I did a test-import of nearly 10 years of accumulated mail from Outlook into Thunderbird 1.5, and it was successful, turning a 900MB PST into a 1.2GB profile folder. Space is cheap. I cleaned up my multi-account set-up a bit, and have since upgraded to Thunderbird 2.x and then switched to Portable Thunderbird. I recently added the Lightning extensions and synchronize my contacts and calendar using scheduleworld.

I am, as such, a “power-user” of Thunderbird. I’m also a programmer by profession and know my way around various OSs.

My AV of choice is ClamWin for Windows and ClamAV for Linux.

And no, I don’t have any virus protection for my Thunderbird. To be fair, I really don’t receive more than one or two attachments a month, and I can’t even remember when I last received an executable of any type in the mail.

However, I also use Firefox and have it configured to scan downloaded files using ClamWin. If there was a reasonable way to scan incoming messages in TB, I would configure it to do that. However, there is not, and I think that is Michael’s point. Matt seems to misunderstand this.

The Mozilla folks are doing a bang-up job on Firefox and Thunderbird, but to not have a single configuration example for TB+AV for any AV program is a gross omission that borders on negligence. And it’s even more so for the fact that beyond a number of “free” AV solution, there’s a very solid open-source program available. And — Hello Matt — ClamAV even updates virus definitions automatically!

All that aside, I think the best solution for email virus protection is to scan at the server level. My ISP uses an installation of ASSP which not only scrutinizes the headers, but also greylists senders (thus delaying or rejection mail from “drones”) and scans attachments. Local POP3/SMTP proxies were fine and well a couple of years ago, but who uses unencrypted POP3 anymore?

So, Michael — yes, it’s a shame Mozilla doesn’t even document a simple antivirus configuration. It’ll hurt Thunderbird adoption in the long run.

Matt — yes, “security” is unknown to the average computer user these days. Even to some of the “above average” users, it’s difficult. I recall a programmer of mine who got his development machine infected and was about to roll out an infected exe to a few hundred users. That’s exactly the reason why it security has to be made available to those users… and that was the point this blog post is making.

I would also argue that the page you recommend for Thunderbird anti-virus information is poorly written, virtually incomprehensible to non-technical users, and significantly out of date in many places (referring to Thunderbird version 0.9 is a dead giveaway there).

But mostly I would argue that your comment boils down to exactly what I wrote before: “People who aren’t smart enough to figure out this Thunderbird + anti-virus thing should use something else.” Indeed, I get the impression you think they should get off the Internet entirely. You blame the user, when it wouldn’t be that hard for the tool to be easier to use (if anyone working on Thunderbird actually cared about solving normal people’s problems).

I would finally note that the main Thunderbird web page no longer has anything to say about viruses or malware, suggesting that there is at least some awareness that Thunderbird doesn’t help very much here.

And don’t get me started on Sunbird…

Would you say there is a problem with your car, and it is the manufacturers fault, if it does not answer your home telephone?

Secondly, your follow up post clearly exposes your belligerence on the matter. You say Thunderbird says no more on the issue than what was stated two years ago. You reveal your ignorance of the accommodation Mozilla has in fact already provided for incompatible AV systems. Since version 1.5, Thunderbird has under the privacy options a setting expressly for AV optimization. For more information, read the Knowledge Base article at mozillazine.org (http://kb.mozillazine.org/Antivirus_software).

Finally, to be frank, the vast majority of internet users are people for whom the concept of computer security is a mystery at best, and a nuisance at worst. I cannot count the number of time I have had to rescue some poor sod who has crashed her computer by having it so overloaded with spyware and viruses. My conversation with the user invariable includes phrases like, “It’s been like this for months.” “I keep getting these pop-up things… I just minimize them and ignore it.” “The only reason I called you this time is I can’t get into my AOL anymore.”

Each time I help the user get their AV updated, in a matter of a week they will not check to ensure they are getting current definitions, in a matter of a year their subscription will expire and they will not update it. I know that in at least 18 months I will have to again clean this machine. Hopefully, in the span of those first 12 months the user will not make a drone out of that machine and be a problem to us all on the internet.

To argue that any given user is the “exception” is laughable. To such an argument I already have a response: When was the last time you clicked Help?

Thunderbird -> Help -> Mozilla Thunderbird Help -> Search for Anti-virus -> click the FIRST standard search response: Antivirus software – MozillaZine Knowledge Base