<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<div>
<p class="MsoNormal">[Re-sending this to the list from my subscribed email address]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">I finally got a reply from my university's manager of Microsoft Services to my request that Alpine be authorized as a client to connect with our Outlook services. This was the response:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="color:black">Hi David, <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;background:white"><span style="color:black">Even if we were to authorize Alpine for use in our tenant its functionality wouldn’t work past August when Microsoft deprecates basic auth with SMTP auth. I feel non outlook
clients are not long for this world in the eyes of Microsoft. <o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is he correct about this? I don't understand the technical details of the various authorization methods but based on what Eduardo says below, the deprecation of basic auth should not be a problem if Alpine is configured correctly? (Eduardo,
should I just forward this admin your email below?)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">David<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">David Sewell<o:p></o:p></p>
<p class="MsoNormal">Manager of Digital Initiatives and Rotunda Imprint<o:p></o:p></p>
<p class="MsoNormal">The University of Virginia Press<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">dsewell@virginia.edu Tel: +1 434 924 9973<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:1.0in"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Alpine-info <alpine-info-bounces@mailman12.u.washington.edu> on behalf of Eduardo Chappa <alpine.chappa@yandex.com><br>
<b>Date: </b>Thursday, April 21, 2022 at 10:46 AM<br>
<b>To: </b>Carl Edquist <gatetman@gmail.com><br>
<b>Cc: </b>"alpine-info@u.washington.edu" <alpine-info@u.washington.edu><br>
<b>Subject: </b>Re: [Alpine-info] O365 XOAUTH2 via fetchmail<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">On Thu, 21 Apr 2022, Carl Edquist wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<p class="MsoNormal" style="margin-left:1.0in">If they give you trouble, perhaps you can get a "doctor's note" from the
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">maintainer...<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">The main problem might be ignorance (not intentional) from the
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">administrator of the server. For them "Alpine" might sound like "Aunt
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Mary's Magic Email Program", hence the fear of the unknown: I cannot trust
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">access to the server to something I have not heard of before.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Here are some arguments that can be used to advocate for allowing Alpine
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">access to a server.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">1. Alpine respects your privacy: It uses your data only for the purposes<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> intended by the user. This means that it will no access your data<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> unless it needs to and only to accomplish the tasks that the user<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> needs. Alpine does not share any of the information it collects with<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> any other person or entity. The privacy policy is posted at<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <a href="https://alpine.x10host.com/legal/privacy.html">https://alpine.x10host.com/legal/privacy.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">2. Alpine uses XOAUTH2 to login a user to their resources. Alpine does not<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> need to use username/password (which is considered "less" safe) to<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> access a server. If an administrator does not want a user to use<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> username/password it can be disabled from the server side to make sure<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> Alpine users never use their password.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">3. Since Alpine supports XOAUTH2, it also supports two-factor<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> authentication. Alpine opens a link to complete the XOAUTH2<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> authorization stage, and while doing so it can complete two-factor<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> authentication.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">4. Alpine does not attempt to access data that it is not allowed to. This<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> means that Alpine will not attempt to access contacts or calendar<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> information that it is not allowed to. The only access that is required<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> to run Alpine is to be able to fully manage email: read, delete, modify<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> and send email.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">5. Alpine is already widely deployed across the world. Alpine is<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> distributed by all mayor linux distributions: Ubuntu, Debian, Fedora,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> Opensuse and many more. Its user basis comes mostly from North America<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> and Europe, and internet searches show that it is used in universities<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> across the world. Here are some links that show administrators at<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> places around the world helping users configure Alpine to access their<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> servers:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <a href="https://kb.mit.edu/confluence/pages/viewpage.action?pageId=164758928">https://kb.mit.edu/confluence/pages/viewpage.action?pageId=164758928</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <a href="https://engineering.purdue.edu/ECN/Support/KB/Docs/UsingAlpinewitho365">https://engineering.purdue.edu/ECN/Support/KB/Docs/UsingAlpinewitho365</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <a href="https://espace.cern.ch/mmmservices-help/AccessingYourMailbox/Alpine/Pages/default.aspx">https://espace.cern.ch/mmmservices-help/AccessingYourMailbox/Alpine/Pages/default.aspx</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> There are many more.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">6. The implementation of Alpine using XOAUTH2 has been available for<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> years. This means it has also been tried and tested by many users<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> around the world. If there had been any problems or security<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> concerns with its implementation those problems would already by<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> posted somewhere. The only problems that have been reported for Alpine<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> in the last few years can be seen for example at this page:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <a href="https://www.cvedetails.com/vulnerability-list/vendor_id-23410/product_id-86426/Alpine-Project-Alpine.html">https://www.cvedetails.com/vulnerability-list/vendor_id-23410/product_id-86426/Alpine-Project-Alpine.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> The fact that this page exists shows that Alpine is widely used around<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> the world.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">7. The developer of Alpine is active in forums, answers to personal<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> email, takes bug reports seriously and addresses them. If any<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> administrator wishes to contact me directly to address any concerns I<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> am happy to speak to them by any means (email, phone, zoom, etc.)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">8. Alpine is in constant development and its code is publicly available<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> and can be found at<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> <a href="https://repo.or.cz/alpine.git">https://repo.or.cz/alpine.git</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> so anyone can review its code at any time.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">9. Users have used Alpine for years and amassed a big amount of email<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> distributed over many folders over years. They have been able to access<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> that email and all information in it with Alpine and losing Alpine<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> access might have a devastating effect over the user. This is<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> particularly troublesome for users that do research in universities<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"> across the world that need that access.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">I hope this helps all of us to talk to administrators and help them see
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">that Alpine is a safe email program. Its interface makes managing email
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">efficient and convenient and that is preferred by many users instead of
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">other more common alternatives that do not match the usage habits of some
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">users of the email service but still makes them efficient workers in their
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">institution.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Eduardo<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in">Alpine-info mailing list<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><a href="mailto:Alpine-info@u.washington.edu">Alpine-info@u.washington.edu</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><a href="http://mailman12.u.washington.edu/mailman/listinfo/alpine-info">http://mailman12.u.washington.edu/mailman/listinfo/alpine-info</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
</div>
</div>
</body>
</html>