Modern email can be built from borrowed parts(en.andros.dev) |
Modern email can be built from borrowed parts(en.andros.dev) |
Modern email already depends on HTTP, with protocols like MTA-STS (https://www.rfc-editor.org/info/rfc8461/) using HTTPS/TLS to improve transit encryption, or Web Key Directory (https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...) which uses HTTP for public key distribution. Personally I think these incremental improvements of SMTP are more promising than replacements, but we deserve better email however we can build it.
NewEmailServers are able to send and receive messages using either the Email or the NewEmail protocol.
Before sending a message, the NewEmailServer checks a directory (similar to DNS) to see if any of the recipients are on another NewEmailServer. If so, the message is sent to those recipients via NewEmail. Others get it by Email.
Completely backward compatible. Once google/microsoft shift to NewEmail, the rest will follow quickly except some legacy servers. All that is needed is a standards body.
You don't want to embed the entire email in JSON. Too many parsers past, present, and future tend to want to decode the entire JSON document into memory before doing anything else, and so you'd be forcing entire email documents to be held in memory at scale, which causes you major problems. I'd recommend something more like either a JSON header that defines what parts are in the email, followed by a normal MIME document, which is perfectly normal in HTTP with other things that use the format as well, or having the top level continue to be a MIME document and specify that the first part must be a JSON document containing the headers. JSON replacing the headers is generally something that would be a good idea, though.
That improves the ability of more language environments to be able to handle the email as a stream or in chunks with "normal" libraries and practices. MIME parsers in languages that tend to favor pulling everything into RAM as a string are still more likely to have been forced to face this issue already.
Why? Even if your system loads emails into memory a whole email at a time, that doesn't imply that it will load large numbers of emails simultaneously. The kind of processing that can be done by stream-processing large numbers of emails in parallel seems rather limited to me.
> I'd recommend something more like either a JSON header that defines what parts are in the email, followed by a normal MIME document, which is perfectly normal in HTTP with other things that use the format as well, or having the top level continue to be a MIME document and specify that the first part must be a JSON document containing the headers. JSON replacing the headers is generally something that would be a good idea, though.
If we're specifically talking about being able to short-circuit after headers, then why not a JSON header followed by JSON representation of the body?
I like this.
Question: can this e-mail specification/implementation also replace direct-messaging protocols (like WhatsApp)?
As a first step I would focus on something like broad S/MIME support. Unfortunately I suspect that the biggest email providers are disincentivized from doing this as it would disrupt their business models.
Interesting take re putting a cost on spam. Perhaps another take would be functionally implementing introductions.
> First-contact consent: an unknown sender doesn't get into the mailbox; they land in a "requests" box with their first message visible (like Signal's message requests). You accept, and the thread opens forever. A stranger can knock on your door, which is the essential property of mail, but they can't fill up your living room.
Unfortunately, this will only move the problem, and only reduce it in the case when all outside communication is ignored.
Email clients already highlight/filter people in your contacts
And poof, we've poorly remembered Web of Trust from 20 years ago!
Overall I do love the idea of HTMP and if we could get it to easily fall back to standard old bad email, I think it could start as a niche and then upgrade towards HTMP over time as more clients adopted support for it.
You can stop there, I've heard enough. Not everything is hypertext.
>The goal is not to replace the current mail system, heaven forbid!, but to learn, have fun and discover current technologies to swap out every element: sending, receiving, gateway, keys, and so on.
It's all for fun.
Other than that...
The most important thing is not the protocol, it's the gui.
At the moment email's gui is horrible on all platforms without exception.
If/when a decent gui appears, protocols will follow.
Also, JMAP did reading can probably be just WebDAV?
This is obviously a matter of opinion. Of course there are endless different email GUIs, on all the platforms; if you don't like one, there are many alternatives.
I cannot imagine that a "decent GUI" by modern web-development standards could be anything I'd prefer to what already exists. Email works and generally doesn't let designer ego get in the way.
How can you say that when it's one of the benefits of email that it's an open protocol and there's thousands of different apps built on top of it. Terminal UIs, web interfaces, chat interfaces etc. - that should be one of the cases where there's a GUI for anyone.
Take this thought experiment - how does nearly every other standard protocol (DNS, SMTP, etc.) except for HTTP survive at scale without server-side load balancing?
Thankfully we're heading in this direction due to happy eyeballs and related client-side retry mechanisms.
I don't agree with "Domain control as a fallback", as the author said "a domain is not owned, it is rented" and I want to normalise the idea that if you lose your private key, you need to start again. I hate that we keep giving so much authority to domains, it's such a big weakness. The author even left the key rotation chain out of the initial implementation.
I still think root/signer keys or sigchains are decent options.
No, no one wants to do that.
* DNS lookup for MX record
New version
* DNS lookup for A record
* HTTP request for .wellknown/htmp/known_hosts
Not sure why this is being considered as an improvement?
> each mailbox of a domain on a different provider
Why is this useful/necessary or even 'good'?
