Modern email can be built from borrowed parts

Posted by andros 9 hours ago

Counter114Comment51OpenOriginal

Comments

Comment by 8organicbits 5 hours ago

I think the network effects make email hard to replace, virtually everyone online has an email address. If this could include a migration path, with backwards compatibility with SMTP, I think it would have a better shot of getting adoption.

Modern email already depends on HTTP, with protocols like MTA-STS (https://www.rfc-editor.org/info/rfc8461/) using HTTPS/TLS to improve transit encryption, or Web Key Directory (https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...) which uses HTTP for public key distribution. Personally I think these incremental improvements of SMTP are more promising than replacements, but we deserve better email however we can build it.

Comment by myaccountonhn 51 minutes ago

The sad thing is that the only successful attempts at tackling its popularity are proprietary, closed ecosystems.

Comment by citizenpaul 13 minutes ago

Yeah, this subject comes up every couple months. The problem is not getting it working. Its that email is a captured system at this point and the real work is various reputation management processes that the big providers control or you can't send email to/from them. They also have no real interest in letting you be your own email provider so its just pushing a rock up a hill grind, for what? To save <$100 a year piggybacking on another provider as a custom domain? or just use a free provider?

Comment by calvinmorrison 6 minutes ago

Having worked at a provider, that is not the psychology at all. The #1 priority is to keep the mail flowing. #2 incremental improvements to security, spam, reputation is a distant second. The other thing is, providers already know and have people who work on email standards, work in the ecosystem, etc. So once you're inside, with people who know whats going on, know the tools, know how things work intuitively without having to read a manual, theres less desire to change.

Comment by amelius 6 hours ago

> First-contact consent: an unknown sender doesn't get into the mailbox; they land in a "requests" box with their first message visible (like Signal's message requests). You accept, and the thread opens forever. A stranger can knock on your door, which is the essential property of mail, but they can't fill up your living room.

I like this.

Question: can this e-mail specification/implementation also replace direct-messaging protocols (like WhatsApp)?

Comment by TheOtherHobbes 3 hours ago

The unknown request will be buried in spam - a problem we have already, but worse.

And I do not want an infinite thread conversation. I want to be able to split off - and perhaps archive and export - different conversations by topic.

I recently had to some legal things, which included forwarding copies of a certain conversation to a lawyer. This turns out to be unreasonably difficult because email clients quote previous conversations. You want a clean thread of comment and reply about a specific topic. You don't get that.

You do get it on chat services, but there's no option there to create sub-conversations.

If I was redesigning email I would think long and hard about different use cases and workflows and start with an RFC. Protocols are far downstream of that.

Comment by jancsika 25 minutes ago

> The unknown request will be buried in spam - a problem we have already, but worse.

I feel like every one of these suggested changes to email comes with a functionally equivalent parody magic trick.

For this one, a magician has two stacks of cards: a tall stack of "spam" cards, and a small stack of "inbox" cards.

The magician moves the stacks apart to make a spot for a new "request" stack.

To start the stack, they pick up five "request" cards from the inbox stack with one hand while subtly pushing the entire stack of "spam" cards with the other hand to spot they made for the "request" stack.

They then pass the five cards they were holding behind their back, revealing them with the opposite hand and finally shuffling them into the now tall stack of "request" cards.

Ta da!

> If I was redesigning email I would think long and hard about different use cases and workflows and start with an RFC.

A magician sweeps 17 sloppy stacks of cards off the table. They then show how the first 15 cards they pick up can more easily be arranged in only three stacks. Voila! Everybody claps.

While the audience members put money in the hat, the pedants stick around and watch the magician pick up the rest of the cards and end up with 18 sloppy stacks by the time the audience for the next show arrives.

Edit: clarification

Edit 2: I forgot this part: "Protocols are far downstream of that." So imagine 8 tiny tables below the main one which somehow end up with more than 52 cards in each of their 17 sloppy stacks.

Comment by tcfhgj 2 hours ago

> You do get it on chat services, but there's no option there to create sub-conversations.

It's called threads - even Matrix has these

Comment by aboardRat4 3 hours ago

>Question: can this e-mail specification/implementation also replace direct-messaging protocols (like WhatsApp)?

Deltachat

Comment by dzonga 36 minutes ago

other email clients/services like Hey etc do this.

at one point Gmail had a service for this - if I remember well - but google being google - I guess it was just a promotion project for someone.

Comment by MrGilbert 5 hours ago

> I like this.

Honestly, I'd want this as a default. I wonder if a mailserver can be configure like this. Doesn't sound too hard, does it?

Comment by thesuitonym 3 hours ago

Believe it or don't, most mailservers actually are set up this way, but it's completely invisible to the user: https://en.wikipedia.org/wiki/Greylisting_(email)

Greylisting is not perfect, not even close, but it allows servers to reject huge amounts of garbage mail while allowing new mail from unexpected parties without user intervention.

