8 ms·

Bjarni here, lead dev. Happy to answer any questions.

jeffbr13 13y ago
Are there any plans to help make setting up your own mailserver easier? That seems to be the main challenge for anyone who wants to self-host right now.
- HerraBRE 13y ago
  That is one of our main long-term goals. It's too early to say exactly how we would do that, but odds are there would be some sort of helper service in the cloud which relays and handles DNS and such. We need to get the client built first though.
  - jeffbr13 13y ago
    And what would be your approach to spam-filtering? One of Google Mail's strengths is that it can use data from millions of accounts' emails to train its spam-filter. Do you see Mailpile offering some way to do the same thing in the future, with clients flagging spam and the result being used to train a 'community' filter?
    - HerraBRE 13y ago
      This is still largely an open question. But there are some interesting possibilities for those who actually make their Mailpile visible on the public web - Mailpiles could talk to each other and exchange data of this sort. But ideally things like this would be a community effort shared between projects and we would join, not necessarily lead.
      - alextingle 13y ago
        If encrypted & signed mail becomes common enough, then I suspect the spam problem goes away. I suspect spammers won't want to sign their mail, and if they do, it would be trivial to distrust new public keys and maintain a global blacklist of bad established ones. Then almost all encrypted mail can be simply trusted, and spam filtering only has to pick out the occasional real message from the unencrypted dross.
joeyh 13y ago
Please fix the "it's" typo on your website ;)
- HerraBRE 13y ago
  Haha, noted. Thanks.
ssp 13y ago
Do you have plans to make money off of this?
- M4v3R 13y ago
  They've started an indiegogo campaign to fund the development. http://www.indiegogo.com/projects/mailpile-taking-e-mail-back http://www.indiegogo.com/projects/mailpile-taking-e-mail-bac...
andrewcooke 13y ago
how does the search work? is there a separate database? i use mairix (which does construct a separate database) and it's pretty damn awesome. have you looked at that? are re-inventing something worse? sometimes it is useful to search just the body. and mairix works fine with a huge volume of mail. also, getmail is python and does pop and imap downloads, so could be used there. [otherwise, this seems awesome and if i run out of my own dumb ideas i will seriously consider contributing]
- HerraBRE 13y ago
  It is a custom search engine, written in Python. It works surprisingly well, most queries are answered under 200ms and tens of milliseconds are common once caches are warm.
  - beachstartup 13y ago
    any plans for a solr support? there's a lot of knowledge out there on how to scale solr for large webmail deployments like i.e. inside a large company or for forensic mail analysis.
    - rhizome31 13y ago
      I was wondering about that as well. Why not go with an existing search engine? Having checked out the code it seems that the project it still in its infancy. A lot of effort has probably gone into building the search engine though, which kind of seem like re-inventing the wheel but I'm sure you have reasons that I don't see. By the way, as test-infected coder, my first move was to launch the test suite, and it was a bit surprising that it wanted to run sudo :) I didn't go further for now because I don't have time to setup fetchmail, will do later. You guys seem to have a lot of potential and good intentions :) In my end of the world I'm also dreaming of "taking back email" and I happen to write Python for a living, so I'll be watching you guys very closely. Quite frankly though, I won't consider contributing until you have a proper test suite :) Keep it up!
      - 13y ago
susi22 13y ago
Not a question but a comment: You should add an igg link to the github README. Some people link to github projects instead of the website. Good luck!
- gingerlime 13y ago
  What's an "igg link"?
  - mikkow 13y ago
    Indiegogo link
- HerraBRE 13y ago
  Yes, very good point. :)
mkl 13y ago
"Mailpile is a modern web-mail you run on your own computer." I think this sentence should be the first thing anyone sees when they go to the page. The text at the moment assumes everyone already knows roughly what Mailpile is, so I didn't figure it out until I read HN comments. Also, are there screenshots somewhere?
- HerraBRE 13y ago
  Brennan was working on getting some screenshots uploaded. We are obviously very busy reloading everything at the moment. ;-)
- jspaetzel 13y ago
  I think that this sentence needs to be gotten rid of completely. - Webmail is fundamentally not something that can run on your own computer. The word is "web" mail, not desktop mail, it's just going to confuse users. In addition to it being confusing, because of dynamic IPs and residential port blocking you may be able to run it on your computer, you just won't be able to do anything with it due to other internet infrastructure... - Sending mail from home is almost guaranteed to fail sometimes/often, due to dynamic ip ranges which are frequently blocked. - Port 25 and port 80 are blocked by most major american ISPs these days for residential services. Making this unusable from a home server. Not to mention it's against many ISPs terms of service to run a server from home without paying for a business package. (That's right, it's not just google fibre) - SPF records and other forms of email authentication? You would also need a third party DDNS service if using a dynamic IP. So with all of that said, I like the interface pictures. It could be a good competitor to webmail clients like roundcube and friends.
  - alextingle 13y ago
    > Sending mail from home is almost guaranteed to fail... It's an MUA - it can sent mail just as well as any other MUA. Use your ISP's smarthost if you are using it from home. > Webmail is fundamentally not something that can run on your own computer. This statement is plain wrong, even if by "your own computer" you really mean "your desktop box". I can run any server I like on my desktop box. If it has a well designed installer, then it would be as easy to set up as a "normal" app - the end user might not ever know the technical details. > The word is "web" mail, not desktop mail, it's just going to confuse users. Now I do agree with you. The product seems to be a little bit of both, so there is some potential for confusion. "Web-mail you run on your own computer" does seem to explain it pretty well though.
guygurari 13y ago
