mpop: news archive

• November 14, 2016: mpop 1.2.6 is released!
  This release improves error exit codes when multiple accounts are queried.
• May 31, 2016: mpop 1.2.5 is released!
  The TLS certificate fingerprinting feature now uses SHA256 fingerprints.
• February 1, 2016: mpop 1.2.4 is released!
  This release now uses the system default policy with GnuTLS instead of a hardcoded one.
• November 15, 2015: mpop 1.2.3 is released!
  This release fixes a bug in SOCKS proxy support and the handling of non-fatal errors in TLS handshakes.
  Note that starting from this version, we do not provide binaries for Windows platforms anymore.
• January 13, 2015: mpop 1.2.2 is released!
  This release ignores nonsensical POP3 mail and mailbox sizes (e.g. negative values) instead of reporting an error. Furthermore, a few minor issues related to IDN support were fixed.
• January 5, 2015: mpop 1.2.1 is released!
  This release fixes a problem on platforms where glibc does not support Internationalized Domain Names (IDN).
• December 30, 2014: mpop 1.2.0 is released!
  This is the new stable release. The 1.0.x series is put to rest after 7.5 years. But do not worry: 1.2.0 is fully compatible with 1.0.x. Noteworthy changes since 1.0.29:
  • Support for SOCKS proxies was added. This allows mpop to be used with Tor.
  • GNOME Keyring support now uses libsecret instead of libgnome-keyring. Consequently, secret-tool can be used to manage passwords for mpop; the obsolete mpop-gnome-tool script is removed.
  • Libidn is not required for IDN support anymore on systems where getaddrinfo() supports the AI_IDN flag and the GnuTLS version is >= 3.4.0.
  • SSLv3 is disabled.
  • The GSSAPI authentication method is not chosen automatically anymore, you have to request it manually if you want it.
  • Configuration file permissions are now only checked if the file actually contains secrets such as passwords. (If you still store passwords in the configuration file, consider using a key ring or the the passwordeval command instead.)
  • The documentation was updated and improved.
  Enjoy!
• December 17, 2014: mpop 1.2.0rc3 is released!
  This is the third release candidate for the next stable version 1.2.0. Changes since 1.2.0rc2:
  • Authentication with Microsoft Exchange servers was fixed
  • Libsecret support was improved further
  • The vim syntax file was updated
  • A few minor problems were fixed
  Please test!
• December 9, 2014: mpop 1.2.0rc2 is released!
  This is the second release candidate for the next stable version 1.2.0. Changes since 1.2.0rc1:
  • Gnome Keyring passwords can now be managed with secret-tool (part of libsecret).
  • Configuration file security checks are now only performed if the file actually contains passwords (which is not necessary anymore since we have passwordeval and key ring support).
  Please test!
• December 2, 2014: mpop 1.2.0rc1 is released!
  This is a release candidate for the next stable version 1.2.0. It contains a few more new features and changes than usual, but is still compatible to versions 1.0.x. The most important changes are:
  • Support for SOCKS proxies was added. This allows mpop to be used with Tor.
  • SSLv3 is disabled
  • Gnome Keyring support now uses libsecret
  • Libidn is not required for IDN support anymore on new systems
  Please test!
• March 9, 2014: mpop 1.0.29 is released!
  This release fixes a minor bug in command line parsing.
• April 22, 2013: mpop 1.0.28 is released!
  This release fixes building the documentation with texinfo version 5.x.
• May 1, 2012: mpop 1.0.27 is released!
  This version fixes a minor problem with a network-related error message.
• January 7, 2012: mpop 1.0.26 is released!
  This version fixes a problem with configurations that use OpenSSL and at the same time do not use GNU SASL. (If you use a different configuration, there's no reason to upgrade.)
• October 16, 2011: mpop 1.0.25 is released!
  This release fixes a few problems, and marks DIGEST-MD5 authentication as deprecated (see RFC 6331).
• April 27, 2011: mpop 1.0.24 is released!
  This is a cleanup release that updates the build system and removes old cruft and unnecessary complexity, without changing the functionality of the program.
• January 17, 2011: mpop 1.0.23 is released!
  This release fixes SCRAM-SHA-1 authentication via GNU SASL.
  If you use a version of mpop that supports SCRAM-SHA-1 authentication via libgsasl (see the output of mpop --version), then an update is recommended.
• December 30, 2010: mpop 1.0.22 is released!
  This release adds a passwordeval command that allows to set the password to the output of a program invocation.
• July 3, 2010: mpop 1.0.21 is released!
  This minor update mainly fixes build problems with newer OpenSSL versions and with disabled TLS/SSL support.
• March 20, 2010: mpop 1.0.20 is released!
  This release adds support for authentication mechanism SCRAM-SHA-1 via GNU SASL. The new command tls_fingerprint allows one to trust one particular TLS certificate, in case tls_trust_file cannot be used for some reason. The new script mpop-gnome-tool.py manages Gnome Keyring passwords for mpop.
• October 24, 2009: mpop 1.0.19 is released!
  This release contains a security fix: When using OpenSSL, NUL characters in the Common Name or Subject Alternative Name fields of certificates are now handled properly. This fixes the problem described here. Note that mpop is not affected by this problem if GnuTLS is used.
Furthermore, mpop can now handle mail boxes larger than 2 GiB even on 32bit systems (previously, this worked only on 64bit systems).

