#944818 Installation of proprietary exchange addon is encouraged without adequate explanation

Package:
thunderbird
Source:
thunderbird
Description:
mail/news client with RSS, chat and integrated spam filter support
Submitter:
Thomas Karpiniec
Date:
2019-11-16 05:21:03 UTC
Severity:
normal
#944818#5
Date:
2019-11-15 21:55:20 UTC
From:
To:
When I attempt to set up an account ending in `@outlook.com' it defaults
to an account type of `Exchange'. This requires support from a
third-party closed source addon. The Thunderbird UI prompts me to
install this with a small picture of a blue owl and a single button that
says `Install Now'.

I pressed the button, went through the Exchange sign-on process and
gained access to my email.

When I reviewed the addons manually I realised I had installed a one
month free trial of a proprietary addon named `Owl for Exchange'.

Prompting users to install proprietary addons for convenience is not
unusual - Firefox does it for media DRM - however this particular
instance strikes me as a UI dark pattern. Had I been properly informed
that this was closed-source software that I would need to pay for one
month later, I would have stuck with IMAP.

I have nothing against the addon and no reason to doubt the intentions
of its developers. It seemed to work well while I had it installed. As a
user, particularly on a free software distribution like Debian, I would
prefer a fuller explanation in the UI before I download and execute it.

#944818#10
Date:
2019-11-15 22:15:53 UTC
From:
To:
Hi,

Am 15.11.19 um 22:55 schrieb Thomas Karpiniec:
...

we package upstream software and remove non-free stuff if needed. The
thing your are requesting isn't a job for Debian, this is in the end
something upstream needs to do.

But I'm wondering a bit about your report at all. You've written you did
set up an account for the *proprietary* Outlook.com service but you do
complain that Thunderbird has installed a plugin to access that
proprietary service automatically that costs money? Sorry, I don't get it.

Using free software to use a proprietary service makes that service
still not better if you would use it by only free additional tools.
Even GMail is better here as it is using standard protocols. So I'd
suggest GMail hor any other email service provider ere that isn't using
it's own closed source protocol.

#944818#15
Date:
2019-11-15 22:27:00 UTC
From:
To:
Okay, fair enough. I thought this might fall within what Debian may
consider patching. I guess not.

The Outlook.com email service can be accessed using POP, IMAP, _or_
their proprietary Exchange protocol. Indeed I began the account setup
process fully intending to use IMAP.

Thunderbird's behaviour in this case was to guide me towards to the
third, proprietary option, even when this isn't necessary, and when
support for that option requires the proprietary addon.

Regardless, if this isn't a concern for Debian specifically I'm happy to
take it upstream. Thanks!

#944818#20
Date:
2019-11-15 23:40:31 UTC
From:
To:
Hi again, this report is redundant sorry.

In the last two weeks there has been urgent upstream activity in
resolving this problem[1]. I missed it when I was searching around a
week ago.

I suppose some Debian stable users may suffer from surprise trial
expirations for a while, but it's not a fatal issue.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1592258

#944818#25
Date:
2019-11-16 05:19:09 UTC
From:
To:
Hi,

Am 16.11.19 um 00:40 schrieb Thomas Karpiniec:

if things don't go heavily wrong we can upload the new versions for
buster and stretch (based on 1:68.2.2-1) within the next hours. The
build environment in both releases is differ from testing and unstable
and tthe adjustments takes always a lot of time for the first new ESR
version.

But the release finally is made by the security team. This will not fix
your issue but makes it easier to get other new versions prepared for
the *-security suites.