I applaud your efforts! I did not see mobile mentioned. Will there be a mobile-friendly version of the web client? Will there be IMAP access from (e.g.) mobile devices? (Under 'Current Features' you mention IMAP, but I did not understand if this refers to you acting as an IMAP client or server.) By the way, there seems to be a copy-paste typo in the description for 'Spam Detection'; it reads 'PGP encryption and verification of emails and recipients'.
- HerraBRE 13y ago
  Yes, making the web mobile friendly is definitely on the list of things to do. Native apps may come later, once the APIs have stabalized a bit. The current IMAP support is functioning as an IMAP client, we haven't started work on the server side yet. And thanks for the typo report :)
  - alternize 13y ago
    so if i understand you comment right: it will be a MUA that accessed through a webbrowser, and one still needs to have an IMAP capable email-account somewhere else?
    - HerraBRE 13y ago
      Yes, at least to begin with, we are not providing people with domains or e-mail addresses. IMAP, POP3, or run your own SMTP server...
      - alternize 13y ago
        but then I'm not really seeing what the advantagess over running thunderbird + engimail locally or using roundcube (which also has openpgp support built in) would be?
      - unhammer 13y ago
        sigh … I already have email clients that do PGP on my email that is hosted on Someone Else's Computer. It doesn't seem like Mailpile moves me a single step away from the dragnet. When I saw the "pagekite" username on github, I immediately hoped for plug-and-play self-hosted IMAP/SMTP. Here is what I envisioned in the blissfully ignorant moments until I read what the project was actually about: The user gets to download/buy a USB stick image / raspberry pi SD image. After plugging it into a pi or other box and turning that on, user types in the URL "mailpile" on their laptop web browser and on first run, user gets asked by web app to plug in a big harddrive for storing email on[1]. The box runs some IMAP server (dovecot?), connected to some MTA that does TLS (postfix?). The user has paid for an already setup domain name, kept in sync with the IP address of that box (which runs a dyndns-like daemon), user also gets access to some server that relays SMTP without breaking TLS (since most mail servers will not accept SMTP from just any dynamic IP). So on first run, the user also has to enter the credentials for the service they paid for, these credentials are used to let the box get its SSL key signed by the CA, tell the dyndns service that this box gets to update this domain name etc. Now if two users run this, they don't even need PGP to communicate in an encrypted way, it looks just like any other sent email. Nor can anyone requisition their mail without breaking into their house. So the paid service would be to get a dyndns-updatable domain name with SSL, and access to some server that relays SMTP. The service would have to dole out domain names and either be a CA itself, or be able to intermediate in the SSL key signing process. [1] For bonus points, dejadup runs there and user gets to say "send encrypted backups to dropbox/some ssh account/some other USB drive"
eps 13y ago
> Smári is the director if the International Modern Media Institute of
ippisl 13y ago
What about anonymity ? email has a potential for better anonymity than TOR via mixmaster or other remailers. Are you considering those features ?
- HerraBRE 13y ago
  It's not on the roadmap yet, but that is why we want to build a community, to see what people want.
barend 13y ago
Your introductory text and video mention the NSA and PGP. The PGP system has been around for a long time without getting any mainstream traction. There are numerous reasons for this failure, but the general complexity of public key crypto has to be one of them. On the project page you write > An intuitive, modern user interface makes strong security accessible to everyone. Can you share a bit more about the way you envision this?
- HerraBRE 13y ago
  Big, big topic. I suggest you follow our Twitter account or something, we'll probably be blogging about this later on in the campaign.
alecco 13y ago
Thank you! will donate today. What about perfect forward secrecy for server connections? What about transparent text compression?
- HerraBRE 13y ago
  Sounds like those are out of scope, that's just down to correctly configuring the SSL server. But yeah, I hope we correctly configure our SSL servers. ;-)
rhizome31 13y ago
Why AGPL rather than a more liberal license like BSD or MIT? Edit: Just to clarify why I'm asking this, the project looks very interesting and I suppose the choice of AGPL wasn't made lightly, as it might slow down adoption by commercial organizations, so I'm interested in the reasoning behind this choice.
- HerraBRE 13y ago
  This is something we have debated extensively. Our main goal is to improve privacy and security on-line - giving cloud providers yet another free tool with which to build proprietary services and lock in more users and their data feels like it would be counterproductive. However, we are open to discussing, and if a significant fraction of our backers would prefer a more liberal license we will probably switch.
  - alecco 13y ago
    Please stay AGPL. It's the right choice for these times. BTW, beware of code ownership of pull requests from corporations.
    - pixelcort 13y ago
      Regarding Pull Requests, this is quite important if and when you want to change licenses, or dual license. Make sure you have on file release forms for every copyright holder who submits code that grant you permission to relicense later on. For one line bug fixes it can be a pain, but it's worth it. One problem with this though is that it places an unfair advantage with the current maintainer. A fork of the project wouldn't inherit the relicensing permissions from all the contributors.
      - icebraining 13y ago
        Ugh, why? You're just discouraging people from contributing by forcing them to accept that their code might be used in a matter they don't approve of in the future.
jerrac 13y ago
Any plans for .deb/.rpm repositories?
- HerraBRE 13y ago
  Of course, but that's months away. We gotta write the software first!
  - jerrac 13y ago
    'Course it's months away. :) I've noticed that some applications don't offer their own repositories. So I've been left with either relying on the distributions out of date packages, or installing the application manually. That's why I asked. I'd rather use your repos so that I can keep it up to date.
    - tmzt 13y ago
      Another option is packaging it with docker (http://docker.io http://docker.io) so it could be dropped onto an existing system quickly.