• September 8, 2009: mpop 1.0.18 is released!
  This release adds support for delivery to Exchange pickup directories and fixes some minor problems.
  
• April 11, 2009: mpop 1.0.17 is released!
  This release fixes some minor glitches.
  The source code repository moved from CVS to Git.
• December 27, 2008: mpop 1.0.16 is released!
  This release adds support for storing passwords in the GNOME keyring.
  Update: The binary for Windows contained a bug and was replaced by version 1.0.16+20081227.
• September 18, 2008: mpop 1.0.15 is released!
  This release fixes two bad bugs:
  • With certain POP3 servers, mpop would in rare cases fail to read an UIDLS file correctly.
  • Mpop failed to correctly retrieve mails that have no mail body (the much more common case of mails with empty mail bodies was handled correctly, that's why this longstanding bug was not found earlier).
  Everyone is encouraged to upgrade!
• June 7, 2008: mpop 1.0.14 is released!
  The following changes are noteworthy in this release:
  • Performance is further improved by a new approach to handle UIDs. This is especially noticable with large mail boxes (many thousands of mails).
  • TLS/SSL configurability is improved by the new commands tls_crl_file, tls_priorities, and tls_min_dh_prime_bits.
• March 13, 2008: mpop 1.0.13 is released!
  Support to store passwords using the Mac OS X keychain was added by Jay Soffian. Performance problems when using GnuTLS were fixed.
• November 28, 2007: mpop 1.0.12 is released!
  This release fixes some minor bugs.
• September 18, 2007: The LinuxUser Magazine (in german) has an article about mpop in issue 10/2007, to be released on September 20, 2007. The article was written by Andreas Kneib.
  The magazine already ran an article by the same author on msmtp in issue 04/2005. Msmtp shares much of its source code with mpop.
• August 1, 2007: mpop 1.0.11 is released!
  Bug fixes and improvements for large POP3 mail boxes with thousands of mails were made, thanks to Dimitrios Apostolou.
  The license was updated to GPLv3 or later (source code) and GFDLv1.2 or later (documentation).
• June 7, 2007: mpop 1.0.10 is released!
  A bug in the UID handling code was fixed. The bug was introduced in version 1.0.7.
  As a consequence, if you update from version 1.0.7-1.0.9, the first invocation of this new mpop version will download all mails from the server, even mails that were retrieved before. Sorry for the inconvenience.
• April 9, 2007: mpop 1.0.9 is released! This is a security update.
  • Security fix: APOP authentication is vulnerable to man-in-the-middle attacks. See CVE-2007-1558. Such attacks might lead to password disclosure. Therefore, mpop does not use APOP automatically without TLS anymore. Additionally, the checks on the APOP challenge were too lax in previous versions of mpop, making attacks easier than necessary. This has been fixed.
  • Security improvement: NTLM authentication is not used automatically without TLS anymore.
  • Security improvement: TLS now requires either tls_trust_file (highly recommended) or a disabled tls_certcheck.
  An update is recommended.
• March 20, 2007: mpop 1.0.8 is released!
  This version has improved capability detection for servers that are not 100% standards compliant. For example, POP3 pipelining is now automatically used for pop.gmail.com and some other servers.
• January 29, 2007: mpop 1.0.7 is released!
  This version now works with the Comcast.net POP3 server, thanks to a patch by Benji Fisher.
• January 21, 2007: mpop 1.0.6 is released!
  Some build and installation problems were fixed.
  The default value for the pipelining setting is now auto. The values on and off now have a slightly different meaning: they force pipelining on or off regardless of server capabilities. If you use pipelining on and your POP3 sessions hang, switch to pipelining auto.
• November 6, 2006: mpop 1.0.5 is released!
  This release fixes yet another build problem.
• November 5, 2006: mpop 1.0.4 is released!
  Some minor build problems were fixed, and the gnulib portability library was updated.
  Using OpenSSL on Mac OS X works again.
• September 23, 2006: mpop 1.0.3 is released!
  Support for GNU SASL was fixed (it was broken in 1.0.2).
  A spanish translation was added by Carlos Martín Nieto. Thanks a lot!
• August 20, 2006: mpop 1.0.2 is released!
  Minor bugs were fixed, and some portability issues were solved.
  The configuration command tls_force_sslv3 was added. This is needed to use TLS/SSL with some old and broken servers.
• July 23, 2006: mpop 1.0.1 is released!
  Minor bugs were fixed, and some portability issues were solved.
  The default UIDLS file changed from ~/.mpop_uidls to ~/.mpop_uidls/%U_at_%H. %U and %H will be replaced with the user and host name of an account. This means that every account uses its own UIDLS file now.
  !!! IMPORTANT !!!
  If you update from mpop-1.0.0, you must do one of the following:
  • If your ~/.mpop_uidls file contains no UIDs, delete it.
  • If you want to keep using it, add the following line to the "defaults" section of your configuration file:
    uidls_file ~/.mpop_uidls
• May 25, 2006: mpop 1.0.0 is released!
  Finally :)
  Thanks to everybody who helped with this.
  This release adds the --all-accounts (-a) option to query all accounts in the configuration file.
  Some bugs were fixed, so everybody is invited to upgrade to this version.
  Important update:
  Please note that the original mpop-1.0.0.tar.bz2 archive accidentally missed the file gnulib/nanosleep.h. This caused compilation errors.
  Since the original file was only online for a few minutes, I simply replaced it with a fixed version. If you have the defective archive, please download the new version of the file.
  Thanks to Marco Ferra for reporting this issue so fast.
• March 23, 2006: mpop 0.8.5 is released!
  Again, one more beta release before 1.0.0.
  This time, my excuse is the large number of small changes, and the addition of optional support for Internationalized Domain Names (IDN) via GNU Libidn.
  Please test this release!
• February 14, 2006: mpop 0.8.4 is released!
  One more beta release before 1.0.0, because a bug fix and a feature addition introduced some new code. Please test this release!
  Binaries for Windows are available again.
• December 27, 2005: mpop 0.8.3 is released!
  Only a few minor tweaks were made in preparation of the upcoming 1.0.0 release.
  The development moved to a public CVS repository on SourceForge, and the mailing list mpop-users was created. Everyone is invited to participate!
• 2005-08-15: mpop 0.8.2 is released!
  This release fixes some minor glitches.
  Please note: Previous versions of mpop carried the additional note that "compiling, linking, and/or using OpenSSL is allowed". This is no longer the case, because mpop uses gnulib modules that are released under the GNU GPL, and the note above does not apply to these modules.
  It is still OK to download the mpop sources and build binaries that are linked against OpenSSL, but it may be problematic to distribute those binaries (I'm not a lawyer, so I'm not sure about this).
  If you want to avoid the OpenSSL licensing problems, consider using GnuTLS. It's the default anyway.
• 2005-07-10: mpop 0.8.1 is released!
  This release fixes an annoying bug: mpop will no longer leave stale messages on the server. Some minor other improvements were made.
• 2005-07-04: mpop 0.8.0 is released!
  
