Betterbird Blog

We've shipped Betterbird 140.10.0esr-bb21 today. Please refer to the Release Notes for full details.

As the new ESR version 153 is already on the horizon being scheduled for the 21st of July 2026, development of the current ESR 140 has somewhat slowed down. The Thunderbird folks are not shipping anything in their 140.10.0 apart from security fixes in the Mozilla platform and more complete localisations.

We're shipping Betterbird for the first time in Portuguese from Portugal. This was made possible be the tireless effort or volunteer Hugo from North-Portugal. Portuguese is tricky, they have a polite verb forms, like German, French, Spanish and many other languages, and they had a orthography reform in 1990, which wasn't widely accepted, so people still use the old spelling. Thunderbird opted for the polite form and adherence to the reform, so we needed to adopt the same, much to the discontent of our translator who argued that the familiar verb forms are more adequate in today's Portugal. He also had to fix the Thunderbird localisation for Portuguese, so Betterbird (and Thunderbird) can now ship a proper localisation without "English patches" here and there. Thank you, Hugo!

By popular demand, we've changed the icon for CardDAV address books to make them more distinguishable:

Lastly, we fixed a long-standing issue with permanently decrypted PGP messages. After Thunderbird removed this feature in version 78, we implemented it in Betterbird 91, and Thunderbird followed in version 102. However, when decrypting a signed and encrypted message, the signature wasn't shown as valid any more. This has now finally been fixed:

Note that from version 115, signed and encrypted messages use a "combined" MIME layer, so when decrypting the signature is lost regardless. Therefor the fix only applies to messages created before version 115 or those which are now created forcing separate MIME layers with preference mail.openpgp.separate_mime_layers.

Thunderbird has always been underperforming when measured against its own roadmaps. Now it looks like the roadmaps have been replaced by a list of what the project is working on anyway.

Let's compare the past and current roadmaps. We're focusing on the major items which have accompanied us over the last five years, of which at time of writing (April 2026) none are complete and only one, Exchange support, has a realistic chance of being completed.

Items marked with an asterisk for 2026 (Fluent, Exhange) may be complete for the summer release of Thunderbird 153, the global database will not be shipping in this release.

Important items, like replacing the buggy 26-year-old MIME library of finally providing a decent and contemporary mail editor, are not even on the roadmap.

It's no surprise that things are not progressing with the Thunderbird desktop development, since despite close to 60 staff (of whom 15 are managers, CEO, COO or directors), the project has "diversified" into Thunderbird for Android (rebadged K-9 app), Thunderbird for iOS and so-called "Services" where the project actually supplies mail accounts. A developer recently wrote that the desktop team was small; going by the mentioned page and not counting director/manager and release engineer, there are only 12 people.

We've shipped Betterbird 140.9.0esr-bb20 today. Please refer to the Release Notes for full details.

Here are three important new features and changes:

We improved the "delayed sending" capability by making sure that a message which is scheduled for sending is in fact not sent once it's opened for further edits with "edit as new message".

Betterbird/Thunderbird allows to convert an e-mail message to a calendar event or task. The original message is linked to the event/task. However, that link wasn't reliably displayed. That was fixed and we added a button Open in Folder (see screenshot) that allows to go back to the original message.

Lastly, localised versions, like the German version, no longer include the standard Mozilla English US dictionary. We had users who expressed that they wanted to remove the dictionary, which wasn't possible. Also, it allows more flexibility in choosing an English dictionary. Here are some choices:

• The stock-standard Mozilla dictionary, which is rather basic.
• The English US dictionary maintained by Marco Pinto.
• The British English dictionary maintained by Marco Pinto which is the better choice for European use.

If you read the article about discontinuing the Revolut payment link, you will already have heard of credit card testing attacks: Fraudsters effect (small) payments to "merchants" to test the validity of stolen/leaked credit card details. As you can see in the picture, nine attempts were made within less than 40 minutes. All Revolut did was to block our account, they don't offer any mitigation tools.

As of March 2026 our Stripe payment USD link also came under attack. It started with small payments between $0.50 and $2, which we blocked, but later they increased to $5 to $20, and even payments of $100 or $1000 were "tested".