Are there any plans to help make setting up your own mailserver easier? That seems to be the main challenge for anyone who wants to self-host right now.

HerraBRE 13y ago
That is one of our main long-term goals. It's too early to say exactly how we would do that, but odds are there would be some sort of helper service in the cloud which relays and handles DNS and such. We need to get the client built first though.
- jeffbr13 13y ago
  And what would be your approach to spam-filtering? One of Google Mail's strengths is that it can use data from millions of accounts' emails to train its spam-filter. Do you see Mailpile offering some way to do the same thing in the future, with clients flagging spam and the result being used to train a 'community' filter?
  - HerraBRE 13y ago
    This is still largely an open question. But there are some interesting possibilities for those who actually make their Mailpile visible on the public web - Mailpiles could talk to each other and exchange data of this sort. But ideally things like this would be a community effort shared between projects and we would join, not necessarily lead.
    - alextingle 13y ago
      If encrypted & signed mail becomes common enough, then I suspect the spam problem goes away. I suspect spammers won't want to sign their mail, and if they do, it would be trivial to distrust new public keys and maintain a global blacklist of bad established ones. Then almost all encrypted mail can be simply trusted, and spam filtering only has to pick out the occasional real message from the unencrypted dross.

joeyh 13y ago

Please fix the "it's" typo on your website ;)

HerraBRE 13y ago
Haha, noted. Thanks.

ssp 13y ago

Do you have plans to make money off of this?

M4v3R 13y ago
They've started an indiegogo campaign to fund the development. http://www.indiegogo.com/projects/mailpile-taking-e-mail-back http://www.indiegogo.com/projects/mailpile-taking-e-mail-bac...

andrewcooke 13y ago

how does the search work? is there a separate database? i use mairix (which does construct a separate database) and it's pretty damn awesome. have you looked at that? are re-inventing something worse? sometimes it is useful to search just the body. and mairix works fine with a huge volume of mail. also, getmail is python and does pop and imap downloads, so could be used there. [otherwise, this seems awesome and if i run out of my own dumb ideas i will seriously consider contributing]

