'm not the leetest or fastest h4x0r out there, but at least i'm enjoying myself :).

(i would be curious about an actual test case though -- maybe someone could design a few common tasks to complete using one's favourite HID and compare!)


> What about mail on a mobile phone (I guess security experts do not use them)?

Just to note that I'm not a security expert, but I never check email on my phone. Just don't need to.

Whilst I realise mobile devices are very popular, there are a lot of people who don't require checking email when they're not at a desk.


> So who cares if you write your email in text mode but browse the web with Chrome/Firefox?

On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim.

Now try that with a privately owned and administered server.


You think the US government doesn't have full access to your private server? If it's located within the US they have full physical access. If it's located outside the US it's a valid target for all the TLAs.

If the government is on your list of threats you need a lot more than "private mail server".


> If it's located within the US they have full physical access.

If I were to live in the US, I would know when my server went missing. With Google or other cloud-providers they can do it behind your back.

> If it's located outside the US it's a valid target for all the TLAs.

And then can't seize it. It's physically secure. It may not be bullet-proof security-wise (what is?) but they can't rubber-stamp their way into it.

And for some people that's quite an important aspect.


Amen, this whole "if it's not 100% secure why bother" argument is annoying, we can still make it hard for them.

We can, and we definitely should.


It makes it easier for them.


what does? housing mail outside the US? outside of their partner companies or previously breached companies (in the case of google).

I mean, if you have a remote server- it's lawful for them to snoop (by their own law), but it certainly makes it harder, to gain access and maintain access- as these systems may be wildly different and hosts will be varying degrees of paranoid.


With tremendous respect to Linus, this isn't a fair characterization of the "security community", whatever that means. There are both practitioners and vendors who take the view that security should enable business, not block it; there are groups of experts who run contrary to this, and believe in a reductive and restrictive approach to everything. The continuum of thought around what it means to be secure, especially when dealing with organizational security, seems to be shifting towards the former, rather than the latter.

As far as Linus' statements go, saying that security is imperfect by design isn't a new take on it, and I'm in complete agreement with you that it needs to be something that regular users can benefit from.


I use mu4e[1] to read, search and refile my emails, and there's a keyboard shortcut for viewing an HTML email in a browser. offlineimap[2] handles inbound messages. I love it!

But for writing email, I still tend to jump over to Apple Mail. msmtp[3] handles outbound messages on those occasions when I choose to fire off a message from within mu4e.

[1] http://www.djcbsoftware.nl/code/mu/mu4e.html

[&] https://github.com/djcb/mu

[2] https://github.com/OfflineIMAP/offlineimap

[3] http://msmtp.sourceforge.net/


I used mutt when I used vim, but after switching to emacs, I began using mu4e. Very keyboard-driven and scriptable. Glad to see others on HN using it.

Speaking to your not using mu4e to compose mail, I compose mail in org-mode (I often make lists in emails) then copy them into an mu4e buffer. Funny to see someone using uncommon software the same way I do.


I also use mu4e, and i'm curious, why do you switch to Mail.app for composing? I love the fact that all my editor customisations (of which there are many) are still there when i'm writing email.


To each their own, obviously, but this does seem profoundly weird. I can't imagine anyone choosing an Emacs-based mua and not using the editing ability for composing mail.


I've been using Apple Mail since the OS X Public Beta in 2000. Its address completion and rich text support are entwined in how I think about authoring emails, so I'm simply more comfortable using it for that purpose. It also helps that Emacs-style movement keys work throughout OS X, including Apple Mail's "new message" windows.

I did give mu4e a go, i.e. for writing emails, and I never got to a point where it really appealed to me. I do love it, though, for reading and managing my tens of thousands of email messages. It's also nice that I can easily create links to messages in mu4e, which I can include in my org-mode files.


I've used mutt for ages, but a couple of years ago I switched to Karel Zak's mutt-kz branch (https://github.com/karelzak/mutt-kz), which integrates notmuch into mutt. The setup is a little fussy (although well documented), but the results are spectacular. Mutt's search was never horrible but with notmuch its nutty fast, and the tagging feature makes dealing with search and mailing lists very convenient.


