Mailit: A Tiny Drop-In REST API to Send Emails

#1

Post by robinj6 » Tue, Aug 01, 2017, 6:30 AM UTC

Mailit: A Tiny Drop-In REST API to Send Emails
github.com

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#2

Post by bjpbakker » Tue, Aug 01, 2017, 8:00 AM UTC

It migt be just me, but I honestly don't understand why people would use an HTTP API to send mail.

SMTP really is a very simple protocol, that's matured for decades now. Also it is fully specified by RFCs.

I can see why mail services that provide templating (eg Mandrill) have special APIs, they offer something different from sending regular emails.

This specific REST API seems more like a standin for sendmail, which IMO makes things only more complicated.

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#3

Post by sleepychu » Tue, Aug 01, 2017, 8:02 AM UTC

Is this authless? You just send mail as the account configured and anyone can send mail?

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#4

Post by bjpbakker » Tue, Aug 01, 2017, 8:09 AM UTC

sleepychu wrote: post #3

Is this authless? You just send mail as the account configured and anyone can send mail?

I haven't tried it myself (and won't) but given this section "Passing Secrets" in the README [1] I dont think its authless.

[1] https://github.com/dthree/mailit/blob/master/readme.md#passi...

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#5

Post by carl_dr » Tue, Aug 01, 2017, 8:16 AM UTC

sleepychu wrote: post #3

Is this authless? You just send mail as the account configured and anyone can send mail?

> This service defaults to no authentication.

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#6

Post by fidbit » Tue, Aug 01, 2017, 8:21 AM UTC

sleepychu wrote: post #3

Is this authless? You just send mail as the account configured and anyone can send mail?

A service like this might only be exposed internally to trusted servers. Depends on the setup.

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#7

Post by [deleted] » Tue, Aug 01, 2017, 8:21 AM UTC

sleepychu wrote: post #3

Is this authless? You just send mail as the account configured and anyone can send mail?

[deleted]

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#8

Post by icebraining » Tue, Aug 01, 2017, 8:27 AM UTC

bjpbakker wrote: post #2

It migt be just me, but I honestly don't understand why people would use an HTTP API to send mail. SMTP really is a very simple protocol, that's matured for decades now. Also it is fully specified by RFCs. I can see why mail services that provide templating (eg Mandrill) have special APIs, they offer something different from sending regular emails. This specific REST API seems more like a standin for sendmail, which…

Playing Devil's advocate: SMTP has some back-and-forth stateful chatter. With a custom HTTP API, you can authenticate and send an email in a single request. SMTP Pipelining can reduce this problem, but not all libraries support it (e.g. Python's smtplib).

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#9

Post by beefhash » Tue, Aug 01, 2017, 8:30 AM UTC

carl_dr wrote: post #5

sleepychu wrote: post #3

Is this authless? You just send mail as the account configured and anyone can send mail?

> This service defaults to no authentication.

That default really did not work out well for MongoDB[1]. Why are we perpetuating this mistake?

[1] https://www.bleepingcomputer.com/news/security/mongodb-apoca...

Re: Mailit: A Tiny Drop-In REST API to Send Emails

#10

Post by icebraining » Tue, Aug 01, 2017, 8:37 AM UTC

bjpbakker wrote: post #4

sleepychu wrote: post #3

Is this authless? You just send mail as the account configured and anyone can send mail?

I haven't tried it myself (and won't) but given this section "Passing Secrets" in the README [1] I dont think its authless. [1] https://github.com/dthree/mailit/blob/master/readme.md#passi...

Those secrets are for Mailit itself to connect and authenticate against the email server.