You can read html emails in mutt with decent support, using "links" or a somilar app. Mutt let's you define application that generate dumps for a given MIME type.

See: https://www.debian-administration.org/article/75/Reading_HTM...

I used to use mutt (now i use mu4e) and indeed i do not own a mobile phone capable of more than GSM. Also, as mentioned elsewhere, HTML rendering works fine in mutt and mu4e (although perhaps this opens me up to various nefarious things).

I don't do this because i'm a security expert (i'm not), i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard.

EDIT: Oh yeah, and i'd never trust my web browser with my PGP key...

> i just love speed (so AJAX and fancypants websites are out for me, i'll use the terminal or Emacs where possible) and the keyboard.

The trouble is that most people who say this end up doing 6 things that take 200 ms each (with the keyboard) instead of 1 thing that takes 1 second (with the mouse), and feel like they're zooming along in hyperspace. You feel like a leet hacker, but are you really getting anything done more efficiently?

> are you really getting anything done more efficiently?

Maybe not, but is that 200ms improvement when using the mouse really worth it if i get all warm and fuzzy-feeling by being able to type something? :p Intangible benefits, yo.

More seriously though, i also feel (personally -- maybe i'm an outlier) like switching from keyboard to mouse and back is a bit of a performance hit, so i tend to concentrate my workflow around the keyboard as much as possible. And yeah, maybe (99% certainly!) i'm not the leetest or fastest h4x0r out there, but at least i'm enjoying myself :).

(i would be curious about an actual test case though -- maybe someone could design a few common tasks to complete using one's favourite HID and compare!)

> What about mail on a mobile phone (I guess security experts do not use them)?

Just to note that I'm not a security expert, but I never check email on my phone. Just don't need to.

Whilst I realise mobile devices are very popular, there are a lot of people who don't require checking email when they're not at a desk.

> So who cares if you write your email in text mode but browse the web with Chrome/Firefox?

On a server owned by somebody else, which the US government can fully spy on, seize and lock down at a whim.

Now try that with a privately owned and administered server.

You think the US government doesn't have full access to your private server? If it's located within the US they have full physical access. If it's located outside the US it's a valid target for all the TLAs.

If the government is on your list of threats you need a lot more than "private mail server".

> If it's located within the US they have full physical access.

If I were to live in the US, I would know when my server went missing. With Google or other cloud-providers they can do it behind your back.

> If it's located outside the US it's a valid target for all the TLAs.

And then can't seize it. It's physically secure. It may not be bullet-proof security-wise (what is?) but they can't rubber-stamp their way into it.

And for some people that's quite an important aspect.

Amen, this whole "if it's not 100% secure why bother" argument is annoying, we can still make it hard for them.

We can, and we definitely should.

It makes it easier for them.

what does? housing mail outside the US? outside of their partner companies or previously breached companies (in the case of google).

I mean, if you have a remote server- it's lawful for them to snoop (by their own law), but it certainly makes it harder, to gain access and maintain access- as these systems may be wildly different and hosts will be varying degrees of paranoid.

With tremendous respect to Linus, this isn't a fair characterization of the "security community", whatever that means. There are both practitioners and vendors who take the view that security should enable business, not block it; there are groups of experts who run contrary to this, and believe in a reductive and restrictive approach to everything. The continuum of thought around what it means to be secure, especially when dealing with organizational security, seems to be shifting towards the former, rather than the latter.

As far as Linus' statements go, saying that security is imperfect by design isn't a new take on it, and I'm in complete agreement with you that it needs to be something that regular users can benefit from.