13 Jul
2015
13 Jul
'15
9:16 a.m.
Hi.
Has anyone got any recommendations for webmail software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched, so I'm looking for
something new. Ideally whatever software would be good for the security
obsessed (so eg not php[1]).
[1] no php arguments please. I just don't trust it. I know you've had
massive success and your favourite huge website uses it fine.
13 Jul
13 Jul
10:39 a.m.
mån 2015-07-13 klockan 10:16 +0100 skrev Michael Stevens:
Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched,
...
Assuming weak TLS support is your only problem with prayer, why not
simply put a proxy in front, and let that proxy do the TLS termination?
// Andreas
10:42 a.m.
On Mon, Jul 13, 2015 at 12:39:51PM +0200, Andreas Olsson wrote:
mån 2015-07-13 klockan 10:16 +0100 skrev Michael
Stevens:
It's an option, but I'd also like to upgrade to something with a less
1990s UI. It's more of a last straw.
Michael
Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched,
...
Assuming weak TLS support is your only problem with prayer, why not
simply put a proxy in front, and let that proxy do the TLS termination? 
11:10 a.m.
On 13/07/15 11:42, Michael Stevens wrote:
On Mon, Jul 13, 2015 at 12:39:51PM +0200, Andreas
Olsson wrote:
The problem with Prayer appears to be with the configuration of the web
server on which it runs rather than the software itself. This is an MitM
(Man-in-the-Middle) bug so it "only" enables eavesdropping when you are
using the software, rather than enabling an unauthenticated attacker to
breach the server. I would suggest one of the following immediate
mitigations while you're deciding what to do:
* Stop logging into it - Nobody can man-in-the-middle a
communication you're not using.
* Apply the config changes to Apache listed here
https://poodle.io/servers.html - This will make Prayer safe to use.
* Only log in from networks you reasonably trust ( ethernet,
encrypted wifi where you know all the users or 3G/4G) - Don't use it in
coffee shops, on the train or anywhere with open public wifi.
If you avoid unencrypted wifi and networks owned by people who don't
provide bandwidth for money, like Vodafone, then the only people who
would generally have the legal ability to be in the middle would be "the
man."
I use Roundcube which I really like and has a slick, modern UI. It is,
however, also vulnerable to Poodle in its default config but once you've
tweaked the Apache config using the link above, you'll be good to go.
Bests,
Paul.
mån 2015-07-13 klockan 10:16 +0100 skrev Michael
Stevens:
It's
an option, but I'd also like to upgrade to something with a less
1990s UI. It's more of a last straw.
Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched,
...
Assuming weak TLS support is your only problem with prayer, why not
simply put a proxy in front, and let that proxy do the TLS termination?
11:15 a.m.
mån 2015-07-13 klockan 11:42 +0100 skrev Michael Stevens:
On Mon, Jul 13, 2015 at 12:39:51PM +0200, Andreas
Olsson wrote:
Perhaps https://www.mailpile.is/ might be worth keeping an eye on then?
Still in Beta, and not really proven yet. Does look kind of promising.
// Andreas
mån 2015-07-13 klockan 10:16 +0100 skrev Michael
Stevens:
It's an option, but I'd also like to upgrade to something with a less
1990s UI. It's more of a last straw. Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched,
...
Assuming weak TLS support is your only problem with prayer, why not
simply put a proxy in front, and let that proxy do the TLS termination? 
11:42 a.m.
Been using Roundcube for years, very happy.
Actively developed, modern interface:
https://roundcube.net/
and they have the Roundcube Next project too which looks interesting:
https://roundcube.net/news/2015/05/03/roundcube-next-is-coming/
On 13/07/15 12:15, Andreas Olsson wrote:
mån 2015-07-13 klockan 11:42 +0100 skrev Michael
Stevens:
On Mon, Jul 13, 2015 at 12:39:51PM +0200, Andreas
Olsson wrote:
Perhaps https://www.mailpile.is/ might be
worth keeping an eye on then?
Still in Beta, and not really proven yet. Does look kind of promising.
