Bugzilla

Comment 3

•

13 years ago

Walsh hasn't responded. :(

Please don't file bug reports if you are not going to respond in the future to people who need more information to attend to your issue.

Status: UNCONFIRMED → RESOLVED

Closed: 13 years ago

Resolution: --- → INCOMPLETE

Reporter

Comment 4

•

13 years ago

Sorry, but didn't get the emails in a timely fashion...

They ended up in my bugmail folder, which ... well, 
is odd, since it was addressed to me...
(i.e. filter rules should have ->mozilla@tlinx.org, goto 'domain', else, from bugzilla -> bugmail).


Yes, TB2.x

Haven't tried a 4th time to upgrade to TB3.x because previous 3 attempts ..
welll first time, I didn't know,
2nd, time, thought I checked right options
3rd time, after research and checking more opts, still found it
d/l'ing ~4GB of mail to my local workstation...(which it would do for about
5 instances of T-bird I run...if I upgraded them all to 3.x).


Not being able to turn off this 'default behavior' (which I'm told
is 'very easy', and 'very obvious', isn't -- I'm sure it is to those who told this,
but the location of a birthmark on my body is also known to me -- and I
might even think it 'obvious'....that doesn't mean it is so for everyone!

Hopefully, I'll eventually be able to find the key pieces I am 
missing (that are blindly obvious to those who implemented them, (!of course!),

I got updated in my TB to 2.0.0.24, when I went for the relnotes, got the error.

What problems are there with 2.x in regards to security when it is 
used behind a firewall on an internal network IMAP server?

Status: RESOLVED → UNCONFIRMED

Resolution: INCOMPLETE → ---

Tyler Downer [He/Him]

Comment 5

•

13 years ago

So I'm really not understanding your issue 100%. Can you please explain what exactly you are seeing, step by step? I'm a bit muddled.
And by the way, security fixes in thunderbird that aren't in 2, well, try http://www.mozilla.org/security/known-vulnerabilities/thunderbird31.html#thunderbird3.1.1 for a start.
 
Please download Thunderbird 5, http://www.mozilla.org/en-US/thunderbird/ (since you are so far behind, it is easier just to download the installer rather than try to update internally. All your data will be saved. Then see if your problem still exists. Thank you.

Reporter

Comment 6

•

13 years ago

SERIOUSLY....I'd love to upgrade, but I'm very afraid of 
it downloading my 4..sorry 4.7GB of IMAP folders to my
local machine.

I tried installs 3 times after getting advice from others how to turn it off
and it still tried to d/l it.

I use a roaming profile, and having my TB folder grow by multiple
GB when the whole profile is only 2.1, is a major pain...

Login/logout time more than doubled.

I have 5 copies of TB that I can run from different accounts/computers.

I put things on IMAP for a reason -- I wanted only 1 copy
for all of my logins.

ok, for 2.0.0.24, if I goto help->release notes -- I get taken to a bogus page:

http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.24/releasenotes//2.0.0.24/releasenotes/

Anyway, let me know how permanently disable the local download, and I'll
be happy to try a newer version!

(by permanently, I mean something that will survive over upgrades!)

I don't need my local profiles doubling and tripling in size...

I'm sure you can understand how having logoff take >40 minutes, is really
a pain!  (logon was only about 7-8 minutes)....

Comment 7

•

13 years ago

(In reply to comment #6)
> ok, for 2.0.0.24, if I goto help->release notes -- I get taken to a bogus
> page:
> 
> http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.24/releasenotes//2.0.
> 0.24/releasenotes/

just to be clear - you are being sent to the above link, and not http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.24/releasenotes/ ?

> Anyway, let me know how permanently disable the local download, and I'll
> be happy to try a newer version!

It's pretty well documented at http://support.mozillamessaging.com/en-US/kb/imap-synchronization

And it's also mentioned in Help | Migration Assistant which you should have seen upon updating to version 3.


> I'm sure you can understand how having logoff take >40 minutes, is really
> a pain!  (logon was only about 7-8 minutes)....

It's unclear what you mean about logon  and logoff - Thunderbird doesn't really have that concept, and those times (especially logoff=40 minutes) doesn't correspond to anything I recognize.  Do you mean windows startup and shutdown?  Or thunderbird? Or are you referring to the time needed to download the messages?And is your antiviru

Also, do you have Thunderbird configured to start when XP starts? And is your antivirus software configured to not scan thunderbird profile?


