Subject: Netscape problems with uw imapd

From: Sean Witham <[email-masked]>
Date: Wed, 23 May 2001 12:10:25 +0100

I have just installed "imap-2001.BETA.SNAP-0105151510" to see if it
solved a problem where netscape would not detect new email in a
mailbox until the imap sessions was ended and a new one started. I was
previously running a version that dates back to 1998 and so there was
not mention of the bug in the fix list for this release. If anyone can
confirm that this was a known problem that has been fixed I would
appreciated it.

Since the update a new problem has been found. Netscape ( we a using
version 4.7x on windows ) comes with a notify tool that sits on the
windows tool bar and waves a flag when new email has arrive. The new
problem is that the notify tool repeatedly asks the user to
authenticate.  When I checked the logs I found that the notify tool
succeeds in authenticating on the first attempt but then logs out
straight afterwards but it appeared that the imapd process that
started was still running and that a second one had started.

Any thoughts on what to do next to get a better idea of what is going
wrong ?

--Sean
-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Wed, 23 May 2001 10:47:39 -0700 (PDT)

Netscape's notify tool is well-known to be broken for quite some time.  There
has been no word that it will ever be fixed.  Consequently, the best thing to
do with Netscape's notify tool is:
	DEL NSNOTIFY.EXE

In general, Netscape's IMAP client is not a very good one, and as far as
anyone can tell, it has been allowed to succumb to software rot.  I don't know
why in your particular case that you're not getting new mail; there could be
any of a number of reasons on both client and server.

However, as the first diagnostic test you should try some other client
(preferably one that actually gives some information about the IMAP status
such as Pine), to see if the problem still occurs  If it does happen with
other clients, then there are some additional diagnostic tests.  If it doesn't
then you might as well stay with that other client.

---

From: Sean Witham <[email-masked]>
Date: Thu, 24 May 2001 10:11:07 +0100

> do with Netscape's notify tool is:

The strange thing is it was workling (most of the time) with the old
uw-imapd

That asside is there any reason why I wouldn't be able to get a third
party "biff" like tool to work ? Can anyone recomend one that will sit
on the win32 tool bar ?
 
> any of a number of reasons on both client and server.

Well, I haven't had any reports of the problem since the upgarde of
uw-imapd. We will just have to wait and see.
 
> then you might as well stay with that other client.

I will do that should the problem repeat itself with the new uw-imapd.

The next question which this list must have been asked lots of time is
for recomendation for an IMAP/POP aware Graphical email tool for
Windows. Outlook is not an option ( I don't like the security problems
it casuses, nor the lack of message header information ).

>From a users point of view the netscape mail tool is quite useable.
I'd like something with the same ease of use (or better) and
functionality.

--Sean

---

From: Kevin Dwyer <[email-masked]>
Date: Thu, 24 May 2001 08:50:18 -0400 (EDT)

Sean, have you tried Eudora?

While I personally detest Windows, I had to use it for a while in my
previous position.  We had UW-IMAP running on a solaris box with Windows
clients.  The email program of choice ended up being Eudora.  It seemed to
support the IMAP extensions well (or we didn't do anything powerful).  You
may want to give it a whirl.  I believe Eudora has a little systray icon
of a mailbox or something and lets you know when there is new mail.  I
believe it worked.

/* Kevin Dwyer                              <[email-masked]> */
/* Network Security Engineer  -=-  Intermedia Communications */

On Thu, 24 May 2001, Sean Witham grunted something like:

