newscracker

> The dealbreaker for me when I tried Thunderbird years ago is that it lacked any way to export the filters you'd set up, so you could copy them to your other computers. Has this been addressed?

It’s been a while since I used Thunderbird and looked at its internal files. But I remember some .dat file inside the profile that stored the filters and could be copied across.

Edit: Found it. The filter rules are in a file called msgFilterRules.dat. This answer and others on super user (from more than 10 years ago) have the details. [1] I’m sure the Thunderbird forums would also have this information.

[1]: http://superuser.com/questions/439451/ddg#439458

> Apple ruined their IMAP client ("Mail") a few years ago

Please elaborate on this point. I’d like to know how it was before and how it is now.

> so now that world is basically Outlook and Thunderbird, and I'm sure I don't need to describe why Outlook is unacceptable.

Please also elaborate on why Outlook is unacceptable. I like hearing different perspectives.

I personally don’t use Outlook and don’t like it because it pushed a lot of non-standard things (for want of a broader and better word), is actually slow and painful to use, and exists to satisfy Microsoft’s agenda to make everything proprietary (AFAIK Outlook365/Microsoft365/Exchange Server by default disables IMAP, SMTP and POP citing those as insecure even though they’re usable with OAuth2).

A bit lazy to search right now and provide links, but Mozilla laid off most of the Servo team members a few years ago. So it’s not really been under Mozilla for all practical purposes. My understanding is that some of that work was, and continues to be, integrated into Gecko. But the momentum of replacing Gecko (a huge endeavor in itself) has been lost.

The only reason I’ve remained on the Dropbox free plan for a decade is because in the early years I was able to boost the free space to 25GB through referrals and contests. I use it as a quick way to sync files and access them from mobile devices (I have separate online backups not dependent on this). I’m not interested in buying yet another cloud storage plan from the major providers just for this.

From this article, it seems like support for macOS Big Sur (and prior releases) will be dropped in the coming months. That plus the dropping of LAN Sync, which was great when it worked, means I’d have to consider dropping Dropbox.

I’ve tried Maestral (https://maestral.app/) once last year and it made a mess of the files while the official Dropbox client was being used by another user (not at the same time). So I switched back to the official client. If there are good clients that would continue to work (don’t know what the Dropbox server side changes are), I could continue using it.

Sounds exactly like a deep bureaucracy at work! How do they even sit and design such systems and who signs off on such designs? It’s as if the company that prides itself for tech has mostly incompetent people with no real world experience or real world information gathering skills.

This loop and a lockout was a nightmare for me. No suspicious IP address or browser changes, but Google would still not let me in. Worse, it asked me to verify with a phone number and after I verified, it still wouldn’t even send any codes to the phone and stopped me from recovering or logging in to the account.

The people who created this useless and draconian account “protection” system seem to have no clue about the real world.

Considering that Authy relies on an SMS OTP for the account creation (and possibly account recovery), I prefer to use something else that provides the benefits of cloud syncing across devices and isn’t tied to a phone number. I understand that SMS OTP is simple for most people to handle (encouraged by many platforms over the years), but I just cannot get past that barrier to choose Authy over something else for personal use.

For comparatively better privacy and lower cost, here are a few services to consider (they offer custom domain support and IMAP access):

Mailbox.org

Runbox.com

Mailfence.com

Migadu.com

If price is not a big concern but privacy is, consider the following:

ProtonMail (supports IMAP on paid plans)

Tutanota (no IMAP support)

Do you use a mail forwarding service along with Posteo, since it doesn’t support custom domains on the service?

OP wants custom domain support, which Posteo explicitly does not support and will not support directly.

Matrix (with the Element client), Wire and Threema are a few options that don't require phone numbers, offer end-to-end encryption and have mobile clients. IIRC, the chats also sync across devices (with some duration limits measured in weeks) on all these platforms.

Here are some that allow custom domains, have IMAP support and are relatively cheap too.

The list below is of the format: Provider name (Hosting Location):

1. Mailbox.org (Germany)

2. Runbox.com (Norway)

3. Mailfence (Belgium)

4. Migadu (France; company is in Switzerland)

5. Inbox.eu (Latvia)

6. Mxroute (USA)

I was glad to note that this is available on iOS too, but it seems like it needs more time to mature and be trustworthy.

The site clearly states that a security audit hasn’t been done and that it’s planned in the future. The makers caution people not to trust it completely at this point, especially in war situations.

> I suppose this is an argument for hosting one's own blog, but I do have a lot on my plate already.

With a little effort, you can do this. Your own domain and NFSN (Nearly Free Speech) [1] for hosting is the combo I’d recommend. You need to handle the blog generation (and/or sFTP) part. You’ll get proper support from humans if there are any issues.