You can use mairix as a search system outside of mutt. Results are a temporary mailbox.


notmuch can generate temporary maildirs as well with this script:

http://git.notmuchmail.org/git/notmuch/blob_plain/HEAD:/cont...

However, in my experience mutt-kz is much faster. Plus, you get tagging everywhere (if you use it) and threads can be reconstructed across folders (helpful when your own mails are in a 'Sent' folder).


As I'm a emacs person, I tried once wanderlust[1] and got hooked up to it. Wanderlust is mail client which supports a wide variety of protocols. For me the biggest advantages are the blazing fast IMAP support and the whole emacs thing (Keybindings, Help (C-h b for all keybindings in this buffer, priceless I have to say), the possibility to run it either in GUI or in a terminal, etc). Recently the devs uploaded it to melpa[2] which makes it even more easy to get started. I would definitly recommend it, to people who are already using emacs, its such a joy!

[1] https://github.com/wanderlust/wanderlust

[2] http://melpa.org/#/wanderlust


Another Emacs person here. I'm using offlineimap+msmtp together with mu4e. I prefer not to do IMAP sync or mail delivery in Emacs itself.


I do the same, except I use emacs build-in SMTP (smtpmail) directly. I'm quite happy with it :). What is the advantage of msmtp?


Have you tried isync? I was using offlineimap before, but found it buggy and inefficient.


Currently using isync for those exact reasons. Only issue that I have with it is that it doesn't support nested folders.


What are the bugs you are referring to? I have been using it for a few weeks for a couple of mail accounts without trouble so far. It could probably be faster though (customizing 'maxconnections' does help).


It never reliably functioned as a daemon for me. It would just stop checking for messages randomly after an hour or two. And if you give up on it being a daemon, then it's horrifically slow because it's doing full syncs all the time.

I ended up having a script running out of cron that would kill and restart the daemon process every 30 minutes so that I could get reasonably fast incrememntal updates but still have it continue to work properly.

And then it started losing track of what the server looks like. If you delete a label on the Gmail side, then of course offlineimap wants to recreate it. For a little while, it was tolerable to stop offlineimap, delete all the local metadata for a folder, go delete the folder from Gmail, and then restart offlineimap, but eventually that stopped working too, and it was recreating deleted folders on the server that I never managed to find a reason for.

isync just worked exactly how I wanted to after spending a bit of time setting it up, and it's been pretty solid since then.


There are several slightly less hardcore alternatives to Mutt for those wanting a more modern e-mail experience without the security baggage of running an entire browser. Sylpheed for instance is a very pleasant text-only MUA (http://sylpheed.sraoss.jp/en/). For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access.


Text-only? I could have sworn sylpheed was a GUI program.


For added peace of mind it does not take long to write an AppArmor profile to further confine Sylpheed to just the parts of your filesystem you'd like it to be able to access.

Do you have an example? Sounds like a pretty awesome setup that you should share.


I will see if I can get it tidied up enough I'd be comfortable sharing :)


Thunderbird has, or had, a plain text mode and a "Simple HTML" mode (other than only recognizing a subset of HTML, I don't know what it does) for displaying messages. You can leave it in plain text mode and, in the event you really need to view HTML, switch it to "Simple" or full HTML. It also can block remote images and, I think, all JavaScript.

The wonderful Nostalgy add-on provides a very responsive keyboard interface.

https://addons.mozilla.org/en-US/thunderbird/addon/nostalgy/

I don't know if current Thunderbird versions include all that, however.


I use Thunderbird and keep it set as text only for sending and remote images loading is disabled by default (as it should be). JavaScript in emails is not loaded or run.


Thanks.

> I use Thunderbird and keep it set as text only for sending

Is that an option for viewing messages? That's where the security risk mostly exists.


View - Message Body As - and then your options are Original HTML, Simple HTML, and plaintext.

Loading of external images is fully disabled by default. You can enable it per-email by clicking as well as per-sender (which I don't personally do or recommend).

