GNU bug report logs - #26102
movemail can't connect mail server

Previous Next

Full log

Message #30 received at 26102 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Eli Zaretskii <eliz <at> gnu.org>, Glenn Morris <rgm <at> gnu.org>
Cc: hengaini2055 <at> qq.com, 26102 <at> debbugs.gnu.org
Subject: Re: bug#26102: movemail can't connect mail server
Date: Wed, 15 Mar 2017 15:48:50 -0700

[Message part 1 (text/plain, inline)]

On 03/15/2017 11:20 AM, Eli Zaretskii wrote:
> I'm against removing features for no good reason.

Sure, but there is a good reason here: Emacs movemail supports only 
unencrypted POP3 connections, which has real security problems in 
typical network environments today. Also, as can be seen earlier in this 
thread, having two 'movemail' commands confuses users and can trip them up.

I take your point that there is a backwards-compatibility argument for 
installing a movemail program that converts mailboxes from system format 
to Emacs format, when GNU Mailutils is not available. However, we should 
not distribute a movemail program that encourages users to read their 
mail unencrypted over a network -- although that may have been OK in the 
1980s when POP support was added to movemail, it's a grave disservice to 
users in typical environments today.

Attached are two proposed patches to try to improve the current 
situation. The first removes unencrypted POP3 support from Emacs 
movemail, as it's a significant security blunder to insist on 
unencrypted network connections these days. The second changes the Emacs 
build procedure so that there is a configure-time option for whether to 
install the substitute 'movemail' program instead of relying on GNU 
Mailutils 'movemail'; the idea is to let distributors decide whether to 
make GNU Mailutils be a prerequisite for reading email in Emacs.

[0001-Drop-POP-from-movemail.patch (application/x-patch, attachment)]

[0002-Emacs-movemail-is-now-a-configure-time-option.patch (application/x-patch, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.