HerraBRE 13y ago
It is a custom search engine, written in Python. It works surprisingly well, most queries are answered under 200ms and tens of milliseconds are common once caches are warm.
- beachstartup 13y ago
  any plans for a solr support? there's a lot of knowledge out there on how to scale solr for large webmail deployments like i.e. inside a large company or for forensic mail analysis.
  - rhizome31 13y ago
    I was wondering about that as well. Why not go with an existing search engine? Having checked out the code it seems that the project it still in its infancy. A lot of effort has probably gone into building the search engine though, which kind of seem like re-inventing the wheel but I'm sure you have reasons that I don't see. By the way, as test-infected coder, my first move was to launch the test suite, and it was a bit surprising that it wanted to run sudo :) I didn't go further for now because I don't have time to setup fetchmail, will do later. You guys seem to have a lot of potential and good intentions :) In my end of the world I'm also dreaming of "taking back email" and I happen to write Python for a living, so I'll be watching you guys very closely. Quite frankly though, I won't consider contributing until you have a proper test suite :) Keep it up!
    - 13y ago

susi22 13y ago

Not a question but a comment: You should add an igg link to the github README. Some people link to github projects instead of the website. Good luck!

gingerlime 13y ago
What's an "igg link"?
- mikkow 13y ago
  Indiegogo link
HerraBRE 13y ago
Yes, very good point. :)

mkl 13y ago

"Mailpile is a modern web-mail you run on your own computer." I think this sentence should be the first thing anyone sees when they go to the page. The text at the moment assumes everyone already knows roughly what Mailpile is, so I didn't figure it out until I read HN comments. Also, are there screenshots somewhere?

HerraBRE 13y ago
Brennan was working on getting some screenshots uploaded. We are obviously very busy reloading everything at the moment. ;-)
jspaetzel 13y ago
I think that this sentence needs to be gotten rid of completely. - Webmail is fundamentally not something that can run on your own computer. The word is "web" mail, not desktop mail, it's just going to confuse users. In addition to it being confusing, because of dynamic IPs and residential port blocking you may be able to run it on your computer, you just won't be able to do anything with it due to other internet infrastructure... - Sending mail from home is almost guaranteed to fail sometimes/often, due to dynamic ip ranges which are frequently blocked. - Port 25 and port 80 are blocked by most major american ISPs these days for residential services. Making this unusable from a home server. Not to mention it's against many ISPs terms of service to run a server from home without paying for a business package. (That's right, it's not just google fibre) - SPF records and other forms of email authentication? You would also need a third party DDNS service if using a dynamic IP. So with all of that said, I like the interface pictures. It could be a good competitor to webmail clients like roundcube and friends.
- alextingle 13y ago
  > Sending mail from home is almost guaranteed to fail... It's an MUA - it can sent mail just as well as any other MUA. Use your ISP's smarthost if you are using it from home. > Webmail is fundamentally not something that can run on your own computer. This statement is plain wrong, even if by "your own computer" you really mean "your desktop box". I can run any server I like on my desktop box. If it has a well designed installer, then it would be as easy to set up as a "normal" app - the end user might not ever know the technical details. > The word is "web" mail, not desktop mail, it's just going to confuse users. Now I do agree with you. The product seems to be a little bit of both, so there is some potential for confusion. "Web-mail you run on your own computer" does seem to explain it pretty well though.

guygurari 13y ago

I applaud your efforts! I did not see mobile mentioned. Will there be a mobile-friendly version of the web client? Will there be IMAP access from (e.g.) mobile devices? (Under 'Current Features' you mention IMAP, but I did not understand if this refers to you acting as an IMAP client or server.) By the way, there seems to be a copy-paste typo in the description for 'Spam Detection'; it reads 'PGP encryption and verification of emails and recipients'.

