7 ms·

RainLoop Webmail: Simple, modern and fast web-based email client

115 points by mintplant 12y ago

infocollector 12y ago
Nice!
alex_duf 12y ago
I hope it's going to be integrated into https://yunohost.org https://yunohost.org
taneem 12y ago
This is very promising. Ever since Gmail for domains and Outlook for domains became paid-only, I've been looking for alternatives. This looks like potentially a perfect solution.
- prg318 12y ago
  You might want to look into roundcube [1] which is another PHP webmail application that has a very nice UI,, (more) mature codebase, and is on an (arguably) better license (GPL3). I can't say how it compares to rainloop because the demo servers are slammed right now, but I would recommend roundcube in general. [1] http://roundcube.net/ http://roundcube.net/
  - tbrock 12y ago
    Except nobody wants a PHP webmail application.
    - johnchristopher 12y ago
      Could you share alternatives written in another language ?
    - daledavies 12y ago
      Can you explain why?
      - pjc50 12y ago
        Terrible security record of PHP apps, probably.
        brokenparser 12y ago
        Doesn't make sense because Squirrelmail is also written in PHP and it's pretty solid. The next version will use HTTP-only cookies to further harden against attacks.
        mgkimsal 12y ago
        do you know of any particular reason that wasn't put in to place years ago? concern for legacy browsers at all costs? it sounds snarky, but it's a genuine question - I think I've set my apps to be http-only cookies for a while now, and am wondering why someone would only get around to it in 2014.
edwardio 12y ago
Going to be "that guy": On the installation page, it says to do this: curl -s http://repository.rainloop.net/installer.php | php wget -qO- http://repository.rainloop.net/installer.php | php This is incredibly dangerous. Because it's http, it can be Man-In-The-Middle'd, so you're basically executing arbitrary commands on your computer. (See: php function exec()). Also, even if it's non TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious.
- gtCameron 12y ago
  Couldn't you say the same thing about downloading and running any installer from the internet? There is nothing special about PHP that makes this insecure, the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it.
  - thrownaway2424 12y ago
    The point is there's no SSL.
  - jnbiche 12y ago
    >There is nothing special about PHP that makes this insecure He didn't say it was because of PHP, he said it was because of http (i.e., because it's not over SSL). > the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it Exactly, which is why people who are security conscious never simply execute a Windows installer downloaded from the browser (or wget, for that matter). At a minimum, one checks the file hashes. Ideally, one confirms that the executable has been properly signed and not tampered with (by right-clicking the file, clicking 'properties' and looking at the 'signature' tab, or else manually checking if it's been GPG signed).
- thrownaway2424 12y ago
  For a long time the officially documented way to install GNOME was to lynx -dump http://go.gnome.org http://go.gnome.org and pipe it to a root shell. Looks like the industry hasn't learned much in twenty years.
adambatkin 12y ago
The license (CC BY-NC-SA 3.0) kinda sucks. It's not Free or Open Source, but more importantly, "non commercial" for a webmail client is probably an impossibly high standard for the type of person who would be setting up their own webmail client. Even CC recommends against using CC licenses for software.
- sheetjs 12y ago
  > We recommend against using Creative Commons licenses for software ... CC licenses may be used for software documentation, as well as separate artistic elements such as game art or music http://wiki.creativecommons.org/FAQ#Can_I_apply_a_Creative_Commons_license_to_software.3F http://wiki.creativecommons.org/FAQ#Can_I_apply_a_Creative_C...
- kentonv 12y ago
  Ugh. Rainloop has been on my "to-port" list for sandstorm.io but I hadn't noticed the license. If I want to make this available as a "free" package that can be installed on an open source platform, but I also want to sell hosting for that platform, am I using it for my own commercial advantage and thus violating the license? Who knows? Guess I'll stick to mailpile and roundcube.
  - tonglil 12y ago
    Try Modoboa? Link: http://modoboa.org/en/ http://modoboa.org/en/
    - kentonv 12y ago
      Ooh, thanks, I'll add that to the list.
- vertex-four 12y ago
  Apparently they want you to pay $85 a year for a real license, which is a complete shame, but rational given that there is at present a total of one reasonably modern open-source email client (Roundcube) and it's still pretty dreadful to work with, and in some cases hard to use. Rainloop don't have much in the way of open-source competitors to drive the market price near 0.
TimWolla 12y ago
Hacker News effect, the demo takes ages to load. But the frontend looks cleaner than Roundcube, it might be worth a try.
damm 12y ago
There's a lot of php webmail software out there; the php script for installation just makes you want to run away.
- johnchristopher 12y ago
  You can download the zip file if you'd rather install that way.
- fredsted 12y ago
  Seems pretty sane to me: checks for dependencies, unzips the application files, chmods some data folders. It may be a little complex, but that's understandable since PHP can be used on any platform.
TimWolla 12y ago
I don't know how I should feel about this secure method of generating a salt that is used for almost everything as it seems: // random salt $sSalt = '<'.'?php //' .md5(microtime(true).rand(1000, 5000)) .md5(microtime(true).rand(5000, 9999)) .md5(microtime(true).rand(1000, 5000)); @file_put_contents(APP_DATA_FOLDER_PATH.'SALT.php', $sSalt); It looks like they just threw some cryptographic hash functions at things and hope it works out.
- deleted 12y ago
  [deleted]
- jnbiche 12y ago
