Icedove for Debian
------------------

Icedove is the Thunderbird email client from Mozilla rebranded by Debian.

Mozilla has changed the kind of developing and managing Thunderbird and make an
announcement about this on July 8 2012. Since this announcement Mozilla decided
to change the focus of there own software development and will put more action
on important web projects and of course on FirefoxOS. Mozilla plans to open the
Thunderbird development to a more community driven project but will also be
there for security and stability maintenance. There are no plans to close the
packaging of Icedove from the Debian side, but the future will see where the
upstream project will go to.
As long as Mozilla will provide ESR versions there will be packaged versions of
those inside the various release of Debian.

 -- Carsten Schoenert <c.schoenert@t-online.de>  Sun, 2 July 2013 21:32:07 +0100

Downgrading TLS security
------------------------

If your provider doesn't support TLS 1.2 and you can't make him
upgrade you can change:

    "security.tls.version.min"

and/or

    "security.tls.version.max"

in about:config (available via "Edit ->> + Preferences -> Advanced ->
General -> Config Editor"). For details see
http://kb.mozillazine.org/Security.tls.version.* .

Note that changing these values decreases your transport level
security. For more details see:

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS
https://bugzilla.mozilla.org/show_bug.cgi?id=480514
https://wiki.mozilla.org/Security/Server_Side_TLS
http://en.wikipedia.org/wiki/Network_Security_Services
http://kb.mozillazine.org/Connection_errors_-_SMTP
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761245
https://tools.ietf.org/html/draft-ietf-tls-downgrade-scsv-00

 -- Carsten Schoenert <c.schoenert@t-online.de>  Wed, 15 Oct 2014 18:38:00 +0200

Adjusting TLS fallback strategy
-------------------------------

Mozilla introduced a new setting with version 34.0b1:

    "security.tls.version.fallback-limit"

The recommended (and default) value currently is: 1

This means Icedove is doing a fall back from TLS 1.2 through 1.1 to 1.0 if
the server is requesting this.
A value of '2' would mean Icedove is only using TLS 1.2 and 1.1.
And with a value of '3' Icedove wouldn't do any fall back and is only using
TLS 1.2.

Technical details can be found on:
https://bugzilla.mozilla.org/show_bug.cgi?id=1093724
https://bugzilla.mozilla.org/show_bug.cgi?id=1084025

Reactivateing SSLV3 connectivity
--------------------------------

Due to POODLE and BEAST SSLv3 encrypted connections are not considered secure
anymore. See [1], [2] and [3] for details. If you need to reactivate SSLv3 to
use Icedove against legacy systems you have to change the settings for

    "security.tls.version.min"

and set the value to '0'.

This setting can be found in the about:config summary.
(available via "Edit ->> + Preferences -> Advanced -> General -> Config Editor").
For details see
http://kb.mozillazine.org/Security.tls.version.* as written above.

Please read also:
[1] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3389
[2] https://www.openssl.org/~bodo/ssl-poodle.pdf
[3] https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/

 -- Carsten Schoenert <c.schoenert@t-online.de>  Wed, 12 Nov 2014 19:38:00 +0100

Plugins and Icedove settings
----------------------------

There are at least one known plugin that conflict with the change of the
security settings from above.
The user Brent S. Elmer has reported that the plugin 'HTTPS Everywhere' from
the Electronic Frontier Foundation is blocking a permanent change of the
setting "security.tls.version.min". Note that this behavior is no Debian
related issue.

Please report other plugins and extensions that doesn't work well with the
security settings.

[1] https://www.eff.org/https-everywhere
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774790

 -- Carsten Schoenert <c.schoenert@t-online.de>  Sun, 18 Jan 2015 9:34:00 +0100

New and Changed Features with Icedove version 38.x and above
------------------------------------------------------------

At the Thunderbird Summit 2014 in Toronto [1] the contributers and developers
for Thunderbird decided to focus their work on some important changes that now
released with version 38.0.1.
For Icedove these changes means in detail:
 * New storage backend maildir
   You can now choose as backend while set up a new account to store the
   emails in a maildir [2] backend. There is no migration from existing
   accounts into the maildir backend format available! You have to set up a
   new account for that and move your mails!

 * Removing the 4GB folder maximum
   In previous versions you couldn't use more than 4GB within one folder in
   your INBOX, now this limit isn't exist any longer.

 * Searching contacts across all address books
   The address book now contains a folder "All Address Books" from there you
   can search for any address in all of your local or remote address books.

 * Support OAuth backend for new created GMail accounts
   You are now able to use the OAuth authentication while you create a new
   account for a GMail address. Existing accounts can be changed to use
   OAuth.

 * Opt out automatic installation of Lightning
   Mozilla has changed the installation mechanism for Lightning away from a
   always manually installation to a automatic installation with a option to
   opt out this while the main installation of Thunderbird.
   Debian is handling this slightly different as we use a package management
   for such automatism.
   On a Debian system the package iceowl-extensiom (the rebranded Lightning
   package from Mozilla) will now installed automatically if you install or
   upgrade the Icedove package through the package manager you prefer.
   If you already have installed the Lightning package Icedove will use this
   AddOn like before the upgrade.
   But we recommend to not use the Lightning AddOn to work always with full
   compatible program packages. So please remove the Lightning plugin and use
   the iceowl-extension instead. No data will be lost!

[1] https://wiki.mozilla.org/Thunderbird:Summit_2014
[2] https://en.wikipedia.org/wiki/Maildir

 -- Carsten Schoenert <c.schoenert@t-online.de>  Sun, 14 Jun 2015 13:13:00 +0200