Showing as text is mostly unnecessary, though, as Thunderbird does not allow Javascript or any plugins within messages. As a result, the attack surface is significantly reduced compared to a browser as most browser-based attacks are via Flash, PDF, Java, Javascript, etc in decreasing order of popularity. That wipes out the vulnerabilities used in the vast majority of attacks right off the bat. Thunderbird uses the Gecko engine underneath which is up to date and version tied to Firefox ESR, so the engine gets security updates basically same-day as Firefox itself, which is another big point in its favor.


thunderbird is love, thunderbird is life


I'm not sure I buy the reasoning on "surface area", at least not the specific comparisons in the article. It seems unfair to count Chrome but not Unix. For that matter, shouldn't we count the surface area of everything that touches the email as it hops around, including routers, etc? And isn't that the whole problem with email that the protocol does not require secure transport? So, seems like the only way to make that even vaguely secure is to use PGP (or something) on top, in which case who cares about mutt...


Right.

"Let's switch from an email client written in a safe high level language that's also running inside multiple sandboxes and which has a full time security team (e.g. gmail) to ...... a mail client written in C"

Doesn't seem like a great approach.


(Preemptive N.B.—I'm far from an expert, but I'm very interested in seeing this aspect of the topic discussed further by folks who might be experts.)

Isn't the general premise here that one can choose to package up any program in as many deeply nested (virtual or physical) sandboxes as one would like, but there's an inherent benefit to the piece of software inside all those boxes exposing to one's adversary as few avenues as possible to attempt to escape them (specifically as it pertains to people in the business of painting targets on their backs e.g. Soghoian)?

Put another way, of course Gmail and Chrome have dedicated security teams, but they won't ever have prevent $GIVEN_INFOSEC_RESEARCHER's box from getting owned teams.


C is not too bad in this situation. If you implement DEP + ASLR correctly and do not give the attacker access to an interpreter (javascript/fonts/xslt/etc) then it is quite difficult (impossible except for luck?) for an offline attacker to gain code execution. You need to leak information about the programs memory layout in order to bypass DEP but how do you do that with an email?

The best vector is probably taking control of the IMAP/POP server Mutt is connecting to and finding a vuln that will leak an address back to the server and another vuln that will take control over the instruction pointer.

Or alternatively hope there is some broken shell command injection lurking in Mutt.


You want to reduce the "surface area" of your email client so that the act of viewing an email doesn't own your system. It has nothing to wo dith the privacy of your email.


Another reason is that it spawns a text editor. Typing emails in a text widget without proper editing capabilities can be irritating.


I'm rapidly returning to mutt from gmail because the new gmail compose widget is so bloody awful. I use Firefox-Aurora and the compose widget is sluggish, buggy, and the faux-window manager is a terrible paradigm. I'm fairly sure this isn't my aging brain calcifying on me and turning me into "grrr, I hate change": messages not sending when requested (or sending twice), line breaks not rendering, and a generally unresponsive UI.

As a bonus, I can start toying with GPG for real now (for all of my friends and family that will never use GPG?).


In Firefox, you can use It's All Text! to edit the current text area in a proper editor.

https://addons.mozilla.org/en-us/firefox/addon/its-all-text/


That works less and less as more websites offer "improved" text editing capabilities through javascript.


Pentadactyl also allows you to edit input fields with any editor (and many other things):

http://5digits.org/nightlies

Same goes for vimperator, of which Pentadactyl is a fork.


Copy+paste? It's rare that I write an email that's more than a couple of paragraphs, but when I need to, it only takes a second to copy the text over from a real editor.


Thunderbird and, I think, Kmail allow you to specify an external editor (probably vim, Emacs users would use something inside Emacs)


The title carries sarcasm as soon as you finish the article half-way.

I totally agree that usability is damn important. One reason I stopped using Ubuntu Desktop version is exactly the poor usability of Unity, and I now prefer headless (and if I ever need browser I'd use X-windows).

