4 ms·

I've downvoted you for your sheer negativity. This is a person who's worked 2 years on a project, in a neglected space where companies don't go because they ca

by porker 8y ago

I've downvoted you for your sheer negativity. This is a person who's worked 2 years on a project, in a neglected space where companies don't go because they can't make money. He deserves praise for taking the time, creating something that's different, and thinking through the idea. Well done!

partycoder 8y ago
I built a webmail client from scratch many years ago and I agree with the security concerns. In my case the credentials were not a problem with displaying inline HTML securely was difficult to get right. Back then there was no CSP.
cronin101 8y ago
He isn't trying to take away from the achievement, just highlighting some legitimate security concerns. IMHO this is justified since people often overlook how critical an attack vector this would be. Imagine if a state-sponsored "hobbyist" posted a pet project like the OP to Reddit and started harvesting keys/password reset capabilities for huge amounts of users. Hell, people flocked to use unroll.me and then it turned out they were (predictably) scraping your entire inbox and selling the data to advertisers. I don't believe that worrying somebody's skepticism might hurt feelings is a legitimate reason to downvote (remember, downvotes aren't about whether you agree with somebody; it's about whether they add constructively to discussion). Aside: Great work OP. Seems like an incredibly hard sector to make traction with though, so best of luck.
- ryandrake 8y ago
  Yea, I kind of feel the same way about it. "Great work but not my cup of tea for reasons A, B, and C" should be valid feedback on a Show HN.
  - porker 8y ago
    Absolutely. But the OP forgot the "Great work but...". Had they, I wouldn't have commented.
  - augbog 8y ago
    Well said. It's very impressive and I have a lot of hopes for the future but I feel the concerns are very valid and if OP wishes to take this to the next step, he/she needs to be aware of the security implications and possibly figure out a way to help address them. Regardless, I'm really glad there are more people trying to fix the problem of email.
dogma1138 8y ago
Security concerns are the one of the primary reasons why so many email clients died out mid to late 2000’s when every red team success story was “found XSS in email client pwned admin”. No body is detracting anything from anyone but there is no way I’m trusting an application that can take contol of a large portion of my life without assurances. If your email address gets compromised it’s game over for most people every service you’ve registered with is up for grabs which is also the reason why I don’t recommend anyone to use personal domains for email unless they are willing to pay for it till death do them part. As time and time again after buying a domain that was used by someone else and setting up a catch all email address I got emails from Twitter, GitHub and the likes.
JustSomeNobody 8y ago
Just because someone works on something for two years doesn't mean they "deserve" anything. That's flawed reasoning.
deleted 8y ago
[deleted]

by porker 8y ago

partycoder 8y ago

I built a webmail client from scratch many years ago and I agree with the security concerns. In my case the credentials were not a problem with displaying inline HTML securely was difficult to get right. Back then there was no CSP.

cronin101 8y ago

He isn't trying to take away from the achievement, just highlighting some legitimate security concerns. IMHO this is justified since people often overlook how critical an attack vector this would be. Imagine if a state-sponsored "hobbyist" posted a pet project like the OP to Reddit and started harvesting keys/password reset capabilities for huge amounts of users. Hell, people flocked to use unroll.me and then it turned out they were (predictably) scraping your entire inbox and selling the data to advertisers. I don't believe that worrying somebody's skepticism might hurt feelings is a legitimate reason to downvote (remember, downvotes aren't about whether you agree with somebody; it's about whether they add constructively to discussion). Aside: Great work OP. Seems like an incredibly hard sector to make traction with though, so best of luck.

ryandrake 8y ago
Yea, I kind of feel the same way about it. "Great work but not my cup of tea for reasons A, B, and C" should be valid feedback on a Show HN.
- porker 8y ago
  Absolutely. But the OP forgot the "Great work but...". Had they, I wouldn't have commented.
- augbog 8y ago
  Well said. It's very impressive and I have a lot of hopes for the future but I feel the concerns are very valid and if OP wishes to take this to the next step, he/she needs to be aware of the security implications and possibly figure out a way to help address them. Regardless, I'm really glad there are more people trying to fix the problem of email.

dogma1138 8y ago

Security concerns are the one of the primary reasons why so many email clients died out mid to late 2000’s when every red team success story was “found XSS in email client pwned admin”. No body is detracting anything from anyone but there is no way I’m trusting an application that can take contol of a large portion of my life without assurances. If your email address gets compromised it’s game over for most people every service you’ve registered with is up for grabs which is also the reason why I don’t recommend anyone to use personal domains for email unless they are willing to pay for it till death do them part. As time and time again after buying a domain that was used by someone else and setting up a catch all email address I got emails from Twitter, GitHub and the likes.

JustSomeNobody 8y ago

Just because someone works on something for two years doesn't mean they "deserve" anything. That's flawed reasoning.

deleted 8y ago

[deleted]