Comment by dizhn 3 hours ago

It is similar but not the same thing. It does not have anything to do with the email being legit (non spam) or not. It only catches emails that do not do what they supposed to do when they are deferred for a little bit. They are supposed to try again later. (A super nice feature of email which protects you from losing all incoming emails when your server is down for a short time). The reasoning here is hopefully a spam script or software will not implement the standard properly or will skip apparently broken destinations.

What parent wants is also possible and I remember people doing it as far back as the early 2000s. You would basically manually whitelist an email or have them bypass the list (once or always) with something like a key word or token sort of like a captcha which can be shared off band.

Comment by thesuitonym 3 hours ago

It's definitely possible, a few companies do it, and let me tell you: People hate it.

Comment by PaulRobinson 1 hour ago

"We" tried this in the late 1990s. I remember writing an exim config to do this a couple of ways back in my ISP times:

1. "The recipient will not get this message until you authenticate yourself as a legitimate sender at this URL [...]" - resulted in people never getting mail from no-reply addresses they cared about (banks, e-com, etc.)

2. "This sender has sent you an email, with this subject and this first paragraph. Click here to whitelist, here to blacklist" - created a lot of churn on first setup that users didn't like as a UX

Baking it into the protocol - even now in SMTP and IMAP land - is doable, but would be resisted by email providers who, for example, make their money selling data to marketing agencies. Like, you know, Google, Microsoft, Yahoo...

I've seen other approaches proposed - even at IETF level - over the years, including digital postage stamps (sender pays to send email, your server gets paid, and may reject non-stamped/paying email), but it's the usual network effect: until it becomes widely supported it won't "stick". The stuff that has been adopted has basically been stuff that Google likes, period.

Comment by baudehlo 5 minutes ago

It also misses one of the biggest fundamental problems with SMTP: Lack of per-recipient replies. Though you could potentially mandate a single recipient per request. We wrote a plugin to emulate that in Haraka, where you just 400 (temp fail) each subsequent recipient. The downside is some sources just plain don't retry.

Comment by ponyous 40 minutes ago

Spark email client supports this. It’s great

Comment by stackghost 37 minutes ago

Pretty sure 37signals' email/calendar offering ("Hey") works this way.

Comment by fny 6 hours ago

Is there any reason they shouldn't be the same?

Comment by xd1936 6 hours ago

This is the way hey.com operates. It's nice.

Comment by ccamrobertson 4 hours ago

I think a lot of these concepts are fun/interesting, but I like that email today functions more like a mailbox than WhatsApp or Telegram. Whilst digital (or paper) spam is obnoxious I dislike the idea of binning every sender into a "unread" box until I approve them. I miss unreads all the time across apps like X and Telegram.

As a first step I would focus on something like broad S/MIME support. Unfortunately I suspect that the biggest email providers are disincentivized from doing this as it would disrupt their business models.

Comment by thesuitonym 3 hours ago

> Let's design the successor to email on top of HTTP

You can stop there, I've heard enough. Not everything is hypertext.

Comment by beej71 3 hours ago

And HTTP transports many, many more things than hypertext. It seems like a sensible choice for this use case in terms of capabilities.

Comment by jjice 2 hours ago

From the first paragraph:

>The goal is not to replace the current mail system, heaven forbid!, but to learn, have fun and discover current technologies to swap out every element: sending, receiving, gateway, keys, and so on.

It's all for fun.

Comment by andros 3 hours ago

Usually, informed people only read the headline.

Comment by aboardRat4 3 hours ago

Self-ejecting panels on three sides of the website are a horrible user experience.

Other than that...

The most important thing is not the protocol, it's the gui.

At the moment email's gui is horrible on all platforms without exception.

If/when a decent gui appears, protocols will follow.

Also, JMAP did reading can probably be just WebDAV?

Comment by andros 3 hours ago

GUIs cannot be built either before or during the specification of a protocol. In fact, this is the part that should have the least weight. There are important steps, such as system auditing or making design decisions (like certificate rotation), that are not addressed. However, the goal is not to replace SMTP/IMAP, but rather to show how modern tools, when properly assembled, can replace older protocols with serious design flaws. JMAP is flexible, mature, and easy to connect with current technologies. It's a better option.

Comment by marssaxman 3 hours ago

> At the moment email's gui is horrible on all platforms without exception.

This is obviously a matter of opinion. Of course there are endless different email GUIs, on all the platforms; if you don't like one, there are many alternatives.

I cannot imagine that a "decent GUI" by modern web-development standards could be anything I'd prefer to what already exists. Email works and generally doesn't let designer ego get in the way.

Comment by dewey 3 hours ago

> At the moment email's gui is horrible on all platforms without exception.

How can you say that when it's one of the benefits of email that it's an open protocol and there's thousands of different apps built on top of it. Terminal UIs, web interfaces, chat interfaces etc. - that should be one of the cases where there's a GUI for anyone.

Comment by andros 3 hours ago

Why do you find the panel experience so bad?