Username is your public key, password is your private key. So we get end to end encryption and account ownership out of the box. Something similar to how .onion addresses work. Needing easy to remember addresses? Build aliases on top of that. Needing server-side automation? Handle trusted server your private key.
Also, almost everyone carry a 24/7 powered and Internet connected device in their pockets. The Internet - network that allows globally sending any data between devices. Maybe with full redesign third-party email servers should be made optional.
I believe we should focus less on how to redesign whole service and build more universal layers instead. First, vsending any data to any machine. Second, optionally remotely accessing our data. Third, mail-like format of data.
If you have a website, please, don't subject your visitors to something like that.
And I do not want an infinite thread conversation. I want to be able to split off - and perhaps archive and export - different conversations by topic.
I recently had to some legal things, which included forwarding copies of a certain conversation to a lawyer. This turns out to be unreasonably difficult because email clients quote previous conversations. You want a clean thread of comment and reply about a specific topic. You don't get that.
You do get it on chat services, but there's no option there to create sub-conversations.
If I was redesigning email I would think long and hard about different use cases and workflows and start with an RFC. Protocols are far downstream of that.
Surely only if you configure them that way. At least I can turn that off in my email client, Thunderbird.
Nina xx
I feel like every one of these suggested changes to email comes with a functionally equivalent parody magic trick.
For this one, a magician has two stacks of cards: a tall stack of "spam" cards, and a small stack of "inbox" cards.
The magician moves the stacks apart to make a spot for a new "request" stack.
To start the stack, they pick up five "request" cards from the inbox stack with one hand while subtly pushing the entire stack of "spam" cards with the other hand to spot they made for the "request" stack.
They then pass the five cards they were holding behind their back, revealing them with the opposite hand and finally shuffling them into the now tall stack of "request" cards.
Ta da!
> If I was redesigning email I would think long and hard about different use cases and workflows and start with an RFC.
A magician sweeps 17 sloppy stacks of cards off the table. They then show how the first 15 cards they pick up can more easily be arranged in only three stacks. Voila! Everybody claps.
While the audience members put money in the hat, the pedants stick around and watch the magician pick up the rest of the cards and end up with 18 sloppy stacks by the time the audience for the next show arrives.
Edit: clarification
Edit 2: I forgot this part: "Protocols are far downstream of that." So imagine 8 tiny tables below the main one which somehow end up with more than 52 cards in each of their 17 sloppy stacks.
It's called threads - even Matrix has these
Deltachat
Honestly, I'd want this as a default. I wonder if a mailserver can be configure like this. Doesn't sound too hard, does it?
Greylisting is not perfect, not even close, but it allows servers to reject huge amounts of garbage mail while allowing new mail from unexpected parties without user intervention.
1. "The recipient will not get this message until you authenticate yourself as a legitimate sender at this URL [...]" - resulted in people never getting mail from no-reply addresses they cared about (banks, e-com, etc.)
2. "This sender has sent you an email, with this subject and this first paragraph. Click here to whitelist, here to blacklist" - created a lot of churn on first setup that users didn't like as a UX
Baking it into the protocol - even now in SMTP and IMAP land - is doable, but would be resisted by email providers who, for example, make their money selling data to marketing agencies. Like, you know, Google, Microsoft, Yahoo...
I've seen other approaches proposed - even at IETF level - over the years, including digital postage stamps (sender pays to send email, your server gets paid, and may reject non-stamped/paying email), but it's the usual network effect: until it becomes widely supported it won't "stick". The stuff that has been adopted has basically been stuff that Google likes, period.
at one point Gmail had a service for this - if I remember well - but google being google - I guess it was just a promotion project for someone.
This results in the top and left-side bars staying decorative and unobtrusive, but the concurrent visitor counter thingy is floating well above the bottom-right of the page. But then, as I shrink in the page width, the left-side bar and the concurrent visitor counter swap sides, and also a bunch of the content from the top is added to a new bar at the bottom. Eventually, the horizontal space between the side components becomes irrelevant such that they function as an additional bottom bar. At which point, maybe 40% of the vertical space is used for navigation and other shiny toys. This is really annoying, and the overall experience is inconsistent across widths.
(Also, at all widths, the top-bar has a transparent background, so main page text interferes with top-bar text as it scrolls.)
All of this is done in CSS, so presumably it can be fixed that way too.
The stories have discouraged my from spending my time on it though.
However, most of time, it's not that providers are blacklisting because "Ha ha ha, screw the little guy" but more "Yea, they are hosting on IP blocks with terrible reputation and spammers are absolute liars. I refuse to trust whatever they say, period."
If you have your own /24 or greater, you can become email provider. It's also just such a low margin business, it's not worth small businesses disrupting it.
I blacklisted pretty much all of africa and arabic nations and china on the IP level, ( ensure you get the bgp routed datacenters in those nations too) and not only did i get less spam, but less automated bot attacks on my webserver.
The reason people talk about the blacklist is because its just so damn effective.
What parent wants is also possible and I remember people doing it as far back as the early 2000s. You would basically manually whitelist an email or have them bypass the list (once or always) with something like a key word or token sort of like a captcha which can be shared off band.