I've spent the last two years building a new email client

Re:I've spent the last two years building a new email client by porker on Wednesday May 02, 2018 @05:21AM (#16975256)

I've downvoted you for your sheer negativity.

This is a person who's worked 2 years on a project, in a neglected space where companies don't go because they can't make money.

He deserves praise for taking the time, creating something that's different, and thinking through the idea. Well done!

[ Parent | on HN ]

Re:I've spent the last two years building a new email client by cronin101 on Wednesday May 02, 2018 @05:54AM (#16975436)

He isn't trying to take away from the achievement, just highlighting some legitimate security concerns.

IMHO this is justified since people often overlook how critical an attack vector this would be.

Imagine if a state-sponsored "hobbyist" posted a pet project like the OP to Reddit and started harvesting keys/password reset capabilities for huge amounts of users.

Hell, people flocked to use unroll.me and then it turned out they were (predictably) scraping your entire inbox and selling the data to advertisers.

I don't believe that worrying somebody's skepticism might hurt feelings is a legitimate reason to downvote (remember, downvotes aren't about whether you agree with somebody; it's about whether they add constructively to discussion).

Aside: Great work OP. Seems like an incredibly hard sector to make traction with though, so best of luck.

[ Parent | on HN ]

Re:I've spent the last two years building a new email client by ryandrake on Wednesday May 02, 2018 @07:19AM (#16975838)

Yea, I kind of feel the same way about it. "Great work but not my cup of tea for reasons A, B, and C" should be valid feedback on a Show HN.

[ Parent | on HN ]

Re:I've spent the last two years building a new email client by porker on Wednesday May 02, 2018 @08:31AM (#16976264)

Absolutely. But the OP forgot the "Great work but...". Had they, I wouldn't have commented.

[ Parent | on HN ]

Re:I've spent the last two years building a new email client by dogma1138 on Wednesday May 02, 2018 @06:14AM (#16975534)

Security concerns are the one of the primary reasons why so many email clients died out mid to late 2000’s when every red team success story was “found XSS in email client pwned admin”.

No body is detracting anything from anyone but there is no way I’m trusting an application that can take contol of a large portion of my life without assurances.

If your email address gets compromised it’s game over for most people every service you’ve registered with is up for grabs which is also the reason why I don’t recommend anyone to use personal domains for email unless they are willing to pay for it till death do them part.

As time and time again after buying a domain that was used by someone else and setting up a catch all email address I got emails from Twitter, GitHub and the likes.

[ Parent | on HN ]

Re:I've spent the last two years building a new email client by partycoder on Wednesday May 02, 2018 @05:32AM (#16975319)

I built a webmail client from scratch many years ago and I agree with the security concerns. In my case the credentials were not a problem with displaying inline HTML securely was difficult to get right. Back then there was no CSP.

[ Parent | on HN ]

Re:I've spent the last two years building a new email client by JustSomeNobody on Wednesday May 02, 2018 @06:41AM (#16975666)

Just because someone works on something for two years doesn't mean they "deserve" anything. That's flawed reasoning.

[ Parent | on HN ]