  I don't really know PHP, but what's the problem? A salt doesn't have to be perfectly random. It just should be unlike any other salt in use. This looks like it would meet that requirement. Edit: Since this is HN, I feel obliged to point out that there is a small vulnerability introduced by using a non-CSPRNG here. If an attacker is already surveiling you, and is able to perfectly deduce the state of your PRNG before you generate your salt, and the attacker plans to steal your db at some point in the future, he can get a head start in generating rainbow tables against your database. But the main value of a salt is in being globally unique, which this is.
  - chacham15 12y ago
    >he can get a head start in generating rainbow tables against your database. While it is true that he can get a head start, a head start is quite useless because the work necessary to reverse one hash is independent of the work necessary to reverse a different hash. That means that you still have to brute force each password individually.
- mintplant 12y ago
  It's not my project, but I'm sure a pull request would be appreciated. https://github.com/RainLoop/rainloop-webmail https://github.com/RainLoop/rainloop-webmail
- chacham15 12y ago
marco1 12y ago
How does it compare to Roundcube [1] which is solid, proven and has a better license? [1] https://github.com/roundcube/roundcubemail https://github.com/roundcube/roundcubemail
- jonahx 12y ago
  It may have improved, but when I used roundcube on webfaction a year or two ago, it was unusably slow.
  - fredsted 12y ago
    Try it again. Maybe WebFaction customized it? Roundcube is plenty fast.
  - pjc50 12y ago
    I use it on a smaller host, and it's alright. It doesn't seem to support multi-selection of email so you have to delete or move messages one at a time, and it's not at all ajaxy.
deleted 12y ago
[deleted]
coherentpony 12y ago
I did a Cmd-f for 'secure' and 'encrypt' on the front page got no hits.
- fredsted 12y ago
  You forgot PGP and SSL. http://rainloop.net/features/ http://rainloop.net/features/
  - coherentpony 12y ago
    Thanks!
Cowicide 12y ago
The privacy policy says that personal information, such as my name or e-mail address, is private and confidential. I assume that personal information would include the contents of my emails. However, with email privacy policies I'd rather not rely on assumptions and see it spelled out more specifically.
goblin89 12y ago
I wonder what does RainLoop use as ‘backend’ for communication with mail servers. Are there standalone libraries that fully support, say, Gmail IMAP features? Libraries one can build a mail management GUI on top of. Last time I updated Apple Mail it included yet a few more fixes specifically for Gmail IMAP support. This makes me think that a compatible enough decent solution requires knocking together something custom at this point.
- josteink 12y ago
  Are there standalone libraries that fully support, say, Gmail IMAP features? If you have to call them "Gmail IMAP features" they really aren't IMAP at all and it would be better to call them proprietary Google-extensions. Gmail does not follow standard IMAP, and no standard IMAP client can fully interop with Gmail. That's a decision Google made, and you can't blame anyone else for the consequences of that.
  - nl 12y ago
    It's been a while since I looked at it, but my impression had been that Gmail does follow IMAP, but some features of Gmail aren't represented in IMAP. A simple example is that IMAP expects a message to be in a single folder but Gmail allows you to use multiple labels. I'm pretty sure that this particular issue had no real impact, but there are others that do (difference in handling deleted messages sounds right?) IMAP has no concept of "Archive", which is a key Gmail feature. I think I remember some talk about how Apple deals with that. I don't think you can blame either Google or Apple or IMAP for this. It's how standards work: good for interop, but don't always deal with innovation well.
    - pjc50 12y ago
      What does the gmail android app do? Does it speak IMAP, IMAP-with-proprietary-extensions, or something else?
      - mike_hearn 12y ago
ehPReth 12y ago
Does this validate TLS/SSL connections? Roundcube has the option for TLS/SSL IMAP/SMTP but doesn't preform any validation :/
chanux 12y ago
Reporting a typo: Purchase Subscription Key on gimroad.com It should be gumroad.com
ForFreedom 12y ago
What exactly is the "PLUS" in this client? How does it fare against RoundCube? The colors could be better.
- eng_monkey 12y ago
  It seems to support GPG.
girvo 12y ago
What's up with the Password setup here? It's using symmetric encryption rather than a slow hash? I'm no cryptographer, but I always thought that was generally a terrible idea... Or am I reading that terribly wrong, it is 5.30pm here and my brain has shut off for the day. https://github.com/RainLoop/rainloop-webmail/blob/be45d989f85b2db9b06fc5515822a4e11227d13a/build/owncloud/rainloop-app/lib/RainLoopHelper.php https://github.com/RainLoop/rainloop-webmail/blob/be45d989f8...
- LeoPanthera 12y ago
  Is that because it needs to know your password to pass it on to the mail server?
  - girvo 12y ago
    Ah hah, alright, that makes sense. I knew I was missing something, thanks.
jiggy2011 12y ago
How does this compare to roundcube?
kalleboo 12y ago
Slightly off-topic - mobile. Roundcube and this solves the webmail client send nicely. IMAP PUSH solves the desktop end nicely. But the reason I switched away from self-hosting my email was due to the lack of IMAP PUSH on iOS (ironically this was never a problem on several generations of dumbphones I had before, which supported IMAP PUSH). As far as I can tell, all the current alternatives to get your IMAP email pushed to your iOS device require giving a third party full access to your email. Or does anyone know of anything I've missed?
lazyant 12y ago
http://demo.rainloop.net/ http://demo.rainloop.net/ Resource temporarily unavailable - please try again later.
therealidiot 12y ago
Looks great, and it's awesome that it has pgp support, but it seems that unless your key is created specifically with the current email address you just can't use it? would be nice if you could use any key for which you had the secret part Also, how does it handle verifying signed messages from keys which you don't have? does it have support for searching via keyservers/using pka stuff to find a key?