// Andreas
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users mån 2015-07-13 klockan 10:16 +0100 skrev Michael
Stevens:
It's
an option, but I'd also like to upgrade to something with a less
1990s UI. It's more of a last straw. Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched,
...
Assuming weak TLS support is your only problem with prayer, why not
simply put a proxy in front, and let that proxy do the TLS termination? 
12:59 p.m.
Take a look at citadel. Has a web interface too. :)
On Tue, 14 Jul 2015 12:22 am Richard Dignall <richard(a)dignall.co.uk> wrote:
On Mon, Jul 13, 2015, at 12:42 PM, Simon Bell wrote:
Been using Roundcube for years, very happy.
"PHP Version 5.3.7 or greater"
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
12:06 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 13/07/2015 12:42, Simon Bell wrote:
Been using Roundcube for years, very happy.
Actively developed, modern interface:
https://roundcube.net/
Roundcube appears to be written in PHP, though.
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iEYEARECAAYFAlWjqdoACgkQ/kpNbHCQHr4OqQCffG6iGKZvUyGT2IdbnJFfsEYQ
1QQAn2C9kLAfAGUW3Teup2xnvx1xlU49
=L2qJ
-----END PGP SIGNATURE-----
12:09 p.m.
Oh, sorry, missed that bit!
On 13/07/15 13:06, Mike Zanker wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 13/07/2015 12:42, Simon Bell wrote:
Been using Roundcube for years, very happy.
Actively developed, modern interface:
https://roundcube.net/
Roundcube appears to be written in PHP, though.
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iEYEARECAAYFAlWjqdoACgkQ/kpNbHCQHr4OqQCffG6iGKZvUyGT2IdbnJFfsEYQ
1QQAn2C9kLAfAGUW3Teup2xnvx1xlU49
=L2qJ
-----END PGP SIGNATURE-----
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
2:30 p.m.
On 13/07/15 13:06, Mike Zanker wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 13/07/2015 12:42, Simon Bell wrote:
What is your aversion to PHP please?
Most of the products I've seen recently use ut.
Been using Roundcube for years, very happy.
Actively developed, modern interface:
https://roundcube.net/
Roundcube appears to be written in PHP, though.
2:33 p.m.
On Mon, Jul 13, 2015 at 03:30:21PM +0100, Paul Stimpson wrote:
On 13/07/15 13:06, Mike Zanker wrote:
I don't trust it for security. I know it's very popular, and many people
are successful and will say I'm imagining all the security issues etc...
Michael
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 13/07/2015 12:42, Simon Bell wrote:
What
is your aversion to PHP please?
Most of the products I've seen recently use ut. Been using Roundcube for years, very happy.
Actively developed, modern interface:
https://roundcube.net/
Roundcube appears to be written in PHP, though. 
10:41 a.m.
On Mon, Jul 13, 2015 at 10:16:36AM +0100, Michael Stevens wrote:
Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched
This suggests that POODLE was actually patched:
https://bugs.launchpad.net/ubuntu/+source/prayer/1.3.5-dfsg1-3
I'm not familiar with Prayer, so I might be missing something. However,
POODLE isn't too a big deal and, realistically, only affects HTTPS
anyway (not STARTTLS). And seeing as POODLE uses Apache for its web
interface you should be able to disable SSL 3.0 in there.
Martijn.
PS I know that doesn't answer your question, for which I apologise.
10:44 a.m.
On Mon, Jul 13, 2015 at 10:41:01AM +0000, Martijn Grooten wrote:
On Mon, Jul 13, 2015 at 10:16:36AM +0100, Michael
Stevens wrote:
It looks like it's only patched in Ubuntu from that link? Although of
course I could pickup the patch by myself.
I'm using prayer's direct http(s) server, although a proxy *is* an
option.
Michael
Has anyone got any recommendations for webmail
software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched
This suggests that POODLE was actually patched:
https://bugs.launchpad.net/ubuntu/+source/prayer/1.3.5-dfsg1-3
I'm not familiar with Prayer, so I might be missing something. However,
POODLE isn't too a big deal and, realistically, only affects HTTPS
anyway (not STARTTLS). And seeing as POODLE uses Apache for its web
interface you should be able to disable SSL 3.0 in there.