> What problems are there with 2.x in regards to security when it is 
used behind a firewall on an internal network IMAP server?

Please ask about this in Thunderbird support http://www.mozillamessaging.com/support and ask your IT support group.

Comment 8

•

13 years ago

p.s. is your thunderbird profile on a network share?

Reporter

Comment 9

•

13 years ago

From my proxy log,
The first request is to
GET http://en-us.www.mozilla.com/en-US/thunderbird/2.0.0.24/releasenotes/
which returns a TCP_MISS/301
Then it gets redirected to
[GET http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.24/releasenotes//2.0.0.24/releasenotes/
---
so the 'redirect' is what's throwing the link to the wolves...

---
logon/logoff -- meaning when my Win7 workstation logs out/or I log in.

I have a *roaming profile*..... meaning windows tries to copy any newly created files
from my profile back to the 'server' (which is also my IMAP server) -- i.e. my server
is the 'back half of my computer').

I moved to 'roaming profiles', on my home domain when I went to windows 7 -- as I didn't trust win7's stability and the fact that they removed reliable backup capability (they have a backup, but it isn't reliable -- refused to restore an image to a new HD when I needed to replace an old one, thank goddess for linux & cygwin's 'dd' (and linux-miniroot to copy from an external HD, the old HD image to the new).... It HAS worked (once), -- full system restore, but I've had to do too many file recovery and reinstalls on win7 (well, especially in the first 3 months of when it came out!)... Not as bad now, but more than once having my profile stored on the server has saved my bacon when some local win7 process (or I) hosed one or more files...

So the >4G of email stored in my imap folders (going back to at least I can see an Amazon folder from 1998, all got copied up to my local profile -- by DEFAULT.... -- 2 profiles on each Windows machine (a local one and the newer 'Domain profile' (as before I figured out how to create a Samba Domain, I figured out how to do roaming profile backup through system policies)....

Anyway...the advice MS gives to IT professionals is to NOT have users store lots of files
in their profiles -- that's the official line, as the more you put it in the longer logon/logout takes (if the files are all 'up-to-date', it still checks the DT's on the files, which goes much faster (<1 minute on a good day)... But if it has to copy a bunch of 'changed' files (like updated local copies of IMAP folders), on each logout/login, then we are talking serious time.

MS would recommend putting an app with a large file need either on a local hard disk if it doesn't need backing up, or if it does -- put it on a local share.

Perhaps you should store files meant to be cached 'locally' under /appdata/local, and not appdata/roaming,
(or in XP parlance, 'local settings' and not 'application data')...
Stuff in application data is stuff that is supposed to be transported from network location to network location because it is only stored with the user profile and NOT on some network share.

'temp' files/cache files are all stored in 'local settings'/ appdata/local

Thunderbird broke that usage when they started making a local cache of
a shared network data-store (like IMAP).

Arguably with POP, that wouldn't be less likely, but IMAP was traditionally used more
'in network', while POP out on the WWW, those are generalizations, but they are probably
still true today (ignoring 'MS-EXCHANGE')....

I was being 'facetious' (sorry, my bad) when I asked what probs there were w/r/t security
2.x on a closed subnet. Normally internet traffic isn't even routable to or from the internet
from my windows machine (NAT is normally disabled)...I go through an HTTP proxy,
and my IMAP server is on my local network (the server downloads my email to my local IMAP server and handles sending out email for my client...)...

My 'sysadmin' assures me I'm paranoid using IMAPS and not just IMAP, since and ssh instead of rlogin, but hold habits die hard, and they don't cost much in performance.

(in case not obvious, sysadmin=me (sigh) :-) )

----
Anyway -- the problem described in the base appears to be based in that initial redirect.

Updated

•

13 years ago

Component: General → www.mozilla.com

Product: Thunderbird → Websites

QA Contact: general → www-mozilla-com

Updated

•

13 years ago

Status: UNCONFIRMED → NEW

Ever confirmed: true

Updated

•

13 years ago

Severity: major → normal

Comment 10

•

13 years ago

This is a rewrite bug.

http://en-us.www.mozilla.com/en-US/thunderbird/2.0.0.24/releasenotes/ 
should redirect ->
http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.24/releasenotes/

instead it is currently doing this:
http://www.mozillamessaging.com/en-US/thunderbird/2.0.0.24/releasenotes//2.0.0.24/releasenotes/

The trailing version number and /releasenotes/ is being duplicated.