115 points by mintplant 12y ago

infocollector 12y ago

Nice!

alex_duf 12y ago

I hope it's going to be integrated into https://yunohost.org https://yunohost.org

taneem 12y ago

This is very promising. Ever since Gmail for domains and Outlook for domains became paid-only, I've been looking for alternatives. This looks like potentially a perfect solution.

prg318 12y ago
You might want to look into roundcube [1] which is another PHP webmail application that has a very nice UI,, (more) mature codebase, and is on an (arguably) better license (GPL3). I can't say how it compares to rainloop because the demo servers are slammed right now, but I would recommend roundcube in general. [1] http://roundcube.net/ http://roundcube.net/
- tbrock 12y ago
  Except nobody wants a PHP webmail application.
  - johnchristopher 12y ago
    Could you share alternatives written in another language ?
  - daledavies 12y ago
    Can you explain why?
    - pjc50 12y ago
      Terrible security record of PHP apps, probably.
      - brokenparser 12y ago
        Doesn't make sense because Squirrelmail is also written in PHP and it's pretty solid. The next version will use HTTP-only cookies to further harden against attacks.
        mgkimsal 12y ago
        do you know of any particular reason that wasn't put in to place years ago? concern for legacy browsers at all costs? it sounds snarky, but it's a genuine question - I think I've set my apps to be http-only cookies for a while now, and am wondering why someone would only get around to it in 2014.

edwardio 12y ago

Going to be "that guy": On the installation page, it says to do this: curl -s http://repository.rainloop.net/installer.php | php wget -qO- http://repository.rainloop.net/installer.php | php This is incredibly dangerous. Because it's http, it can be Man-In-The-Middle'd, so you're basically executing arbitrary commands on your computer. (See: php function exec()). Also, even if it's non TLS/SSL, you're putting a lot of trust in Rainloop not being hacked or malicious.