Martijn.
PS I know that doesn't answer your question, for which I apologise. 
11:11 a.m.
I no longer run my own mail server, but when I did I had the classic Squirrelmail
(http://squirrelmail.org/) running, which looks like a bit of a retro Yahoo! mail
interface. I later upgraded to Roundcube (https://roundcube.net/), which has a more modern
interface.
Haven’t used either for a while though I’m afraid, so not sure how well maintained they
are (although both websites have recent updates and releases, so it looks promising).
Hope that helps,
Paul
On 13 Jul 2015, at 11:44, Michael Stevens
<mstevens@etla.org<mailto:mstevens@etla.org>> wrote:
On Mon, Jul 13, 2015 at 10:41:01AM +0000, Martijn Grooten wrote:
On Mon, Jul 13, 2015 at 10:16:36AM +0100, Michael Stevens wrote:
Has anyone got any recommendations for webmail software? I've been using
prayer (http://www-uxsup.csx.cam.ac.uk/~dpc22/prayer/) but it seems to
be vulnerable to POODLE and unlikely to get patched
This suggests that POODLE was actually patched:
https://bugs.launchpad.net/ubuntu/+source/prayer/1.3.5-dfsg1-3
I'm not familiar with Prayer, so I might be missing something. However,
POODLE isn't too a big deal and, realistically, only affects HTTPS
anyway (not STARTTLS). And seeing as POODLE uses Apache for its web
interface you should be able to disable SSL 3.0 in there.
Martijn.
PS I know that doesn't answer your question, for which I apologise.
It looks like it's only patched in Ubuntu from that link? Although of
course I could pickup the patch by myself.
I'm using prayer's direct http(s) server, although a proxy *is* an
option.
Michael
_______________________________________________
users mailing list
users@lists.bitfolk.com<mailto:users@lists.bitfolk.com>
https://lists.bitfolk.com/mailman/listinfo/users
4:58 p.m.
Hello,
On Mon, Jul 13, 2015 at 11:44:19AM +0100, Michael Stevens wrote:
On Mon, Jul 13, 2015 at 10:41:01AM +0000, Martijn
Grooten wrote:
According to:
http://metadata.ftp-master.debian.org/changelogs//main/p/prayer/prayer_1.3.…
that patch was included in 1.3.5-dfsg1-3 which currently only
exists in Debian stretch and sid. The packages probably install on
wheezy, though.
Otherwise, it looks like a very trivial patch to backport.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
This suggests that POODLE was actually patched:
It looks like it's only patched in Ubuntu from that link? Although of
course I could pickup the patch by myself. 
9:02 p.m.
* Andy Smith <andy(a)bitfolk.com> wrote:
According to:
http://metadata.ftp-master.debian.org/changelogs//main/p/prayer/prayer_1.3.…
that patch was included in 1.3.5-dfsg1-3 which currently only
exists in Debian stretch and sid. The packages probably install on
wheezy, though.
I can confirm this works - compiled 1.3.5-dfsg1-3 on my wheezy box today
and installed with zero hassle.
Ross
11:05 a.m.
Michael Stevens said:
Has anyone got any recommendations for webmail
software?.. Ideally
whatever software would be good for the security
obsessed (so eg not php[1]).
It depends on your definition of security obsessed, but my solution is to
copy incoming email to a Gmail account and use that for webmail, still
using my email server to send email.
In exchange for letting Google see all of the email instead of just most of
it, you get quite a lot of advantages over a DIY solution.
Ian
3209
days inactive
3209
days old
17 comments
12 participants
participants (12)
-
Andreas Olsson -
Andy Smith -
Ian -
jan eringa -
Martijn Grooten -
Michael Stevens -
Mike Zanker -
Paul Lewis -
Paul Stimpson -
Richard Dignall -
Ross Younger -
Simon Bell