[1]: nearlyfreespeech.net

> "you're using it wrong" from the developers

This kinda response is common with Signal. It won’t even allow backups on iOS and refuses to handle scenarios where one may have a broken device or a lost device (the only way to retain chats and change devices is through a device-to-device transfer when they’re in close proximity; there is no iOS<->Android chat transfer either). Signal seems like it’s meant for chats that don’t have much value, where losing messages isn’t a big deal. But the app, at least on iOS, will never stop pestering you often if you don’t give it access to contacts. Something is broken between the vision for the platform and the implementation.

> And although the attack was formally a success, there is no reason to get scared and stop using Signal.

This conclusion — “no reason to…” — sounds strange and premature. Such attacks may not get older messages, but contacts of the person whose phone number has been used can still message the new device, which the hacker would get and could launch further attacks on the contacts. Since practically almost nobody verifies “safety number” changes, the contacts of the phone number that has been taken over may not realize they’re chatting with someone else. Isn’t that reason enough to be scared? This problem exists for any app that relies on an external identifier, especially one like a phone number that’s easier to take over (including through SIM jacking).

Signal may be secure for specific definitions, but your contacts may not be safe with such takeovers.

This comment is only about Gmail.

Tested practices: Nope. Nobody can tell you that because it's Gmail's secret sauce to handle abuse, spam, disagreeable people, etc. Even if you follow a 20-point protocol to secure your account, there's no guarantee that Gmail won't block it and never allow you to get it back. It doesn't really matter if your email address is not sending spam or not logging in from random IP addresses from different geographies or is always accessed from the same devices and same browsers.

Good practices:

* at the cost of your privacy, connect/link one or more phone numbers to your account so that you can use those for recovery. Gmail values phone numbers more than recovery email addresses.

* setup 2FA with a TOTP app or with the Google app on your smartphone or with a hardware key.

Best practice: Ditch Gmail and use any other paid email provider that provides customer support. Life is too short to suffer through Google's shenanigans and lack of customer support. The more you allow Google to surveil you, the higher the risk that some random event could trigger an opaque ML algorithm to flag your account for some violation and all forms of support will stonewall you with no help whatsoever.

I'm not sure about cheaper, but you could use an email address from another provider without a custom domain. That could be an @fastmail.com (or other domains Fastmail supports) address or an email address from Posteo.de (paid) or Tutanota.com (free/paid) or Mailfence.com (free/paid) or ProtonMail.com (free/paid). The risk of getting locked out is negligible with these providers. Fastmail and Posteo have been around for a very long time and it's not likely they'd shutdown in the next decade or two (giving you plenty of time to re-plan as time passes).

You may change the email address with your domain registrar at any point in time to manage future risks.

My suggestions:

* stick with a (preferably paid) email account on a domain that's not yours but is likely to be around for a long time

* choose one of the common TLDs like .com or .net or .org for the email address (these TLDs have the least likelihood of disappearing or being blocked by anyone)

* make sure you keep the email address active (by logging in and/or paying on time)

JMAP sounded promising several years ago, and it was great to hear it published as a standard. But it seems like it’ll just remain as what Fastmail (the email provider) uses. Maybe the JMAP team is very small and can’t get more people. Maybe Fastmail doesn’t have enough money and/or enough interest to make it easier to use and to evangelize it with major email providers and email client developers.

I don’t see Outlook365 or Gmail (or even Apple for its iCloud email that has a relatively smaller user base) announcing any implementations of JMAP on their services. I don’t see smaller paid email service providers announce support for it. As it stands now, I don’t see a future for JMAP outside of Fastmail.

A popular client like Mozilla Thunderbird still hasn’t started implementing JMAP [1] and one of the reasons is because…the client and server documentation for JMAP haven’t been updated for a few years. [2]

So yeah, JMAP is like IMAP, but not really. We probably need a successor to JMAP that is liked enough to be implemented by email service providers and by email clients.

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1322991

[2]: https://github.com/jmapio/jmap/issues/323

And for this same reason, PDF is quite ill suited for small screens like smartphones or tablets.

I prefer ePub for the reflow of text that adapts to the screen size and allows the user to select fonts and other reading settings (like spacing, justification, etc.).

That’s only for those restricted by DRM. I make sure that I get DRM free copies through some means. Humankind wouldn’t have progressed to where it is now if a strict DRM-like mechanism had been invented a few thousand years ago.

If we separate Richard Stallman the human (with questionable hygiene habits and sexist/abusive behavior) from the ideas and writing of Richard Stallman the staunch free software philosopher and ideologue, I think we’d find that his philosophy has been strong, his thoughts and writings prescient, and his predictions coming true (as if mocking) in a largely comatose and helpless world.