gtCameron 12y ago
Couldn't you say the same thing about downloading and running any installer from the internet? There is nothing special about PHP that makes this insecure, the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it.
- thrownaway2424 12y ago
  The point is there's no SSL.
- jnbiche 12y ago
  >There is nothing special about PHP that makes this insecure He didn't say it was because of PHP, he said it was because of http (i.e., because it's not over SSL). > the exact same attack you describe could be done when you are downloading a Windows installer executable from a browser and double clicking it Exactly, which is why people who are security conscious never simply execute a Windows installer downloaded from the browser (or wget, for that matter). At a minimum, one checks the file hashes. Ideally, one confirms that the executable has been properly signed and not tampered with (by right-clicking the file, clicking 'properties' and looking at the 'signature' tab, or else manually checking if it's been GPG signed).
thrownaway2424 12y ago
For a long time the officially documented way to install GNOME was to lynx -dump http://go.gnome.org http://go.gnome.org and pipe it to a root shell. Looks like the industry hasn't learned much in twenty years.

adambatkin 12y ago

The license (CC BY-NC-SA 3.0) kinda sucks. It's not Free or Open Source, but more importantly, "non commercial" for a webmail client is probably an impossibly high standard for the type of person who would be setting up their own webmail client. Even CC recommends against using CC licenses for software.

sheetjs 12y ago
> We recommend against using Creative Commons licenses for software ... CC licenses may be used for software documentation, as well as separate artistic elements such as game art or music http://wiki.creativecommons.org/FAQ#Can_I_apply_a_Creative_Commons_license_to_software.3F http://wiki.creativecommons.org/FAQ#Can_I_apply_a_Creative_C...
kentonv 12y ago
Ugh. Rainloop has been on my "to-port" list for sandstorm.io but I hadn't noticed the license. If I want to make this available as a "free" package that can be installed on an open source platform, but I also want to sell hosting for that platform, am I using it for my own commercial advantage and thus violating the license? Who knows? Guess I'll stick to mailpile and roundcube.
- tonglil 12y ago
  Try Modoboa? Link: http://modoboa.org/en/ http://modoboa.org/en/
  - kentonv 12y ago
    Ooh, thanks, I'll add that to the list.
vertex-four 12y ago
Apparently they want you to pay $85 a year for a real license, which is a complete shame, but rational given that there is at present a total of one reasonably modern open-source email client (Roundcube) and it's still pretty dreadful to work with, and in some cases hard to use. Rainloop don't have much in the way of open-source competitors to drive the market price near 0.

TimWolla 12y ago

Hacker News effect, the demo takes ages to load. But the frontend looks cleaner than Roundcube, it might be worth a try.

damm 12y ago

There's a lot of php webmail software out there; the php script for installation just makes you want to run away.

johnchristopher 12y ago
You can download the zip file if you'd rather install that way.
fredsted 12y ago
Seems pretty sane to me: checks for dependencies, unzips the application files, chmods some data folders. It may be a little complex, but that's understandable since PHP can be used on any platform.

TimWolla 12y ago

I don't know how I should feel about this secure method of generating a salt that is used for almost everything as it seems: // random salt $sSalt = '<'.'?php //' .md5(microtime(true).rand(1000, 5000)) .md5(microtime(true).rand(5000, 9999)) .md5(microtime(true).rand(1000, 5000)); @file_put_contents(APP_DATA_FOLDER_PATH.'SALT.php', $sSalt); It looks like they just threw some cryptographic hash functions at things and hope it works out.

deleted 12y ago
[deleted]
jnbiche 12y ago
I don't really know PHP, but what's the problem? A salt doesn't have to be perfectly random. It just should be unlike any other salt in use. This looks like it would meet that requirement. Edit: Since this is HN, I feel obliged to point out that there is a small vulnerability introduced by using a non-CSPRNG here. If an attacker is already surveiling you, and is able to perfectly deduce the state of your PRNG before you generate your salt, and the attacker plans to steal your db at some point in the future, he can get a head start in generating rainbow tables against your database. But the main value of a salt is in being globally unique, which this is.
- chacham15 12y ago
  >he can get a head start in generating rainbow tables against your database. While it is true that he can get a head start, a head start is quite useless because the work necessary to reverse one hash is independent of the work necessary to reverse a different hash. That means that you still have to brute force each password individually.
mintplant 12y ago
It's not my project, but I'm sure a pull request would be appreciated. https://github.com/RainLoop/rainloop-webmail https://github.com/RainLoop/rainloop-webmail
chacham15 12y ago

marco1 12y ago

How does it compare to Roundcube [1] which is solid, proven and has a better license? [1] https://github.com/roundcube/roundcubemail https://github.com/roundcube/roundcubemail

jonahx 12y ago
It may have improved, but when I used roundcube on webfaction a year or two ago, it was unusably slow.
- fredsted 12y ago
  Try it again. Maybe WebFaction customized it? Roundcube is plenty fast.
- pjc50 12y ago
  I use it on a smaller host, and it's alright. It doesn't seem to support multi-selection of email so you have to delete or move messages one at a time, and it's not at all ajaxy.

deleted 12y ago

[deleted]

coherentpony 12y ago

I did a Cmd-f for 'secure' and 'encrypt' on the front page got no hits.

fredsted 12y ago
You forgot PGP and SSL. http://rainloop.net/features/ http://rainloop.net/features/
- coherentpony 12y ago
  Thanks!