[sean.w] Mark Crispin wrote:
[sean.w]
[sean.w] >
[sean.w] > Netscape's notify tool is well-known to be broken for quite some time.  There
[sean.w] > has been no word that it will ever be fixed.  Consequently, the best thing to
[sean.w] > do with Netscape's notify tool is:
[sean.w] >         DEL NSNOTIFY.EXE
[sean.w] >
[sean.w]
[sean.w] The strange thing is it was workling (most of the time) with the old
[sean.w] uw-imapd
[sean.w]
[sean.w] That asside is there any reason why I wouldn't be able to get a third
[sean.w] party "biff" like tool to work ? Can anyone recomend one that will sit
[sean.w] on the win32 tool bar ?
[sean.w]
[sean.w] > In general, Netscape's IMAP client is not a very good one, and as far as
[sean.w] > anyone can tell, it has been allowed to succumb to software rot.  I don't know
[sean.w] > why in your particular case that you're not getting new mail; there could be
[sean.w] > any of a number of reasons on both client and server.
[sean.w] >
[sean.w]
[sean.w] Well, I haven't had any reports of the problem since the upgarde of
[sean.w] uw-imapd. We will just have to wait and see.
[sean.w]
[sean.w] > However, as the first diagnostic test you should try some other client
[sean.w] > (preferably one that actually gives some information about the IMAP status
[sean.w] > such as Pine), to see if the problem still occurs  If it does happen with
[sean.w] > other clients, then there are some additional diagnostic tests.  If it doesn't
[sean.w] > then you might as well stay with that other client.
[sean.w]
[sean.w] I will do that should the problem repeat itself with the new uw-imapd.
[sean.w]
[sean.w] The next question which this list must have been asked lots of time is
[sean.w] for recomendation for an IMAP/POP aware Graphical email tool for
[sean.w] Windows. Outlook is not an option ( I don't like the security problems
[sean.w] it casuses, nor the lack of message header information ).
[sean.w]
[sean.w] >From a users point of view the netscape mail tool is quite useable.
[sean.w] I'd like something with the same ease of use (or better) and
[sean.w] functionality.
[sean.w]
[sean.w] --Sean
[sean.w]

---

From: "Julian Hall" <[email-masked]>
Date: Thu, 24 May 2001 18:11:33 +0100

Personally, I'd avoid Eudora.  It has a nasty security problem that is
almost as bad as any of the ones Outlook has in that it decodes attachments
in incoming mail into a directory on your system without requiring your
permission.  It also (I understand) uses Internet Explorer to view HTML
messages, whilst pasting a note of the file location of the attachments onto
the end of the e-mail.  A cleverly written HTML page could use 'Active
Scripting' to find this file and execute it as a script in the 'Local
Computer' security context, thus being able to do an awful lot of damage.

I am not however aware of this actually having happened 'in the wild', and
thinking about it this may not apply to email retrieved through IMAP as
separating out the attachments this way makes even less sense with an IMAP
server than it does with POP3... but certainly look into the security
implications of Eudora.

---

From: Mark Crispin <[email-masked]>
Date: Thu, 24 May 2001 10:31:48 -0700 (PDT)

On Thu, 24 May 2001 10:11:07 +0100, Sean Witham wrote:
> > Netscape's notify tool is well-known to be broken for quite some time.

NSNOTIFY does not properly handle the IMAP protocol.  Consequently, when a new
version of imapd used a facility that it did not use before, NSNOTIFY broke.
Other IMAP clients have no problem, even if they do not use this facility
(which, by the way, reduces startup overhead by 50%).

This problem has been known about for over a year.  NSNOTIFY has not been
fixed.  You can draw your own conclusion as to its support.  I have.

> party "biff" like tool to work ? Can anyone recomend one that will sit

biff type programs are *evil* in a client/server environment.  Most of these
work by polling; that is, they establish a new session to the server every few
seconds to re-open the mailbox to get its status.  The only way to make such
programs be reasonable is to tie them to the MDA as opposed to polling.

With good-quality mail-reading programs, you don't need such a program.  For
example, PC Pine has a feature that will put a Pine tree icon in the systray,
and will change its color from green to red when there is new mail.

In IMAP it is actually *much* less overhead on the server to keep the mail
reading program running than to use a polling program such as NSNOTIFY.  This
is contrary to what many people expect, but it's true.

> Windows.

PC Pine is the best.  It handles attachments securely, and handles even
gigantic mailboxes and messages with aplomb.  Most of the other programs spend
too much time drawing pretty pictures than they do on handling mail well.

