oss-sec mailing list archives
Re: Enigmail warning
From: Nick Boyce <nick.boyce () gmail com>
Date: Mon, 18 Aug 2014 18:00:04 +0100
On 18 August 2014 07:22, Henri Salo <henri () nerv fi> wrote:
http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/ Quote from thread below: Enigmail 1.7 is completely broken for my purposes. Steps to reproduce the problem: 1) Write an email in TB. 2) Ensure "Force encryption" in Enigmail. 3) Ensure "Force signing" in Enigmail. 4) Recheck encryption and signing settings... OK. 5) Send the email. 6) Look at the received email. OOPS. It is NOT signed and NOT encrypted.
Um ... I see from the Enigmail "Announcements" forum [1] that some major changes have been made to the package over the last 24 months: specifically a decision was made to replace older C++ code (with maintainability issues) by new pure Javascript code, thus hopefully achieving platform, GPG and TB version independence You can see how that sort of upheaval in the codebase might result in horrible problems like this. [ I switched away from TB to Claws/Kmail some time ago, so this is all news to me, but up till that point the behaviour of TB V3 - 10 and Enigmail 1.0/1 in encrypting my mail was never less than excellent for me. ] More relevantly, the (primary ?) author specifically asked [2] for testers to step up and test the new Javascript version thoroughly "In order to reduce the risk of severe errors in the release versions, I will regularly ask for help in testing after I completed such changes." which leaves me wondering how many stepped up to perform that task. It would be interesting - and maybe alarming - to know. [1] http://sourceforge.net/p/enigmail/forum/announce/ [2] https://www.enigmail.net/list_archive/2012-January/014667.html Nick -- "Bob has a problem requiring secure communication. He decides to use certificates. Now Bob has two problems."
Current thread:
- Enigmail warning Henri Salo (Aug 17)
- Re: Enigmail warning Noel Kuntze (Aug 17)
- Re: Enigmail warning Henri Salo (Aug 17)
- Re: Enigmail warning Pedro Cunha (Aug 18)
- Re: Enigmail warning Henri Salo (Aug 17)
- Re: Enigmail warning Jerome Athias (Aug 18)
- Re: Enigmail warning Nick Boyce (Aug 18)
- RE: Enigmail warning securitylists (Aug 19)
- Re: Enigmail warning Guilherme Andrade (Aug 20)
- RE: Enigmail warning securitylists (Aug 19)
- Re: Enigmail warning cve-assign (Aug 21)
- Re: Enigmail warning Noel Kuntze (Aug 17)