  • Fixed handling of POP3 servers that do not support pipelining.
  • Enable or disable pipelining automatically for modern servers.
  • Replaced the connection timeout with a more general network timeout.
  • Always remember successfully delivered mails and never retrieve them a second time. This also works in case of errors or program termination through user interaction or the SIGTERM signal.
  • Removed the now obsolete only_new command.
• 2005-06-17: mpop 0.7.0 is released!
  This release adds native language support (NLS). Currently the only supported language besides english is german, but it is easy to add more translations (hint, hint)!
  Other changes: Much of the code has been reworked to clean it up and simplify it. A Received header is prepended to every delivered mail. The pipeline_min and pipeline_max values are not configurable anymore, they are compile time constants now.
• 2005-05-29: mpop 0.6.3 is released!
  
  • Fixed a bug that broke GnuTLS support. Reported and fixed by Jesse Michael for msmtp.
  • Maildir delivery now uses better unique filenames.
• 2005-05-03: mpop 0.6.2 is released!
  
  • Delivery to maildir folders is now possible. Example:
    delivery maildir ~/Mail/incoming
  • Filter scripts can now use the envelope from address and the size of a mail. Example:
    filter ~/bin/my-pop3-filter.sh --from=%F --size=%S
• 2005-04-01: mpop 0.6.1 is released!
  This hotfix release fixes the following bug:
  If TLS is not used and a mail with a line longer than 1023 characters is read, a null character was wrongly inserted into that line.
• 2005-03-31: mpop 0.6.0 is released!
  This release supports multiple delivery methods:
  • mda: Pipe the mail to an mda. This method can now replace %F in the mda command with the envelope from address of the mail.
  • mbox: Deliver to a file in mbox format.
  • simple_mbox: Deliver to a file in mbox format, but don't care about envelope from addresses.
  APOP authentication works again. Several other bug fixes and improvements were made.
  A minor change to existing configuration files is necessary when upgrading from 0.5.0; see the file NEWS for details.
  Some further performance improvements were made.
  Many thanks to Dimitrios Apostolou for his contributions to this version!
• 2005-03-15: mpop 0.5.0 is released!
  This release allows much faster POP3 sessions by using a network efficient POP3 implementation. Many thanks to Dimitrios Apostolou!
  Also new are .netrc support and several other minor improvements.