To mitigate the issue the following measures were taken on top of Stripe's so-called Radar which has its own heuristic for fraud detection:

• Small donations blocked
• Donations from Algeria blocked, there seems to be a nest of fraudsters
• Now requiring 3D Secure payments (when available)
• Stricter address checking
• USD payment replaced twice and all payment links now obfuscated (supplied via JS on page load or user click)
• Proactive refund of suspicious payments, since every dispute carries a fee of $20
• Last not least: The Link payment method was disabled, a Stripe invention, which makes these attacks faster for the fraudsters.

Unfortunately, Stripe's own mitigation isn't very good, in on case there were at least 8 failed tests from the same IP address within 33 minutes, and Stripe still allowed a subsequent payment from that IP address, which of course we refunded immediately to avoid a costly dispute:

On this topic, Stripe support made the following statement: Stripe is first and foremost a payments processor. We facilitate your interaction with the card networks and issuers, and we provide a PCI compliant way to do so. Payment processing is not the same as dedicated fraud protection. We do have safeguards against fraud, and we do try to weed out risky transactions without blocking legitimate charges - it's a pretty delicate balance. There's simply no algorithm that can replace the role of the merchant's manual review of orders. But even these powerful, dedicated solutions are not foolproof; the strongest, and best, line of defense is still manual review.

If your genuine donation in USD was declined, please get in touch and we'll find a different payment option. In a dialogue with a donor we found out that Bank of America generally allows outgoing ACH payments. For "regular" customers they charge a fee, it's free for customers with a "preferred status".

Strange what tasks arise in an open source project which aims at providing the world's best e-mail client.

We've shipped Betterbird 140.8.0esr-bb19 today. Please refer to the Release Notes for full details.

This new release offers four new functions and a fix for an annoying issue. Here are some details:

The add-on Send Later to schedule sending of messages has many users. Its author doesn't test his add-on in Betterbird, instead he publishes this disclaimer (quote):

Send Later is known to have issues with Betterbird
The Send Later add-on is not regularly tested with the Thunderbird fork called Betterbird, and there are known, unresolved issues which may prevent the add-on from functioning as intended. Using Send Later with Betterbird is therefore not recommended.

We're not aware of any issues, other than the ~55 issues the add-on has anyway. But the good news is, delayed sending in the background is now supported in Betterbird, if you set the following two preferences:

mailnews.sendInBackground set to true and mailnews.sendInBackground.DelayMinutes set to the desired delay in minutes. Be aware that if you close Betterbird before all messages are sent, there is currently no warning.

This is not aimed at replacing the add-on completely, it's aimed at providing a "send delay" that users of MS Outlook are used to.

As we detailed in previous posts like this one, we're now signing our Windows binaries with a code-signing certificate from a reputable source.

By popular demand, the 'Search PreferredSearchEngine for "..." ' option is now also available in the context menu in the compose window.

People who have used Thunderbird for a long time will know that for IMAP accounts, messages read on the server with a different client, like a mobile device, were not subjected to message filtering. That was later changed by introducing preference mail.imap.filter_on_new. However, the filter didn't work when it was run after the junk classification. This has now been fixed.

Thunderbird released version 140.7.2 yesterday to follow Firefox 140.7.1 which fixes a security issue, a heap buffer overflow in libvpx. That's a video codec. The Thunderbird folks wrote this in their advisory:

In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

So, only Betterbird users who use Betterbird as a web browser, or browsing news feeds with embedded videos may be affected. Since the security risk is extremely low and since Betterbird 140.8.0esr-bb19 will ship before the 24th of February 2026, we decided to skip this release.

The "colourful" picture shows the all the test failures that occurred in Thunderbird's release automation and are shown in the so-called "treeherder" (dashboard). Each orange box is a test failure, and it's not advisable to ship the product with so many test failures without investigating them.

In other words: Even if we had built Betterbird based on this Thunberbird release, it could be quite broken. BTW, this is not the first release chagrin, refer to these earlier articles [1] and [2] for more.

