<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt">A very useful summary of Alpine's robustness, thanks!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt">David<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:Helvetica">-- <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:Helvetica;color:black">David Sewell<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica;color:black">Manager of Digital Initiatives and the Rotunda Imprint<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica;color:black">The University of Virginia Press<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Helvetica;color:black">Email: dsewell@virginia.edu Tel: +1 434 924 9973</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Alpine-info <alpine-info-bounces@mailman12.u.washington.edu> on behalf of Eduardo Chappa <alpine.chappa@yandex.com><br>
<b>Date: </b>Thursday, April 21, 2022 at 10:46 AM<br>
<b>To: </b>Carl Edquist <gatetman@gmail.com><br>
<b>Cc: </b>"alpine-info@u.washington.edu" <alpine-info@u.washington.edu><br>
<b>Subject: </b>Re: [Alpine-info] O365 XOAUTH2 via fetchmail<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On Thu, 21 Apr 2022, Carl Edquist wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-right:0in" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<p class="MsoNormal">If they give you trouble, perhaps you can get a "doctor's note" from the
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">maintainer...<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The main problem might be ignorance (not intentional) from the
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">administrator of the server. For them "Alpine" might sound like "Aunt
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Mary's Magic Email Program", hence the fear of the unknown: I cannot trust
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">access to the server to something I have not heard of before.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Here are some arguments that can be used to advocate for allowing Alpine
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">access to a server.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">1. Alpine respects your privacy: It uses your data only for the purposes<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> intended by the user. This means that it will no access your data<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> unless it needs to and only to accomplish the tasks that the user<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> needs. Alpine does not share any of the information it collects with<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> any other person or entity. The privacy policy is posted at<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <a href="https://alpine.x10host.com/legal/privacy.html">https://alpine.x10host.com/legal/privacy.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">2. Alpine uses XOAUTH2 to login a user to their resources. Alpine does not<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> need to use username/password (which is considered "less" safe) to<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> access a server. If an administrator does not want a user to use<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> username/password it can be disabled from the server side to make sure<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Alpine users never use their password.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">3. Since Alpine supports XOAUTH2, it also supports two-factor<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> authentication. Alpine opens a link to complete the XOAUTH2<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> authorization stage, and while doing so it can complete two-factor<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> authentication.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">4. Alpine does not attempt to access data that it is not allowed to. This<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> means that Alpine will not attempt to access contacts or calendar<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> information that it is not allowed to. The only access that is required<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> to run Alpine is to be able to fully manage email: read, delete, modify<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> and send email.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">5. Alpine is already widely deployed across the world. Alpine is<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> distributed by all mayor linux distributions: Ubuntu, Debian, Fedora,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> Opensuse and many more. Its user basis comes mostly from North America<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> and Europe, and internet searches show that it is used in universities<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> across the world. Here are some links that show administrators at<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> places around the world helping users configure Alpine to access their<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> servers:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <a href="https://kb.mit.edu/confluence/pages/viewpage.action?pageId=164758928">https://kb.mit.edu/confluence/pages/viewpage.action?pageId=164758928</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <a href="https://engineering.purdue.edu/ECN/Support/KB/Docs/UsingAlpinewitho365">https://engineering.purdue.edu/ECN/Support/KB/Docs/UsingAlpinewitho365</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <a href="https://espace.cern.ch/mmmservices-help/AccessingYourMailbox/Alpine/Pages/default.aspx">https://espace.cern.ch/mmmservices-help/AccessingYourMailbox/Alpine/Pages/default.aspx</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> There are many more.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">6. The implementation of Alpine using XOAUTH2 has been available for<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> years. This means it has also been tried and tested by many users<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> around the world. If there had been any problems or security<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> concerns with its implementation those problems would already by<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> posted somewhere. The only problems that have been reported for Alpine<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> in the last few years can be seen for example at this page:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <a href="https://www.cvedetails.com/vulnerability-list/vendor_id-23410/product_id-86426/Alpine-Project-Alpine.html">https://www.cvedetails.com/vulnerability-list/vendor_id-23410/product_id-86426/Alpine-Project-Alpine.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> The fact that this page exists shows that Alpine is widely used around<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> the world.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">7. The developer of Alpine is active in forums, answers to personal<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> email, takes bug reports seriously and addresses them. If any<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> administrator wishes to contact me directly to address any concerns I<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> am happy to speak to them by any means (email, phone, zoom, etc.)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">8. Alpine is in constant development and its code is publicly available<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> and can be found at<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <a href="https://repo.or.cz/alpine.git">https://repo.or.cz/alpine.git</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> so anyone can review its code at any time.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">9. Users have used Alpine for years and amassed a big amount of email<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> distributed over many folders over years. They have been able to access<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> that email and all information in it with Alpine and losing Alpine<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> access might have a devastating effect over the user. This is<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> particularly troublesome for users that do research in universities<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> across the world that need that access.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I hope this helps all of us to talk to administrators and help them see
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">that Alpine is a safe email program. Its interface makes managing email
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">efficient and convenient and that is preferred by many users instead of
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">other more common alternatives that do not match the usage habits of some
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">users of the email service but still makes them efficient workers in their
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">institution.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Eduardo<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Alpine-info mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="mailto:Alpine-info@u.washington.edu">Alpine-info@u.washington.edu</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="http://mailman12.u.washington.edu/mailman/listinfo/alpine-info">http://mailman12.u.washington.edu/mailman/listinfo/alpine-info</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>