Bug 269128

After established that there was no real mechanism available for a user of Open Suse Thunderbird Email Client for the user to attach their public key for an S/MIME digitally signed email in order to facilitate future encryption the following became apparent. 

I made the following request of Mozilla with respect to drastically changing the applications handling of S/MIME digital signatures.

Quote to Mozilla
User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.8.1.2)
Gecko/20061023 SUSE/2.0.0.2-1.1 Firefox/2.0.0.2
Build Identifier: version 1.5.0.10 (20060911)

There is a great deal of code devoted to PGP processes and almost none to
S/MIME.
Request you separate the 2 vastly different methods of Digital Signatures and
Encryption.
If you desire the commercial use of Thunderbird, which does not accept PGP, as
anyone can create a PGP signature that is not automatically verified and if
verified it can never be trusted; there needs the equal commitment to S/MIME as
there is current to PGP. 

PGP does have useful purposes intra domain, however we have a world standard in
S/MIME.

I appreciate that PGP is more in keeping with open source policy - however it
does not exclude its wide commercial use and application.

Currently Thunderbird could not pass enough security guidelines for any of the
following domains .MIL .GOV .IT  - And these are big players in the commercial
marketplace. Please take into consideration the many enhancement requests
already present for S/MIME functionality 

Reproducible: Always

Unquote

The following response was received from Mozilla in respect to the above.

Quote
Umm, stock Thunderbird does not have anything OpenPGP at all.  The SuSE
packaged version of Thunderbird does have the Enigmail and Mail Redirector
extensions packaged with it for some reason, though.  Which means you would
need to talk to them instead :(

(Thunderbird does have the S/MIME stuff built in by default, which is way more
support than PGP does...)
Unquote

I can only assume that "them" refers to the open suse Distribution and offer the following thoughts.

Why do we remove current functional aspects of the original production version.

This would seem counter productive in that for every release we need to maintain an altered version of the official release. 

From a development point of view modifications of an application that is constantly under development will require valuable time and possibly removal of functionality that is expected to be available.

Whilst the version of Thunderbird provided by Suse .RPM provides the ability to digitally sign messages it is not apparently able to click on "attach public Key" for any signed message.

PGP signatures by them selves can be created by anyone and carried NO authenticity even as to the validity of the address its signs. 

I do understand the issue of PGP Key servers.

As such every PGP signed message when received by various email clients can display warnings in the case of Microsoft Clients "Invalid Signature" to other less alarming messages of "invalidated signature"

I really do not understand the need to change the version of Thunderbird created and maintained by Mozilla when it offers equal facilities in respect to digital Signatures both PGP and S/MIME ( as told be above response)

I do understand that I can download the Mozilla Version of Thunderbird, however I would like to think that there is no need to change its functionality unless its RC format is not compatible and will not function under Open Suse unless it is modified.

As well as duplication of possible future conflicting development plans by Mozilla, in the first instance, and Open Suse in the second I feel we are trying to re-invent the wheel with a considerable ongoing need to change the Mozilla Product with every version of Thunderbird and every version of Open Suse at the possible expense of attending to known bugs.

The issue of providing a possible security update issues by Mozilla to the installed Suse Product frightens me.

I have reported this as a bug in lieu of an enhancement as the open suse version of Thunderbird appears to have commercially/operability valuable which in respect to "does have the S/MIME stuff built in by default" removed from the distribution contained in open suse.

Please tell me some other organisation has decided to remove and modify existing functionality of a fast developing open source product and I have the above all the wrong way around.

Discussion/awareness is indicated above.