Comment 11

•

13 years ago

I tested this with v2 and confirm everything Walsh points out.  V2 update is majorly broken, because it isn't just the reference URLs that are broken. 

To summarize
1. Help | release notes  redirects incorrectly
2. Help | update | click | Upgrade to Thunderbird 3.1  is broken, takes you to the current version (5) download page
3. Help | update |  Get the update button 
3a) spins on "connecting to the update server"
3b) click details Details takes me to https://www.mozillamessaging.com/en-US/thunderbird/3.1/details/index.html    (then, like #2 above)  clicking update takes me to https://www.mozilla.org/en-US/thunderbird/


Now, L A Walsh, THANKS for the pointing out this serious problem. But please, please, please, please, please compose bug comments more concisely.  i..e please stop writing books. Thank you.

(i'll PM you about version 3 + 5 and how to avoid downloading all messages, which is a support question)

Severity: normal → major

OS: Windows 7 → All

Summary: Thunderbird update process broken → Thunderbird 2 update process broken

Comment 12

•

13 years ago

Okay... this isn't entirely a website bug, so I'm moving it again!

Component: www.mozilla.com → Server Operations

Product: Websites → Mozilla Messaging

QA Contact: www-mozilla-com → server-ops

Version: unspecified → other

Comment 13

•

13 years ago

gozer/jhopkins: It looks like the update server is not serving an update for TB2 -> 3 as it is supposed to? Maybe a redirect is broken, I'm not sure.

Comment 14

•

13 years ago

I filed https://bugzilla.mozilla.org/show_bug.cgi?id=674735 to deal with the release notes rewrite, which has nothing to do with the update process being broken.

John Hopkins (:jhopkins)

Comment 15

•

13 years ago

Several issues here, and one is that 2.0.0.24 is seeing an upgrade to 3.1.10 instead of 3.1.11.  3.1.10 is no longer on the mirrors sites.

I will continue to look into this in depth tomorrow.

John Hopkins (:jhopkins)

Updated

•

13 years ago

Depends on: 674970

John Hopkins (:jhopkins)

Updated

•

13 years ago

Depends on: 674974

Updated

•

13 years ago

Depends on: 674735

Reporter

Comment 16

•

13 years ago

(In reply to comment #11)
> 
> Now, L A Walsh, THANKS for the pointing out this serious problem. But
> please, please, please, please, please compose bug comments more concisely. 
> i..e please stop writing books. Thank you.
----
     I started out succinctly. Instead of being asked for more information,
I was told to 'avoid the problem, by  not testing it -- and to upgrade to 
the newer, incompatible TB3 to 'test' for the problem (that is specific to
TB2).

    That resulted in my answering the questions about version info that the 1st person asked, and telling the 2nd person about the problems I had on previous attempts to upgrade to 3.x and why I was holding off doing that at this point.

    Immediately another support person jumps in and says they don't understand
the quoted steps:
1. Get offered update in TB[2], as noted in title
2. Click on more info to read release notes
3. Click on download version and get offered completely different version that relnotes talks about

     I thought I was reasonably clear, but no one has a test setup to be
able to run TB2 to duplicate the problem, i'm guessing.  Anyway, that person,
not understanding the steps above, told me to upgrade to TB 5.x (!) -- outdoing
the person who suggested 3.x.   

    Now why they'd suggest 5.x, when it has all the same 'download behaviors' as 3.x, when I had already explained why I didn't want those behaviors and my
successive failures in attempting to turn off that behavior, is beyond me.

    But, in the moment, I explained again, why I didn't wish to take that course of action (of course they could have read they previous comments, but, many people don't, thus, I end up repeating myself and looking overly verbose!) -- if they HAD read they previous comments, they'd already know not to suggest
upgrading to 5.0 in order to test the TB2.x website problem (it would have
just buried the problem).