For email client I either use Thunderbird, or Outlook 2013, simply because graphical interface is easier to work with. I code using VIM and I do a lot of work from terminal, but I can't image myself learning all the tricks like dragging image, setting up a meeting, viewing people's availability the next day all via terminal screen. Doable but I still think graphical interface has advantage. The thing I dislike about email clients like Outlook is their WYSIWYG editor as sometimes the editor is limited, or too aggressive. But since my job involves a lot of communication, I do need the convenience of WYSIWYG and COPY-PASTE. What a struggle.


I'd prefer things that need formatting be an attachment such as rtf or pdf leaving the email in plain text. There is no reason why personally written email needs rich text.


I use outlook at my work for email and its not uncommon to send screenshots and similar.

A common workflow for me is to hit print screen paste into the message compose window, crop the image and super impose annotations onto it using the office drawing tools (circle, arrows, text box etc).

I also like the integration with Communicator and calendar, Having notification about when people are online in meetings and which building they are in (my work has multiple sites) is handy. I don't usually like Microsoft products but Outlook is pretty solid in my opinion. The only alternative I've really seen is Lotus Notes.


Does that really crop the image, or just hide parts of it? I ask because cropping in Word can be undone by another recipient.


Do you apply an extreme minimalist styling to other areas of your daily life - like "there's no need to clothes to be any other colour than gray"? or "there's no need for food to have a flavour as long as it's nutritious".

Genuine question.

Most people use some form of flourish even in handwriting - an underline, all-caps, increased letter size or spacing, a personally preferred colour; isn't it weird to not have the facility for that in email?


I looked down and I am indeed wearing a plain grey t-shirt. I wouldn't tell people to not wear anything other than gray though. I wouldn't tell people to not eat food and switch to soylent completely. I'm sorry if I appeared to push my viewpoint. That was not my intention. I apologize for my lack of communication skills. I was merely expressing a personal preference.

I just wonder why documents that need rich text formatting can't be sent as an attachment instead.


I don't know about you, but I write a lot of emails, and I write very long emails, usually to technical people, and believe or not, they don't read everything and they have TL;DR mentality (I don't, I read every word). I also deal with business users in my role, and rich text formatting improves reading when rich text is used appropriately. Compile PDF and upload is just another burden, and sometimes I forget to forward / reply with the attachment there. Wait I want to show table directly on my email (not ascii kind).. that can't be done if you are plaintext.

I don't remember if Gmail's integration with Google Docs actually suppose to make links available during reply/forward...


Don't MUA handle sending both plaintext and HTML well enough? Thunderbird seems to cope with that at least.

I think there is a tendency for minimalists to feel that others should conform to[wards] their ideal, whilst there are many aesthetics and there doesn't appear to be a logical reason to choose one above another [in the general case] - one man's cluttered is another's functional, or whatever.

Way back in KDE3 days I was looking for a MUA to move to from Opera Mail and was auditioning KMail, the devs insisted that the display should not be allowed to handle sending HTML emails as a matter of principle. Since then it's been a bit of a touchy subject for me ...


It should also be all caps. There is no reason why personally written email needs two cases.


It's pretty easy to install other desktop environments on Ubuntu. I run with xfce because I just need a taskbar to keep track of my terminal windows.


Why bother with the desktop environment at all in that case? You could just install a window manager (I like Openbox but you may prefer a tiling wm) and xfce4-panel, which works pretty well standalone. This has been my setup for years now :).


Good point. But what is a desktop environment anyway (one could argue that you made your own)? For example, Lxde already uses Openbox, yet Openbox is not just the "WM for LXDE".


Usually, desktop environments come with a lot of software, like a graphical file browser, games, something to display the content of a directory on the wallpaper (the "Desktop" itself), etc. that I don't need, so I prefer to install only what I need (and concerning graphical software, that is only openbox, xfce4-panel, emacs, rxvt-unicode, inkscape, gimp, and iceweasel).

But in a sens you are right, it's like I composed my own minimal desktop environment :).


Have you tried a tiling wm? I use i3, it's great :-)


I have tried one but the learning curve was too steep for my net productivity to recover.


Claws (and sylpheed, which it is a fork of) is by default text-only (html rendering only through a plugin). I used to use just mutt, but use claws quite a bit now.


