5 ms·

Love it! Some comments: - I want to upload a thread, and it asks me to give Oauth to my entire email. That's a little too much! Can't I just forward an email?

• amsheehan 11y ago
  Thanks for the comment! Currently we don't have a way to cc FWD:Everyone on a thread for the purposes of making it public. It is in the pipeline though! One of the reasons we do it through the gmail api is because if we accepted plain text emails through the typical forward process, the messages can be edited. On FWD:Everyone, you can make redactions, highlight text, and omit entire messages, but you cannot change what the messages say. We think authenticity is vital to the site, and if you'd like to revoke access to your gmail inbox, Google provides a novel way to do so here: https://security.google.com/settings/security/permissions https://security.google.com/settings/security/permissions
• Alex3917 11y ago
  Thanks! With respect to just forwarding the thread, that was the original idea. The reason we've moved away from that though is, counterintuitively, for security reasons. Basically we wanted to make posting email double opt-in, so that you can't publish emails from other people without their permission. The problem is that without OAuth you would be able to change the text of the conversations, and also who the messages were coming from. So although we could still have a permission mechanism, it wouldn't really be enforceable. And worse, anyone getting a permission request would have to reread the entire thread to figure out whether the uploader had changed the text of the conversation. When we build a Gmail plugin we might be able to get around Oauth if we're able to forward each message in the thread, since I think we'd be able to verify the authenticity of the messages with DKIM. I haven't fully looked into this yet. For now what you can do is make multiple gmail addresses and/or revoke the oauth access after each time you use the service. (We do this with our own accounts dozens of times per day while testing the site, and it hasn't caused any issues.) I think also a lot of people in the tech community are more comfortable authing their work email accounts than their personal email accounts, so we're not necessary counting on seeing a huge wave of adoption until we have the organization features in a couple months. With respect to not including certain messages, that's a feature we currently have with Oauth. You can redact any text within the message bodies, which then isn't stored in our database. And you can also exclude messages entirely from the thread, and again the text of those messages isn't stored in our database either. We're going to add more fine-grained privacy settings in the future so that way you can white list certain people and organizations and whatever. But for launch we wanted to keep everything super simple, and make sure your first experience with the site isn't getting doxxed by your friends or whatever even if that means not getting any super viral content on day one.
  • pbiggar 11y ago
    Ah, I see. I guess you'll have to weigh whether that giant obstacle to adoption is worth that feature. My bet is that it won't be.