---

From: Kevin Dwyer <[email-masked]>
Date: Thu, 24 May 2001 15:23:12 -0400 (EDT)

Julian, very true.

I guess I wasn't approaching this subject from the security perspective.
However, I could not think of too many worthwhile email programs for
windows that use IMAP.  With the exception of PC-Pine, of course, but it
seems as though he had ruled that out as an option, in favor of the pretty
GUIs.  On the subject of the security of Eudora, I was under the
impression that one could in fact secure it.  I could be very wrong, but I
think there are some defaults you can change to fix it.  In fact most
clients that interpret HTML and javascript have these issues out of the
box.  One of my favorites is the javascript email bug.  But I believe at
this point we're escaping the scope of this list.  Anyways, I'd take Mark
Crispin's advice and run PC-Pine if I had to use windows and had a choice
in mail client.

On Thu, 24 May 2001, Julian Hall grunted something like:

[jules] Personally, I'd avoid Eudora.  It has a nasty security problem that is
[jules] almost as bad as any of the ones Outlook has in that it decodes attachments
[jules] in incoming mail into a directory on your system without requiring your
[jules] permission.  It also (I understand) uses Internet Explorer to view HTML
[jules] messages, whilst pasting a note of the file location of the attachments onto
[jules] the end of the e-mail.  A cleverly written HTML page could use 'Active
[jules] Scripting' to find this file and execute it as a script in the 'Local
[jules] Computer' security context, thus being able to do an awful lot of damage.
[jules]
[jules] I am not however aware of this actually having happened 'in the wild', and
[jules] thinking about it this may not apply to email retrieved through IMAP as
[jules] separating out the attachments this way makes even less sense with an IMAP
[jules] server than it does with POP3... but certainly look into the security
[jules] implications of Eudora.

---

From: Sean Witham <[email-masked]>
Date: Fri, 25 May 2001 18:20:05 +0100

> programs be reasonable is to tie them to the MDA as opposed to polling.

I do not know the IMAP protocol well enough to know its limitations
but ... The fact is the PC has no way of knowing when an MDA has
delivered new mail accept via the IMAP protocol as this is the only
"email" protocol that the PC has access to the mail server with. Does
IMAP support a push notification of new mail to the client connected ?
Does it allow for a client to ask for Read Only connection so it
doesn't force another client off (only needed if you want a notify ony
tool) ? If it allows either of these does UW-IMAP support them and is
there an IMAP client that makes uses of either of them so that it
provides a visual indication of new email from teh windows task bar ?

> and will change its color from green to red when there is new mail.

People like the GUI look and feel , they like to be able to read html
email etc. I like pine myself but I still use netscape when I have
been sent inline pictures etc.
 
> is contrary to what many people expect, but it's true.

I'm happy to use a mail client this way but the windows users need one
they like the look of and the features. PC Pine doesn't offer all that
they want.
 
> too much time drawing pretty pictures than they do on handling mail well.

If PC Pien handled drawing the pretty pictures as well then my users
would be happy, so what is the second best then ?

--Sean

---

From: Mark Crispin <[email-masked]>
Date: Fri, 25 May 2001 10:54:31 -0700 (PDT)

> I do not know the IMAP protocol well enough to know its limitations

I'd say "features" instead of "limitations", but...

> Does

Yes.  Part of IMAP since the very beginning.

> tool) ?

Yes.

But as I said before you don't want, or need, a notify only tool.

> If it allows either of these does UW-IMAP support them

Yes.  Since the beginning.

> and is

Pine and every other good IMAP client in the world does.  A client that
doesn't do this is "not good" by definition.  A "not good" client has to go to
considerable effort to discard information from IMAP in order to do the wrong
thing; IMAP sends that information whether or not the client asks for it.

> email etc.

Yes, it does seem that people are more concerned about HTML and pretty
pictures and similar cosmetic details than whether it works well, or knows
enough not to install viruses on your hard drive, or can handle more than a
few hundred messages without collapsing.