I have learned that every human has (or has had) disgusting and unethical behaviors of different kinds (not that his behavior is to be excused). And with that background, I believe the world would be better off appreciating having Stallman’s work over the decades, rather than ignoring it altogether because of his personal actions and shortcomings.

Speaking only of the Facebook site/app below. FB Messenger is not included.

For a long while, Facebook hasn’t been a platform to connect people or to connect people meaningfully. It’s either useless and random stuff while your close ones’ posts don’t appear on your timeline and vice versa, or sensational posts that cause anger, anxiety, worry, and despair.

The “algorithm” tuned itself quite well to induce and increase addiction. It’s focused. It’s intelligent. It’s purposeful. None of those aspects may help you become happier or more satisfied or more connected.

I don’t think the “algorithm” can be corrected or made better either. It’s too big, too influential, too profitable and likely too complex (due to ML). Short of getting rid of it completely and going back to a chronological feed only from people and pages you follow, nothing can be humanly done about this decline.

Find another platform and focus on smaller groups if you need or value connectedness or relevant/useful content.

> in my mind you have created a single point of failure for _yourself_. I use Authy for MFA

Since Authy requires an SMS verification for setup, now you’ve made yourself vulnerable to SIM jacking. A better approach would be to use a TOTP generator that doesn’t verify you by SMS.

In general, there’s no point in people dissing SMS OTP as insecure and at the same time adopting a service that uses it.

The way IT security has been (mis)handled by firms large and small, it’s just a matter of time till Grammarly announces a system breach and uses corporatese to hide the true impact and what was lost. When companies in highly regulated industries (like finance) get away with hardly any punishment, I’m not sure what kind of actions or threats of actions would even be effective against an unregulated company. Yes, reputation matters, but I’ve seen that cost is the main concern for many companies.

I wouldn’t trust any company with sending every keystroke (almost) to the company’s servers. That’s why on iOS I don’t use any custom keyboards, and even if I try any, I don’t give them “Full Access” (which means it can send the keystrokes over the network).

This is not new or recent, but printers, photocopiers and projectors have always made my life confusing and painful. What should’ve been simple and what could’ve been intuitive has been made hellishly complex and unwieldy. The scene in Office Space showing them smashing a printer and the scene in The Office (US) where Pam is utterly defeated by a new copier [1] aren’t just jokes.

On relatively recent technologies, Bluetooth is unpredictable and finicky across different devices. One cannot effectively carry over one’s learning from one Bluetooth device to another. One cannot predict how a particular new Bluetooth device will work (or not) with one’s existing devices.

And then there are USB-C ports and cables. They all look alike, but you’d never easily know what it supports (which cable is the right one, power delivery, how much power can/will it handle, data transfer speed, is it Thunderbolt, etc.).

I can’t imagine how non-technical people roll the dice with all these and how much they must hate technology.

[1]: Season 5 Episode 19 (“Two Weeks”)

Since several web features are disabled with Lockdown mode enabled, I wonder what measures Apple is planning to implement to defeat (at least to some extent) fingerprinting attempts to detect the people/devices using Lockdown mode while browsing.

> If you can’t stand the impact on performance or image rendering, well, maybe Lockdown isn’t for you. Apple claims only a tiny fraction of users will need it, though I’d argue an awful lot of users will want it.

Of course, I want it! (I already go through many other inconveniences for privacy and security).

> Should You Turn it On?

> Yes. Seriously. Turn it on when you have a supported OS and don’t look back.

Amen! I’ll be telling some laypeople to turn it on and try it out (along with instructions on how to turn it off selectively or completely).

Turn off the phone for how long? And how would one even know if they’re being attacked? Turning off the phone is not an easy option for investigative journalists and activists, especially in today’s world where communicating with people in different geographical locations may be necessary.

Right out of the box, smartphones are more secure than mainstream personal computers (running Windows, macOS or Linux) that are connected to the Internet.

If you’re anyway using Google Drive, you could use Firefox with the Google Container extension [1] to limit Google’s tracking activities across Google tabs to this container. Also install Cookie AutoDelete [2] and let the cookies, cache, local storage, etc., get cleared soon after you close the tabs.

[1]: https://addons.mozilla.org/en-US/firefox/addon/google-contai...

[2]: https://addons.mozilla.org/en-US/firefox/addon/cookie-autode...

You could setup NextDNS (nextdns.io) on it and enable various DNS level filter lists (and manual lists) on your NextDNS account. Each account can have multiple profiles too, which allows you to use different profiles on different devices. This will help block ads and trackers across all apps on your device, not just on the browser.

To augment it further, you could use Firefox Focus (which comes with a built-in content blocker).