Does the lack of changes include no security updates? Then yes, one should be annoyed and Thunderbird usage should be discontinued.

No, security updates are still being made. Here's the release notes for recent security fixes in thunderbird:

https://www.mozilla.org/en-US/security/known-vulnerabilities...

Are the security updates done by Mozilla itself or by the volunteers that continue Thunderbird development?

The security patches are largely from Mozilla's Gecko/SpiderMonkey/Toolkit work. The people who create the patches tend to be Mozilla employees. Looking over the 45.x Thunderbird releases I don't see a single Thunderbird specific security fix. [1]

The team that qualifies and does the release work for Thunderbird are volunteers. I believe that the builds are done on Mozilla hosted hardware.

[1] https://www.mozilla.org/en-US/security/advisories/

why do you care where the patches come from?

One might care where the patches come from as a volunteer community could be less reliable over time than the paid Mozilla staff. I know I certainly feel that way.

But if you prefer security updates from paid employees of an organization rather than volunteers, surely a commercial product rather than a free one would be more suitable for your needs?

Not necessarily. I appreciate the values for which Mozilla stands, and those values are entrenched in their products.

So you're looking for an organisation who will use non-free employees to give you a product for free?

I really don't see your point.

It doesn't feel that way anymore.

In what way? I'm wary of some of Mozilla's decisions, but their allegiance to their mission & manifesto doesn't seem at stake.

> One might care where the patches come from as a volunteer community could be less reliable over time than the paid Mozilla staff. I know I certainly feel that way.

The people who are making these complaints are disproportionately those who have no problem using Debian or Arch, so I don't think that's the crux of the issue for them.

Spoken like a manager.

Something is either being actively developed or it's dieing, there is no in between with software, there is no finished state.

Does being maintained count as being actively developed? I think it should. As long as Thunderbird gets security patches, and maybe even the occasional bug fix, I'm happy with it.

I wish more pieces of software would get to the finished state and would slip into maintenance mode.

Probably not. Developers are fickle and few like to do maintenance only work. So even if it's still getting security patches they are likely to be losing the institutional knowledge to continue that in future, not to mention keeping up with things like API changes for gmail integration.

Which Gmail APIs? Has there been an update to IMAP that I'm not aware of?

GMail has been pushing for its custom XOAUTH2 authentication for a while, and password-based authentication can result in security warnings. Password-based authentication also doesn't support 2FA.

By the way - the IETF standardised an OAuth2 SASL mechanism (RFC 7628) a couple of years ago, no idea why GMail doesn't support it.

This one?

https://developers.google.com/gmail/api/

I'm asking which Gmail APIs would Thunderbird have to keep up with. As far as I know, it never used that API, hence it doesn't have to keep up with it.

Sorry, didn't understand you right.

Basically, the only thing that is kind-of Gmail specific is the auth support (https://bugzilla.mozilla.org/show_bug.cgi?id=849540). If Gmail sometimes in future switches from OAuth2 to some other protocol, the client will have to be updated.

I haven't used thunderbird in a while, have they not added an easy setup for people using the popular online mail servers yet?

It seems that they have. I just started using Thunderbird again after a number of years and the setup to connect to my gmail account has been simplified to confirming the settings on one page with three auto-filled fields.

You don't need an API for that, just a few hardcoded settings that get auto-filled based on the domain.

That certainly sounds nice but it's not true. Or at the very least depends on how you define software. If software is built upon an evolving platform (such as the web) and has a self-supplying revenue stream if it needs one at all, then it can be done and will last.

Even for embedded software though, if something hasn't been looked at for years then the original developers probably don't remember it and may not still be around. If a client want's a feature or tweak then the institutional knowledge is gone and the best bet would be starting from scratch.

Maybe it's something that is of value to a lot of users and a non-profit (http://www.computerworld.com/article/3011418/web-browsers/mo...) might help move that important software in the future. Like a competitive open-source browser, a competitive mail client is a good thing. Not everyone want to use the cloud.

Well, at some point OS compatibility will break, no?