My graphical client of choice. Lightweight, quick, and relatively easy to box in. Didn't play with Gmail so nicely so I access it a different way. Works with other accounts fine.


I don't use mutt anymore, but I still feel it's a beautiful client, both in its simplicity and its appearance (take the screenshot from the article, for example). I probably should start using it again since I'm transitioning away from Gmail to a traditional mail host.


I use Alpine instead; tried mutt first, but found it abstruse to set up.


Yeah, I'm biased towards (Al)pine, would be interesting to know how does Mutt compares with it


I started with Pine, and used mutt for a bit later. Mutt is ok, if you invest the time in learning it. (If you can handle vim, you can cope with mutt.)


Interesting. I've been using (al)pine for years, and there are bits of it which really frustrate me - mostly how slow it is when dealing with large mailboxes - so i have been considering a move to mutt for a while. I'm not a vim fan, so i might have to reconsider!


Oh, the specific keystrokes etc are not the same. (I don't think they even have the concept of modes in mutt.)

It's more of a spiritual similarity. About as faint as vim / nethack.


The sup email client is another good option. Text mode like mutt but threads emails like gmail http://supmua.org/


I do use mutt as my principal e-mail client. It started as an experiment, now I fully transitioned to it. I enjoy being able to compose messages in vim and the tight integration with gpg. In case you want to try mutt out, some time ago I wrote a short guide about setting up mutt on osx,

http://www.lucianofiandesio.com/getting-started-with-mutt-on...


I still use mh (well, nmh now) programs for my personal email. There is nothing that beats mh's "pick" program for selecting emails.


Does imap figure anywhere in your mix?


Nope! I forward mail from various other email addresses to my email address where I care.


I <3 nmh.



I used to use Mutt, but these days I do over 75% of my mail reading on a phone, and on a phone Mutt is a non-starter.


I have used it from a phone with a terminal emulator over ssh (all of my phones have had keyboards). It was impressive to see how the keyboard supported mapping swipe gestures to cursor movement keys so that I could swipe up and down in my mutt message listings.


What's the best QWERTY-keyboard phone now?


You would have to use an ancient modem or just sync emails by serial cable/irda, but the Psion 5MX was about the pinnacle of portable content creation hardware, IMO. With it you can write emails or whole books if you wish. Some prefer the 3 series, but not necessarily for the keyboard. 25-40hr battery life on 2 AAs, insta-on operation, CF card transfer of files - no wonder people are still using them.

Now that people are not as fixated on having colour screens, being primed to now accept e-ink style displays, is there a chance we could get a similar device with more modern specs? I think I'd still rather work from a palmtop than a laptop or phone when not at a 'workstation'.

I used an N900 for a long time (relatively speaking) and found its keyboard to be solid, but not in a way that could make writing or emailing tasks more productive.


It does look pretty awesome, but I can't find anybody selling Psions here in Buenos Aires, and it seems like they might lack something in the camera, GPS, 3-D modeling, and audio department. Like, I recorded a beatboxer at a public gathering today on my Android phone, and more than once I've sketched things on paper and photographed them with it, quite aside from other creative uses for photography.


> A quarter of a century ago, checking your email meant logging onto a mainframe

The lead in seems incorrect. Pine wasn't publicly released until 1992. By the early 90s many college and university environments were thin clients or unix workstations connecting to unix servers.


Popular mail clients such as Thunderbird and Outlook are underattack so the "Security experts" use lesser known clients. I do believe GPG should have been mentioned more besides the Enigmail mention since we are talking about security.


I've used mutt since '98 or so, and see no reason to change. For HTML email I can either pipe it into lynx or bounce it to Gmail.


Wish it was more user friendly and ran well on Windows (yes, I'm that guy). A good example of something that is user friendly, fast, secure and runs almost everywhere is the messaging client Telegram. Would be great if there were more programs like it.


I think we're past the point of apologizing for using Windows. I just switched back after 5 years on Ubuntu and have been thrilled how things just work.


> Wish [mutt] was more user friendly and ran well on Windows...