HerraBRE 13y ago
Yes, making the web mobile friendly is definitely on the list of things to do. Native apps may come later, once the APIs have stabalized a bit. The current IMAP support is functioning as an IMAP client, we haven't started work on the server side yet. And thanks for the typo report :)
- alternize 13y ago
  so if i understand you comment right: it will be a MUA that accessed through a webbrowser, and one still needs to have an IMAP capable email-account somewhere else?
  - HerraBRE 13y ago
    Yes, at least to begin with, we are not providing people with domains or e-mail addresses. IMAP, POP3, or run your own SMTP server...
    - alternize 13y ago
      but then I'm not really seeing what the advantagess over running thunderbird + engimail locally or using roundcube (which also has openpgp support built in) would be?
    - unhammer 13y ago
      sigh … I already have email clients that do PGP on my email that is hosted on Someone Else's Computer. It doesn't seem like Mailpile moves me a single step away from the dragnet. When I saw the "pagekite" username on github, I immediately hoped for plug-and-play self-hosted IMAP/SMTP. Here is what I envisioned in the blissfully ignorant moments until I read what the project was actually about: The user gets to download/buy a USB stick image / raspberry pi SD image. After plugging it into a pi or other box and turning that on, user types in the URL "mailpile" on their laptop web browser and on first run, user gets asked by web app to plug in a big harddrive for storing email on[1]. The box runs some IMAP server (dovecot?), connected to some MTA that does TLS (postfix?). The user has paid for an already setup domain name, kept in sync with the IP address of that box (which runs a dyndns-like daemon), user also gets access to some server that relays SMTP without breaking TLS (since most mail servers will not accept SMTP from just any dynamic IP). So on first run, the user also has to enter the credentials for the service they paid for, these credentials are used to let the box get its SSL key signed by the CA, tell the dyndns service that this box gets to update this domain name etc. Now if two users run this, they don't even need PGP to communicate in an encrypted way, it looks just like any other sent email. Nor can anyone requisition their mail without breaking into their house. So the paid service would be to get a dyndns-updatable domain name with SSL, and access to some server that relays SMTP. The service would have to dole out domain names and either be a CA itself, or be able to intermediate in the SSL key signing process. [1] For bonus points, dejadup runs there and user gets to say "send encrypted backups to dropbox/some ssh account/some other USB drive"

eps 13y ago

> Smári is the director if the International Modern Media Institute of

ippisl 13y ago

What about anonymity ? email has a potential for better anonymity than TOR via mixmaster or other remailers. Are you considering those features ?

HerraBRE 13y ago
It's not on the roadmap yet, but that is why we want to build a community, to see what people want.

barend 13y ago

Your introductory text and video mention the NSA and PGP. The PGP system has been around for a long time without getting any mainstream traction. There are numerous reasons for this failure, but the general complexity of public key crypto has to be one of them. On the project page you write > An intuitive, modern user interface makes strong security accessible to everyone. Can you share a bit more about the way you envision this?

HerraBRE 13y ago
Big, big topic. I suggest you follow our Twitter account or something, we'll probably be blogging about this later on in the campaign.

alecco 13y ago

Thank you! will donate today. What about perfect forward secrecy for server connections? What about transparent text compression?

HerraBRE 13y ago
Sounds like those are out of scope, that's just down to correctly configuring the SSL server. But yeah, I hope we correctly configure our SSL servers. ;-)

rhizome31 13y ago

Why AGPL rather than a more liberal license like BSD or MIT? Edit: Just to clarify why I'm asking this, the project looks very interesting and I suppose the choice of AGPL wasn't made lightly, as it might slow down adoption by commercial organizations, so I'm interested in the reasoning behind this choice.

HerraBRE 13y ago
This is something we have debated extensively. Our main goal is to improve privacy and security on-line - giving cloud providers yet another free tool with which to build proprietary services and lock in more users and their data feels like it would be counterproductive. However, we are open to discussing, and if a significant fraction of our backers would prefer a more liberal license we will probably switch.
- alecco 13y ago
  Please stay AGPL. It's the right choice for these times. BTW, beware of code ownership of pull requests from corporations.
  - pixelcort 13y ago
    Regarding Pull Requests, this is quite important if and when you want to change licenses, or dual license. Make sure you have on file release forms for every copyright holder who submits code that grant you permission to relicense later on. For one line bug fixes it can be a pain, but it's worth it. One problem with this though is that it places an unfair advantage with the current maintainer. A fork of the project wouldn't inherit the relicensing permissions from all the contributors.
    - icebraining 13y ago
      Ugh, why? You're just discouraging people from contributing by forcing them to accept that their code might be used in a matter they don't approve of in the future.

jerrac 13y ago

Any plans for .deb/.rpm repositories?

HerraBRE 13y ago
Of course, but that's months away. We gotta write the software first!
- jerrac 13y ago
  'Course it's months away. :) I've noticed that some applications don't offer their own repositories. So I've been left with either relying on the distributions out of date packages, or installing the application manually. That's why I asked. I'd rather use your repos so that I can keep it up to date.
  - tmzt 13y ago
    Another option is packaging it with docker (http://docker.io http://docker.io) so it could be dropped onto an existing system quickly.