Comment by flexagoon 19 minutes ago

It's very annoying on mobile, covering half of the page all the time

Comment by andros 13 minutes ago

When you scroll down, they should all disappear. Do you have JavaScript disabled? What browser and device are you using?

Comment by wuschel 5 hours ago

> Optional postage for strangers: the server can answer a first contact with a 402. Configurable per mailbox; the cost of cold spamming stops being zero.

Interesting take re putting a cost on spam. Perhaps another take would be functionally implementing introductions.

> First-contact consent: an unknown sender doesn't get into the mailbox; they land in a "requests" box with their first message visible (like Signal's message requests). You accept, and the thread opens forever. A stranger can knock on your door, which is the essential property of mail, but they can't fill up your living room.

Unfortunately, this will only move the problem, and only reduce it in the case when all outside communication is ignored.

Comment by philipwhiuk 3 hours ago

Yeah the 'Requests' folder just becomes the new Inbox folder.

Email clients already highlight/filter people in your contacts

Comment by Multicomp 2 hours ago

We could add a friend-of-friend for 1 degree of separation (Alice gets an email from Bob, she doesn't know Bob, so it would go into her Requests folder. But Charlie knows Bob and has said 'yes this guy is legit' and Alice has configured her email to trust Charlie's email recommendations up to 2 degrees of separation, so it goes into the inbox with an explanation that it was allowed by Charlie's trust of Bob).

And poof, we've poorly remembered Web of Trust from 20 years ago!

Overall I do love the idea of HTMP and if we could get it to easily fall back to standard old bad email, I think it could start as a niche and then upgrade towards HTMP over time as more clients adopted support for it.

Comment by AKSF_Ackermann 4 hours ago

Content-addressed email breaks mailing lists, as those need to be able to add headers for subscribe/unsubscribe/list id, etc. There is a reason DKIM allows you to pick which headers to sign.

Comment by dinkelberg 56 minutes ago

Copies the mistake from PGP with the unencrypted metadata.

Comment by zdw 1 hour ago

I'd take this the opposite direction - HTTP should get more like SMTP.

Take this thought experiment - how does nearly every other standard protocol (DNS, SMTP, etc.) except for HTTP survive at scale without server-side load balancing?

Thankfully we're heading in this direction due to happy eyeballs and related client-side retry mechanisms.

Comment by jfb 2 hours ago

I like that the author at least head fakes towards postage, which is how spam gets solved, for real. It's far too late for SMTP, but I don't mind folks thinking hard about it.

Comment by syhol 6 hours ago

I'm very excited by this idea. I feel like email/chat is ripe for reinvention.

I don't agree with "Domain control as a fallback", as the author said "a domain is not owned, it is rented" and I want to normalise the idea that if you lose your private key, you need to start again. I hate that we keep giving so much authority to domains, it's such a big weakness. The author even left the key rotation chain out of the initial implementation.

I still think root/signer keys or sigchains are decent options.

Comment by bellowsgulch 45 minutes ago

This is measurably worse in every way if only by saying you've thrown out everyone's existing mail stacks.

No, no one wants to do that.

Comment by 4 hours ago

Comment by philipwhiuk 3 hours ago

Old version:

* DNS lookup for MX record

New version

* DNS lookup for A record

* HTTP request for .wellknown/htmp/known_hosts

Not sure why this is being considered as an improvement?

> each mailbox of a domain on a different provider

Why is this useful/necessary or even 'good'?

Comment by rzerowan 2 hours ago

Id think its for enduser flexibility and convenience. Its more involved to alter DNS records vs just adding a text line to a webpage and hitting that default endpoint as standard. Same way LetsEncrypt allows the easiest setup with the .wellknown endpoint , where a user may not have DNS access beyond the initial A record setup.

Comment by endre 4 hours ago

still better than CoI

Comment by gostsamo 4 hours ago

Unfortunately, stopped reading at one moment, because though the idea might be interesting, the packaging was unbearable. The obnoxious real time visitors counter seriously screws with my screen reader. I don't care how many people are reading this every 3 seconds updated not only with numbers, but with randomly chosen emois in my speech stream.

If you have a website, please, don't subject your visitors to something like that.

Comment by andros 4 hours ago

I'm sorry to hear about your bad experience. I've hidden the counter for screen readers. Please try again when you're ready.

Comment by forty 2 hours ago

Anecdotally, I don't use a screen reader and also couldn't care less on the visitors on the site. I doubt anyone but you is interested in this, and probably this number is slightly lower just because of that popup

Comment by gostsamo 2 hours ago

Thanks for the change.

Comment by jeffbee 3 hours ago

The combination of "I have an idea for changing one of the fundamental experiences of modern life" and "my website is obnoxious and hostile" didn't really work for me.

Comment by andros 1 hour ago

The entire website is accessible; I dedicated ample time to it. This was a minor oversight, but I wouldn't call it hostility.

Comment by gostsamo 2 hours ago

Mistakes happen.