I would be shocked if Cygwin's mutt port didn't run just as well on Windows as it did on Linux. Remember that UNIX software that you compile with Cygwin becomes a native Windows executable.


Software you compile with Cygwin's GCC becomes a native Cygwin executable, with its own concepts of paths, processes, symlinks and environment. All binaries compiled with Cygwin always inherit GPL virality. The Cygwin OS is coincidentally hosted on Windows and mostly plays nice with it.

Software you compile with Mingw(-w64)'s GCC becomes a native Windows executable.


AFAICT, Unix software that you compile with Cygwin's tools understands both Unix paths and Windows style paths. [0]

It also understands Windows environment variables. [1]

Cygwin is aware of Windows processes. [2]

Cygwin is aware of the Windows registry. [3]

The executables that are created by the default Cygwin build process are PE executables that have a dependency on the Cygwin DLLs and run on any Windows system. They are native Windows software, with a dependency on a third-party DLL.

If you build open-source software against the Cygwin libraries, that software can be distributed under its original license. If you modify the Cygwin build process to produce executables that do not depend on the Cygwin libraries, then you can distribute that software under any licence you like. Regardless, if you have cash you can always reach alternative licensing terms if you reach out to Red Hat. [4]

Cygwin symlinks don't make use of NTFS junction points, but I imagine that that is for two reasons:

1) Cygwin might be run on a FAT32 system.

2) There are many, many, many pieces of Windows software (some of it is big name software!) out there that blow up spectacularly when they encounter a Junction Point. (Indeed, it was my direct experience that Windows Explorer behaved very poorly when asked to recursively delete a folder containing a couple of Junction Points in -I think- pre-SP1 Windows 7. I haven't tried JPs in AGES, so I can't speak to whether or not MSFTs own tooling has gotten better.)

At a minimum, software compiled against Cygwin meets the most basic definition of Windows software (A PE executable that runs on Windows systems). I hope that I have made it clear that the Cygwin libraries also provide a large amount of interoperability between Unix software and software originally written for Windows.

[0] Try it out. Fire up a Cygwin Bash shell and do the following (assuming that you're running on an English-language Windows):

echo "hello there" > "$USERPROFILE\Desktop\helloThere.txt"

then check the new file on your desktop. rm works just fine, too. Forward slashes work in paths, also!

[1] Try this out in a Cygwin bash shell:

echo $APPDATA ; echo $LOCALAPPDATA ; echo $SYSTEMROOT

[2] Again, in a cygwin bash shell do:

ps -W

[3] Do (in a Cygwin bash shell):

ls /proc/registry/

[4] https://cygwin.com/licensing.html


I was going to suggest this. It does.


Reminds me on the inverse question I replied to from a few weeks ago: "Ask HN: Someone still using Thunderbird for Gmail in 2015?" https://news.ycombinator.com/item?id=10026641

To be honest, I never thought about the possible weakness of the html rendering in most clients. But then I am more concerned about my privacy than security.


How can you have pricacy without security?


I use mutt because after you learn of its power, other mail clients reveal themselves to be toys. I keep all my active correspondence in my inbox (5773 messages at the moment). With a few keystrokes I can instantly create a subset of my inbox optimized for the task at hand. (People who use toys instead of mutt often advocate an "inbox zero" approach, I understand.)


You can do the same two things with gmail.

(There are lots of things mutt does that gmail doesn't, of course.)


What two things?

I'm not an expert on Gmail's keyboard interface. How, for example, can I see all the messages from Joe Zwanizol that are more than 15 days but less than 60 days old, using only the keyboard, in five seconds?


> What two things?

The two things mentioned: quickly-customized inboxes (via search) and handling lots of emails.

> How, for example, can I see all the messages from Joe Zwanizol that are more than 15 days but less than 60 days old, using only the keyboard, in five seconds?

There's a search syntax for that. Not sure whether you'll type it out in five seconds.

A browser extension to bring mutt keyboard interface to gmail might be useful for some folk.


After looking for it I found the search syntax, so it would seem that something like this is possible, as you say. But it's not as expressive as mutt's pattern language, so would be clunkier to use. But it is there.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: