Mozilla no longer developing Thunderbird

[Eric Moore]

> Yesterday Mitchell Baker posted on the future of Thunderbird:
> http://blog.lizardwrangler.com/

1. "Support will continue to be provided by the Thunderbird community
and Mozilla will continue to provide the required infrastructure."

Is the official support forum part of the required infrastructure? The
proposal should include a overview of the required infrastructure, and
what is being explicitly dropped.

The proposal doesn't address several issues such as who will maintain
the ISP database, and what happens to account provisioning (is anybody
left authorized to sign contracts with new email providers?).

2. "At the same time, Thunderbird will be released with the same feature
set as Thunderbird ESR and will be updated every six-weeks for security
and stability."

Does that include updating Thunderbird to use the latest version of Gecko?

Given the existing problems maintaining and testing Thunderbird I am
confused why the proposal keeps the "new development process" (update
every 6 weeks, including latest Gecko). I'd have expected a slower
release schedule so that the fewer resources have a easier time
maintaining the software and there is a more consistent platform (to
make it easier to get and integrate contributions from the community).
If Mozilla believes "it is quite possible that Thunderbird is already
pretty much what its users want and there is not a high demand for
innovation in this field." why do we need the "new development process"?

I don't see the need for security patches every six weeks for a email
client. People can still safely use 2.0.0.24 if they apply common sense.
The security advisories seem to deliberately inflate the impact of
potential problems. I'd argue that a new release every 6 weeks actually
contributes to stability problems, especially if there is no longer a QA
lead.

3. SeaMonkey is a community effort hosted by and under the legal
protection of the Mozilla Foundation, with the SeaMonkey Council
providing the project leadership. SeaMonkey would seem a better model
than maintaining the status quo with a fraction of the existing resources.

Most of the Thunderbird module owners seem to be Mozilla employees. Its
not clear why that would change anytime soon. I'm worried that the
project will continue to pay the political cost of being a Mozilla
project (many decisions dictated by what Firefox does or Mozilla's
roadmaps) while losing most of its resources. That doesn't seem viable.

4. It would help if a few features developed over a long time that are
near completion such as maildir support were finished and there was some
sort of explicit exit criteria to have a smooth handoff rather than
development ending as soon as a new governance model was established.
That doesn't necessarily require more investment by Mozilla, it might be
done by prioritizing what needs to get done before the transition.

https://wiki.mozilla.org/Features/Thunderbird

It wouldn't hurt to evaluate removing some half-way finished
implementations (such as anti-phishing, which most people disable) that
will probably never be finished due to lack of interest in order to make
Thunderbird a little easier to maintain.

5. The proposal doesn't mention the impact on SeaMonkey. My impression
is they leverage bug fixes and new features developed by Mozilla for
Thunderbird, and this means they are going to have to divert some of
their limited resources. Some volunteers such as rsx11m seem to work on
both projects. Perhaps there needs to be some more explicit coordination
to help deal with the common lack of resources.

6. "We have come to the conclusion that continued innovation on
Thunderbird is not a priority for Mozilla and that the most critical
needs for the product are on-going security and stability. In fact, it
is quite possible that Thunderbird is already pretty much what its users
want and there is not a high demand for innovation in this field. "

Users want a product that is under active development and has a future,
even if they don't really care about the new features or get annoyed by
some of the changes. I suspect many users will interpret the re-focusing
of efforts as Mozilla abandoning Thunderbird, and will look for
alternative email clients since they don't perceive the community as
providing enough development. I think there would have been a much
better reaction if Mozilla had announced they were reducing staffing
levels (there were only two full time employees for a good while) but
would continue new development at a slower pace.





_______________________________________________
tb-planning mailing list
tb-pl...@mozilla.org
https://mail.mozilla.org/listinfo/tb-planning

[Joshua Cranmer]

On 7/7/2012 5:34 PM, Eric Moore wrote:
> 3. SeaMonkey is a community effort hosted by and under the legal
> protection of the Mozilla Foundation, with the SeaMonkey Council
> providing the project leadership. SeaMonkey would seem a better model
> than maintaining the status quo with a fraction of the existing
> resources.
>
> Most of the Thunderbird module owners seem to be Mozilla employees.
> Its not clear why that would change anytime soon. I'm worried that the
> project will continue to pay the political cost of being a Mozilla
> project (many decisions dictated by what Firefox does or Mozilla's
> roadmaps) while losing most of its resources. That doesn't seem viable.

The module ownership is currently undergoing revisions; I know that one
of the people who owns multiple modules has just left the company.

> 6. "We have come to the conclusion that continued innovation on
> Thunderbird is not a priority for Mozilla and that the most critical
> needs for the product are on-going security and stability. In fact, it
> is quite possible that Thunderbird is already pretty much what its
> users want and there is not a high demand for innovation in this field. "
>
> Users want a product that is under active development and has a
> future, even if they don't really care about the new features or get
> annoyed by some of the changes. I suspect many users will interpret
> the re-focusing of efforts as Mozilla abandoning Thunderbird, and will
> look for alternative email clients since they don't perceive the
> community as providing enough development. I think there would have
> been a much better reaction if Mozilla had announced they were
> reducing staffing levels (there were only two full time employees for
> a good while) but would continue new development at a slower pace.

A significant amount of Thunderbird development resources comes from
community members; some of our biggest changes were brought about by
people never employed by Mozilla (the conversations add-on or jminta's
de-RDF project). My understanding of the current situation is that the
current Mozilla employees would be allowed some time to work on
Thunderbird, but it would not be their main focus. In particular, I
think Mike Conley would still be allowed to work on his new address book
project. I cannot confirm this for certain, though.

--
Joshua Cranmer
News submodule owner
DXR coauthor

[Wayne Mery (d531)]

On 7/8/2012 9:51 AM, Joshua Cranmer wrote:
> On 7/7/2012 5:34 PM, Eric Moore wrote:
>> 3. SeaMonkey is a community effort hosted by and under the legal
>> protection of the Mozilla Foundation, with the SeaMonkey Council
>> providing the project leadership. SeaMonkey would seem a better model
>> than maintaining the status quo with a fraction of the existing
>> resources.
>>
>> Most of the Thunderbird module owners seem to be Mozilla employees.
>> Its not clear why that would change anytime soon. I'm worried that the
>> project will continue to pay the political cost of being a Mozilla
>> project (many decisions dictated by what Firefox does or Mozilla's
>> roadmaps) while losing most of its resources. That doesn't seem viable.
>
> The module ownership is currently undergoing revisions; I know that one
> of the people who owns multiple modules has just left the company.

There are module owners and peers who are not mozilla employees. I'm not
sure why we would deprive ourselves of the people who are most
knowledgable about a module, given that there is currently at lack of
owners and peers for many other modules. In other words, we seem to
have a shortage.

What I think you are really seeking is "who decides" priorities, and
what changes go in and what doesn't. That's somewhat more a govenerance
issue and only tangentially related who are module owners.

>> 6. "We have come to the conclusion that continued innovation on
>> Thunderbird is not a priority for Mozilla and that the most critical
>> needs for the product are on-going security and stability. In fact, it
>> is quite possible that Thunderbird is already pretty much what its
>> users want and there is not a high demand for innovation in this field. "
>>
>> Users want a product that is under active development and has a
>> future, even if they don't really care about the new features or get
>> annoyed by some of the changes. I suspect many users will interpret
>> the re-focusing of efforts as Mozilla abandoning Thunderbird, and will
>> look for alternative email clients since they don't perceive the
>> community as providing enough development.

Perhaps this will be controversial, but I believe "the community" shares
some blame here. How often do the more active people in the community
ask/challenge/encourage users to get involved?

I certainly don't see this in public. Does it happen only in private?

>> I think there would have
>> been a much better reaction if Mozilla had announced they were
>> reducing staffing levels (there were only two full time employees for
>> a good while) but would continue new development at a slower pace.

But we don't have that option.

[Mark Banner]

On 07/07/2012 22:34, Eric Moore wrote:
>> Yesterday Mitchell Baker posted on the future of Thunderbird:
>> http://blog.lizardwrangler.com/
>
> 1. "Support will continue to be provided by the Thunderbird community
> and Mozilla will continue to provide the required infrastructure."
>
> Is the official support forum part of the required infrastructure? The
> proposal should include a overview of the required infrastructure, and
> what is being explicitly dropped.

No infrastructure will be dropped.

> The proposal doesn't address several issues such as who will maintain
> the ISP database

The ISP database has at least one community member already doing reviews
for new entries, I believe the reviews can be done by almost anyone with
a knowledge of the APIs, but I'm sure Ben can correct me if I'm wrong.

For the server part of the ISP database, that's within Mozilla. If the
GSoC student completes the work on the new ISPDB application, then that
could be hosted somewhere and the ISP database run from there.

> 2. "At the same time, Thunderbird will be released with the same
> feature set as Thunderbird ESR and will be updated every six-weeks for
> security and stability."
>
> Does that include updating Thunderbird to use the latest version of
> Gecko?

It doesn't.

> I don't see the need for security patches every six weeks for a email
> client. People can still safely use 2.0.0.24 if they apply common sense.

I'd challenge that assertion. When new releases come out, the details of
the possible security exploits are known. It is very common to hear of
hack kits including those exploits as then they can catch older users
who haven't updated. Whilst we don't hear of many attacks on email at
the moment, users of anything that isn't current are at significant risk
if a hacker decides to target them. Whilst there may be safer practices,
that doesn't protect against every eventuality.

> The security advisories seem to deliberately inflate the impact of
> potential problems. I'd argue that a new release every 6 weeks
> actually contributes to stability problems, especially if there is no
> longer a QA lead.

I think you're basing this argument on the assumption that we'll update
gecko every 6 weeks, as that isn't true, then I don't think this is a
real concern.

> 3. ...

> Most of the Thunderbird module owners seem to be Mozilla employees.
> Its not clear why that would change anytime soon. I'm worried that the
> project will continue to pay the political cost of being a Mozilla
> project (many decisions dictated by what Firefox does or Mozilla's
> roadmaps) while losing most of its resources. That doesn't seem viable.

"Most" may be currently true, although we are in the middle of a
revision to bring that more up to date. We are open (and always have
been) to welcome contributors stepping up to ownership roles, although
obviously as you indicate there would be a ramp-up time for that to happen.

I would say though, that removing the existing owners without
replacements that have the experience would actually put the project in
a worse place as it would remove that experience of people that are
still willing to help.

> 4. It would help if a few features developed over a long time that are
> near completion such as maildir support were finished and there was
> some sort of explicit exit criteria to have a smooth handoff rather
> than development ending as soon as a new governance model was
> established. That doesn't necessarily require more investment by
> Mozilla, it might be done by prioritizing what needs to get done
> before the transition.

Most of the features that are in progress should be incorporated before
the new model, although obviously at this stage, we won't know the full
details.

> 5. The proposal doesn't mention the impact on SeaMonkey. My impression
> is they leverage bug fixes and new features developed by Mozilla for
> Thunderbird, and this means they are going to have to divert some of
> their limited resources. Some volunteers such as rsx11m seem to work
> on both projects. Perhaps there needs to be some more explicit
> coordination to help deal with the common lack of resources.

I believe there won't be a significant amount of change for SeaMonkey,
though there may be some, and they are in a better position to assess it
as we progress through the detail.

Mark

[Karsten Düsterloh]

Mark Banner aber hob zu reden an und schrieb:

>> 2. "At the same time, Thunderbird will be released with the same
>> feature set as Thunderbird ESR and will be updated every six-weeks for
>> security and stability."
>>
>> Does that include updating Thunderbird to use the latest version of
>> Gecko?
> It doesn't.

What does this mean?
TB won't get _any_ updates to new Gecko versions?
Or TB won't get updated to _all_ Gecko versions?

>> 5. The proposal doesn't mention the impact on SeaMonkey. My impression
>> is they leverage bug fixes and new features developed by Mozilla for
>> Thunderbird, and this means they are going to have to divert some of
>> their limited resources. Some volunteers such as rsx11m seem to work
>> on both projects. Perhaps there needs to be some more explicit
>> coordination to help deal with the common lack of resources.
> I believe there won't be a significant amount of change for SeaMonkey,
> though there may be some, and they are in a better position to assess it
> as we progress through the detail.

As a general rule, we try to embrace TB fixes/features as we see fit
(and have people writing the code), but we don't actually depend on them.


Karsten

[Jb Piacentino]

On 08/07/2012 19:10, Karsten Düsterloh wrote:
> Mark Banner aber hob zu reden an und schrieb:
>>> 2. "At the same time, Thunderbird will be released with the same
>>> feature set as Thunderbird ESR and will be updated every six-weeks for
>>> security and stability."
>>>
>>> Does that include updating Thunderbird to use the latest version of
>>> Gecko?
>> It doesn't.
> What does this mean?
> TB won't get _any_ updates to new Gecko versions?
> Or TB won't get updated to _all_ Gecko versions?

This means that Thunderbird and Thunderbird ESR will use Gecko 17, which
will be updated for security and stability avery 6 weeks, for the whole
54 weeks ESR cycle duration. Beyond that, we'll switch to ESR 24, and so
on..

[Karsten Düsterloh]

Eric Moore aber hob zu reden an und schrieb:

> 3. SeaMonkey is a community effort hosted by and under the legal
> protection of the Mozilla Foundation, with the SeaMonkey Council
> providing the project leadership. SeaMonkey would seem a better model
> than maintaining the status quo with a fraction of the existing resources.

I (as a member of the SeaMonkey Council) am not quite sure at what you
are suggesting here …

> 5. The proposal doesn't mention the impact on SeaMonkey. My impression
> is they leverage bug fixes and new features developed by Mozilla for
> Thunderbird, and this means they are going to have to divert some of
> their limited resources. Some volunteers such as rsx11m seem to work on
> both projects. Perhaps there needs to be some more explicit coordination
> to help deal with the common lack of resources.

As already mentioned, while we try to embrace TB fixes/features as we
see fit (and have people writing the code), we don't actually depend on
them.

> I suspect many users will interpret the re-focusing of efforts as

> Mozilla abandoning Thunderbird, and will look for alternative email
> clients since they don't perceive the community as providing enough
> development.

That's a likely impression if based upon the Mozillian post, but we
should not jump to conclusion before the actual announcement is out, imo.

Karsten

[Ben Bucksch]

On 07.07.2012 23:34, Eric Moore wrote:
> I don't see the need for security patches every six weeks for a email
> client. People can still safely use 2.0.0.24 if they apply common
> sense. The security advisories seem to deliberately inflate the impact
> of potential problems.

As a member of the Mozilla security group, I have to strongly object to
that.

"Common sense" doesn't defend you from bugs in image decoders, for
example, and there have been a number recently. One image from an email
rendered, and your machine and data is toast (or worse, in the wrong
hands). Are you sure you have all image rendering off? A fairly good
protection is the HTML sanitizer, but it can't protect against images
either, and there can be other loopholes.

And the security advisories are not inflated at all. If anything, they
are often understated.

Using an old Thunderbird is like driving a car without brakes. Don't do
it, you're a hazard to yourself and everybody around you.

> I'm worried that the project will continue to pay the political cost
> of being a Mozilla project (many decisions dictated by what Firefox
> does or Mozilla's roadmaps) while losing most of its resources. That
> doesn't seem viable.

ditto, but I hope that ownership is handed to responsible and competent,
yet open-minded community members. These are in very short supply, though.

[Ludovic Hirlimann]

On 7/8/12 5:08 PM, Mark Banner wrote:
> On 07/07/2012 22:34, Eric Moore wrote:
>>> Yesterday Mitchell Baker posted on the future of Thunderbird:
>>> http://blog.lizardwrangler.com/
>>
>> 1. "Support will continue to be provided by the Thunderbird community
>> and Mozilla will continue to provide the required infrastructure."
>>
>> Is the official support forum part of the required infrastructure?
>> The proposal should include a overview of the required
>> infrastructure, and what is being explicitly dropped.
> No infrastructure will be dropped.
>
>> The proposal doesn't address several issues such as who will maintain
>> the ISP database
> The ISP database has at least one community member already doing
> reviews for new entries, I believe the reviews can be done by almost
> anyone with a knowledge of the APIs, but I'm sure Ben can correct me
> if I'm wrong.
>
> For the server part of the ISP database, that's within Mozilla. If the
> GSoC student completes the work on the new ISPDB application, then
> that could be hosted somewhere and the ISP database run from there.
>

On the long term having isp host the files and knowing about it would be
enough that we shouldn't worry about the ispdb. Maybe it should be
pushed to the IETF and published like an RFC.

Ludo

--
@lhirlimann on twitter
https://wiki.mozilla.org/Thunderbird:Testing

my photos http://www.flickr.com/photos/lhirlimann/collections/

[Ludovic Hirlimann]

On 7/8/12 4:35 PM, Wayne Mery (d531) wrote:
>
> There are module owners and peers who are not mozilla employees. I'm
> not sure why we would deprive ourselves of the people who are most
> knowledgable about a module, given that there is currently at lack of
> owners and peers for many other modules. In other words, we seem to
> have a shortage.
>
> What I think you are really seeking is "who decides" priorities, and
> what changes go in and what doesn't. That's somewhat more a
> govenerance issue and only tangentially related who are module owners.

Yes it would be nice to have and probably have a sort of roadmap so
people who want to participate might get ideas on what needs to be
worked on.

[Ludovic Hirlimann]

On 7/8/12 7:28 PM, Karsten Düsterloh wrote:
>> I suspect many users will interpret the re-focusing of efforts as
>> Mozilla abandoning Thunderbird, and will look for alternative email
>> clients since they don't perceive the community as providing enough
>> development.
> That's a likely impression if based upon the Mozillian post, but we
> should not jump to conclusion before the actual announcement is out, imo.
>

After a week-end of reading twitter this how many people interpreted it :(

Ludo

[Philipp Kewisch]

On 7/9/12 10:35 AM, Ludovic Hirlimann wrote:

On 7/8/12 7:28 PM, Karsten Düsterloh wrote:

I suspect many users will interpret the re-focusing of efforts as
Mozilla abandoning Thunderbird, and will look for alternative email
clients since they don't perceive the community as providing enough
development.

That's a likely impression if based upon the Mozillian post, but we
should not jump to conclusion before the actual announcement is out, imo.

After a week-end of reading twitter this how many people interpreted it :(

Yes, thats the same impression that I have been reading of, and that friends have been asking me about. Maybe there should be some sort of clarification?

Philipp

[Joachim Herb]

Hi,

first a link showing how this message was received in the most important
German news site:
http://www.spiegel.de/netzwelt/web/apple-au-verzichtet-auf-epeat-umweltplakette-a-843388.html
http://translate.google.de/translate?sl=de&tl=en&js=n&prev=_t&hl=de&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Fwww.spiegel.de%2Fnetzwelt%2Fweb%2Fapple-au-verzichtet-auf-epeat-umweltplakette-a-843388.html&act=url

But now my concerns: I contributed to some (very) small patches for
Thunderbird, e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=519956
It took 6 month to get the patch into Thunderbird. This was already
laborious. With the 6-week release cycle there was a chance to see your
work included within a reasonable time. Now, if a new version of
Thunderbird is only released once a year and a patch misses that
opportunity, does it mean you have to wait for another year? This does
not sound very motivating.

Joachim

Am 07.07.2012 21:00, schrieb tb-planni...@mozilla.org:
> Send tb-planning mailing list submissions to
> tb-pl...@mozilla.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://mail.mozilla.org/listinfo/tb-planning
> or, via email, send a message with subject or body 'help' to
> tb-planni...@mozilla.org
>
> You can reach the person managing the list at
> tb-plann...@mozilla.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of tb-planning digest..."
>
>
> Today's Topics:
>
> 1. Change of release and governance model for Thunderbird
> (Jb Piacentino)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Sat, 07 Jul 2012 11:39:07 +0200
> From: Jb Piacentino <j...@mozilla.com>
> To: "tb-pl...@mozilla.org" <tb-pl...@mozilla.org>,
> tb-ent...@mozilla.org
> Subject: Change of release and governance model for Thunderbird
> Message-ID: <4FF803B...@mozilla.com>
> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"
>
> Hi,

>
> Yesterday Mitchell Baker posted on the future of Thunderbird:
> http://blog.lizardwrangler.com/

> In summary, we've been focusing efforts towards important web and mobile
> projects, such as FirefoxOS, while Thunderbird remains a pure
> desktop-only email client. We have come to the conclusion that continued
> innovation on Thunderbird is not the best use of our resources given our
> ambitious organizational goals. The most critical needs for the product
> are on-going security and stability for our 20+millions users, either
> individuals, SMEs or large corporate/institutions.
>
> However, Thunderbird is one of the very few truly free and open source
> multi-platform email applications available today and we want to defend
> these values. We're not "stopping" Thunderbird, but proposing we adapt
> the Thunderbird release and governance model in a way that allows both
> ongoing security and stability maintenance, as well as community-driven
> innovation and development for the product.
>
> We are opening the proposed
> <https://wiki.mozilla.org/Thunderbird/Proposal:_New_Release_and_Governance_Model>plan
> for public discussion to individuals and organizations interested in
> maintaining and advancing Thunderbird in the future. We are looking for
> your feedback, comments and suggestions to refine and adapt the plan in
> the best possible way throughout the summer so we can share a final plan
> of action in early September 2012. The tb-planning mailing list
> <https://mail.mozilla.org/listinfo/tb-planning> is the preferred forum
> to have this conversation. I look forward to reading you there.
>
> Thanks,
>
> Jb
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <http://mail.mozilla.org/pipermail/tb-planning/attachments/20120707/e4ab5b4a/attachment-0001.html>
>
> ------------------------------

>
> _______________________________________________
> tb-planning mailing list
> tb-pl...@mozilla.org
> https://mail.mozilla.org/listinfo/tb-planning
>
>

> End of tb-planning Digest, Vol 30, Issue 3
> ******************************************

[Kent James]

On 7/9/2012 10:45 AM, Joachim Herb wrote:
> But now my concerns: I contributed to some (very) small patches for
> Thunderbird, e.g. https://bugzilla.mozilla.org/show_bug.cgi?id=519956
> It took 6 month to get the patch into Thunderbird. This was already
> laborious. With the 6-week release cycle there was a chance to see
> your work included within a reasonable time. Now, if a new version of
> Thunderbird is only released once a year and a patch misses that
> opportunity, does it mean you have to wait for another year? This does
> not sound very motivating.

In the thread "Gecko versions for future Thunderbird releases" I discuss
some of the possible organization of future releases. Using the
terminology from that thread, according to my proposal you would land
your patch on comm-central, which is synced to mozilla-central Gecko and
would for sure land in the annual TB-next and TB-ESR (and would be
available in EarlyBird on the aurora channel prior to that). If the
patch does not cause interface changes, nor depend on the Gecko version,
then it could be nominated for inclusion in the more frequent TB-Main
(with releases perhaps quarterly). That is accomplished by pushing the
patch to comm-beta.

I think that is is a reasonable compromise that allows development to
keep up with Gecko changes, while allowing more stability in TB-Main.

rkent