    Was some more discussion about how I should know how to do 'xyz, and then another question about my local setup.   At that point, I gave a description of my setup, and then in response to the multiple suggestions to upgrade, I decided to explain how MS, expects local dirs to be used, and how Tbird
violates the MS 'spec', by creating a local cache of "files/folders" on a local, Gbit lan and stores them in the local _roaming_ profile area.

    I explained how if they needed to cache information locally, it shouldn't
be stored in the roaming profile area s any domain users will be severely 
penalized by that decision.  IMAP is efficient for mail retrieval.  It even supports fast indexing and searching if properly configured (sieve), but 
even without sieve, searching through a a 100MB+ mail-folder took maybe as long as 10 seconds -- to search through all the content (if I was running sieve,
presumably it would be faster...dunno).

     But I also tried to explain the difference between a local 'mail-protocol' that supports file-system semantics (directories, access control, multiple namespaces, etc) vs. a 'remote' protocol, that was basically designed simply for retrieval of content from remote mailboxes over dial-up lines (POP)...

    As I was being pushed to upgrade to a product that included design choices contrary to standards, I was trying to explain the standards and what the problem was.  

    Now, it is true, TB3 (and presumably TB5), can be configured to adhere to system setup and usage guidelines, by default, it doesn't.  

    Not having (or wanting a MS Exchange server), I don't know if TB also 
downloads a user's entire exchange profile by default or not.   If it does, you are really risking the wrath of sysadmins on a large scale, and if it does not, then the choice to download all of a users 'IMAP' directory structure, by default, is 'inconsistent' as IMAP is more similar to Exchange, in that it provides DB-like services, as well as local-file services like a local file system, than the 'drop-box' service 'POP'.

    So there was the design choice to download email locally, from mail-stores that were designed flexible querying, but ALSO the absolutely wrong design choice to store a 'local cache' of data in a users roaming profile where it will have to all be uploaded to (often) the same server it was all downloaded
from on logoff, as well as downloaded or 'synced', at logon.  The problem is
much worse for people who logon in multiple locations (physical or virtual).

     Not only did no one seem to care about about violating MS or Windows policies (certainly the largest group of TB & FF users), but they felt it was the right thing to do and kept it in TB5 as the default.  

     So I responded verbosely then (and now), to be clear on the issues -- since when I make 'short-hand' remarks, I'm as often as not, misunderstood, and sometimes taken to be insulting when no such insult was intended -- I was being 'too casual'.   (all in the mozilla support forums, BTW).

     So I end up almost always, it seems, displeasing 'someone' no matter how I phrase things -- only those who never speak/post remain unoffensive and are said to get along with everyone.   Those who put themselves out...well, some like them, and some not.



----
I got these...


> (i'll PM you about version 3 + 5 and how to avoid downloading all messages,
> which is a support question)

the bit of the prefs setting, to turn off the behavior is probably the missing piece I needed.  So thanks for the info!

Right now am struggling with a FF config that has been working fine, but has gotten 'disturbed' by some updates for extensions that were for the newer
version of FF, and not my version.  I have problems there with over 100 extensions -- many of which work, but will be invalidated on a jump to FF4 or FF5, some aren't even on the AMO site for FF3 -- even though they work just fine -- they are just no longer offered, and no similar replacement was created.

Sorry for the long response, I do upgrade my SW, but I also like to use it to have fun -- and a recent upgrade of my linux server from 11.2->11.4, is still having repercussions 2 months later (will say, having used suse from 6.8, this was the worst upgrade experience, hopefully it's not a trend, BUT I notice more than one company jumping to get new versions out REAL fast, and jumpt to latest
SW, long before it is ready or solid.  (11.4, if you have updates turned on, will upgrade you to samba 3.6, -- a pre-release product that is now in its 3rd pre-release due to critical bugs)...but it's being offered for 'STABLE' systems for anyone running 11.4)...

Somehow, that just doesn't seem wise....

I don't want to spend all my time doing sw/hw config just to keep my home network running.

But I do try keep filing bugs on various products...though I don't always win friends that way... (but if no one speaks up and reports problems, then how will anyone know there's a problem, since most users won't speak up), only a small (verbal) percentage of technically inclined ones will.  

And I will admit, I generally push the bounds of of my HW/SW, to take advantage of them.  Using all those features exposes me to many more problems than the 
average user.