Cowicide 12y ago

The privacy policy says that personal information, such as my name or e-mail address, is private and confidential. I assume that personal information would include the contents of my emails. However, with email privacy policies I'd rather not rely on assumptions and see it spelled out more specifically.

goblin89 12y ago

I wonder what does RainLoop use as ‘backend’ for communication with mail servers. Are there standalone libraries that fully support, say, Gmail IMAP features? Libraries one can build a mail management GUI on top of. Last time I updated Apple Mail it included yet a few more fixes specifically for Gmail IMAP support. This makes me think that a compatible enough decent solution requires knocking together something custom at this point.

josteink 12y ago
Are there standalone libraries that fully support, say, Gmail IMAP features? If you have to call them "Gmail IMAP features" they really aren't IMAP at all and it would be better to call them proprietary Google-extensions. Gmail does not follow standard IMAP, and no standard IMAP client can fully interop with Gmail. That's a decision Google made, and you can't blame anyone else for the consequences of that.
- nl 12y ago
  It's been a while since I looked at it, but my impression had been that Gmail does follow IMAP, but some features of Gmail aren't represented in IMAP. A simple example is that IMAP expects a message to be in a single folder but Gmail allows you to use multiple labels. I'm pretty sure that this particular issue had no real impact, but there are others that do (difference in handling deleted messages sounds right?) IMAP has no concept of "Archive", which is a key Gmail feature. I think I remember some talk about how Apple deals with that. I don't think you can blame either Google or Apple or IMAP for this. It's how standards work: good for interop, but don't always deal with innovation well.
  - pjc50 12y ago
    What does the gmail android app do? Does it speak IMAP, IMAP-with-proprietary-extensions, or something else?
    - mike_hearn 12y ago

ehPReth 12y ago

Does this validate TLS/SSL connections? Roundcube has the option for TLS/SSL IMAP/SMTP but doesn't preform any validation :/

chanux 12y ago

Reporting a typo: Purchase Subscription Key on gimroad.com It should be gumroad.com

ForFreedom 12y ago

What exactly is the "PLUS" in this client? How does it fare against RoundCube? The colors could be better.

eng_monkey 12y ago
It seems to support GPG.

girvo 12y ago

What's up with the Password setup here? It's using symmetric encryption rather than a slow hash? I'm no cryptographer, but I always thought that was generally a terrible idea... Or am I reading that terribly wrong, it is 5.30pm here and my brain has shut off for the day. https://github.com/RainLoop/rainloop-webmail/blob/be45d989f85b2db9b06fc5515822a4e11227d13a/build/owncloud/rainloop-app/lib/RainLoopHelper.php https://github.com/RainLoop/rainloop-webmail/blob/be45d989f8...

LeoPanthera 12y ago
Is that because it needs to know your password to pass it on to the mail server?
- girvo 12y ago
  Ah hah, alright, that makes sense. I knew I was missing something, thanks.

jiggy2011 12y ago

How does this compare to roundcube?

kalleboo 12y ago

Slightly off-topic - mobile. Roundcube and this solves the webmail client send nicely. IMAP PUSH solves the desktop end nicely. But the reason I switched away from self-hosting my email was due to the lack of IMAP PUSH on iOS (ironically this was never a problem on several generations of dumbphones I had before, which supported IMAP PUSH). As far as I can tell, all the current alternatives to get your IMAP email pushed to your iOS device require giving a third party full access to your email. Or does anyone know of anything I've missed?

lazyant 12y ago

http://demo.rainloop.net/ http://demo.rainloop.net/ Resource temporarily unavailable - please try again later.

therealidiot 12y ago

Looks great, and it's awesome that it has pgp support, but it seems that unless your key is created specifically with the current email address you just can't use it? would be nice if you could use any key for which you had the secret part Also, how does it handle verifying signed messages from keys which you don't have? does it have support for searching via keyservers/using pka stuff to find a key?