Update: Apologies to the Thunderbird folks for the incorrect statement above. We heard that the test failures were analysed and that they came to the conclusion that despite what was displayed on the dashboard, the product showed no functional failures and was safe to ship. That was confirmed by their QA team, in fact, we also tested that Thunderbird release and didn't see failures.

Our article was overreacting to the fact that in the past, test failures were ignored and the product did get shipped with minor functional issues.

Finally no encoding issues with the re-issued certificate. See our previous post for details.

Three days ago we noticed a number of 1 € payments via our Revolut payment link using a credit card. We were wondering what this was about.

Today we received this message from Revolut: It is with regret that we must inform you of our decision to discontinue the support for your freelance activity. [...] in an effort to mitigate potential risks associated with providing you with our acquiring services, we have temporarily restricted fund withdrawals from your account for the next 90 days.

Wow! AI sprang to help to explain that our payment link had become the targe of a so-called credit card testing attack, where the link was used by fraudsters to test stolen credit cards. AI went on to say:

What Stripe actually does (and Revolut doesn’t)

• aggressively rate-limits payment attempts
• runs real-time card testing detection
• blocks suspicious patterns before they hit the merchant
• absorbs the fraud risk by default
• does not punish merchants for being targeted

That’s why Stripe payment links are safe to publish publicly.

What Revolut does instead

• exposes a public card entry page
• performs basic checks
• then pushes all residual risk downstream to the merchant
• treats anomalous traffic as merchant risk

So yes — they look the same on the surface, but they are not in the same category operationally. This is not something a normal user can or should infer.

Update: Revolut chat isn't very helpful, mostly pre-canned and/or AI replies. They say that blocking the account is based on their Payment Processing Service Agreement which also includes these Business Terms, but none of the documents specify a block for 90 days. Neither do any of the ten reasons for suspension in section 7 apply.

So this looks like a Goodbye to Revolut. Adding to this is the poor quality of the data they provide: For some donors, name and e-mail address are supplied, for others, only the e-mail, and for quite a few, only the name, so we can never contact the donors to thank them. Furthermore, there is zero reporting, we have to "scrape" the textual data off the Android screen (using this Copy app).

As outlined in our previous post, a self-signed certificate cannot be used to build Windows SmartScreen reputation. So we obtained a code-signing certificate from Certum, a recognised provider.

We re-issued Betterbird 140.7.1-bb18 signed with the certificate, but as you can see, even in the 3rd millennium, processing of non-ASCII data is still not working everywhere. The umlaut in our CEO's name "Jörg" is shown as replacement character �. However, if a system locale with UTF-8 support is selected

the SmartScreen displays the correct information:

We'll take the issue up with the certificate provider.

Update: Looks like Certificate Authorities are a pretty bureaucratic bunch. We had to revoke the certificate and go through the entire process again. As a result with ended up with a certificate without umlaut and encoding issue.

Why is Windows SmartScreen blocking so many installations? According to AI, SmartScreen uses various signals:

File reputation (the big one)

SmartScreen maintains a reputation score for that exact file hash:

• How many people have downloaded it
• How many have run it
• Whether users aborted or overrode warnings
• Whether it’s been reported as malicious

A brand-new binary has zero reputation, so it gets flagged even if it’s harmless.

Publisher reputation (certificate reputation)

This is where code signing comes in — but with a catch.

• A standard code-signing certificate starts with no reputation
• Reputation is built over time as many users run binaries signed with that cert
• Until then, SmartScreen still shows “Windows protected your PC”

So signing helps, but it does not give instant trust, unless an (expensive) Extended Validation) code-signing certificate is used. Using a self-signed certificate as "Trusted Root" may even have a worse rating as consequence.

We finally bought a code-signing certificate from the reputable source Certum, since they have a special deal for open source developers. Their CA is present on every Windows installation, see here in the Certificate Manager:

So expect a further announcement when our binaries are signed with the new certificate. Over time, the reputation in SmartScreen will also improve.

This article was partly created with the help of AI, however, manual adjustments were made where needed.