Live data from Hacker News

Show HN: I Built Darwin Mail as a Google Inbox Replacement

darwinmail.app

141–150 of 223 posts

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#142

Earlier quoted context omitted.

Question I have: do you need to actually collect this information at all? I appreciate the no share, but if a service never collects it to begin with then it’s never an issue including if you get hacked for instance. I’m curious not a judgement.

> Question I have: do you need to actually collect this information at all? In the very comment you're responding to, he says "never record". In this context, this means the same as "never collect".

Hey there, thank you very much for helping out :)

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#143
post #137

I'm glad someone is filling this gap. As a huge Inbox fan I'm intrigued. But when Google warns DarwinMail will be able to "View and modify but not delete your email", I don't know if I can take the plunge. For me, what I really want is reminders integrated into my mail routine (the killer feature of Inbox IMO), and I think that can be done in a way that maintains privacy better.

Hey there!

I really wish Google would be clearer about what this means. This allows DarwinMail to create your email (when you use the compose functionality), modify your email, and send your email (when you click the send button). This also allows you to update and save drafts.

https://developers.google.com/gmail/api/auth/scopes

I hope that helps alleviate your worries somewhat :)

We have reminder functionality available! It is part of my everyday routine too!

Could you suggest a way to allow people to use DarwinMail while 'maintaining privacy'? I am learning exactly what you would like here :)

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#144
post #137

I'm glad someone is filling this gap. As a huge Inbox fan I'm intrigued. But when Google warns DarwinMail will be able to "View and modify but not delete your email", I don't know if I can take the plunge. For me, what I really want is reminders integrated into my mail routine (the killer feature of Inbox IMO), and I think that can be done in a way that maintains privacy better.

Hey there! I really wish Google would be clearer about what this means. This allows DarwinMail to create your email (when you use the compose functionality), modify your email, and send your email (when you click the send button). This also allows you to update and save drafts. https://developers.google.com/gmail/api/auth/scopes I hope that helps alleviate your worries somewhat :) We have reminder functionality avail…

You can read the emails I am composing, but not read the emails I receive? That is better, and I could always compose sensitive emails in gmail. So possibly I'd give this a shot with my personal email.

I'd also like to use this at work, but Boomerang[0] was deemed not allowed, so I would imagine Darwin would also not be allowed.

I'm guessing Darwin stores the reminder data on its own servers? That doesn't bother me, most reminders are quite benign.

For reminders that maintain privacy, I would imagine one would need to write a browser extension that threads reminders into gmail. Which doesn't sound like much fun, but also a pretty primitive integration would probably be good enough.

[0]https://www.boomeranggmail.com/

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#145

Earlier quoted context omitted.

There is an option to block it in Gmail/Inbox.

That is excellent news. I will look into that. It does not sound like it will be too tricky to implement so expect a quick turn around time :)

I believe there are a couple of approaches to this with varying amount of data storage, You can download all images immediately as the email is received (thus preventing image tracking as every image would then be clicked immediately) or have the ability to block all images and selectively turn them on when necessary (unless the image is inline etc).

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#146

Opening an email with a calendar event in it downloads a file with some meta data. I think this is a bug. I opened a mail from meetup dot com and it downloaded a file multiple times.

That is definitely a bug! Can you tell me more? Perhaps show me your console output? (Right click -> inspect -> click the console tab)

I had excellent experience with Sentry (https://sentry.io/welcome/) to capture errors that happen on the client side in production. You need to be careful with the sensitive data that gets sent to Sentry, but it's a good tool.

Not being affiliated with them in any way, just a tool I find helpful.

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#147
post #75

Earlier quoted context omitted.

Something like: Darwin Mail: Gmail Evolved Darwin Mail is a better interface to the gmail account you already have: - Restores Google Inbox features - .... Aside, do you need to add any trademark notices?

I like it! How about: "Enhance Gmail to get your Google Inbox features back. Productivity awaits!". This was suggested by another user :) Do you mean trademark notices with Google?

Yeah, wasn't sure if Gmail is trademarked and if it is, whether you need a notice.

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#148
post #26

I tried to test it, but I literally don't feel comfortable giving somebody full access to my email. I don't know your practices, security protocols, etc. I'd feel way more comfortable if this would be an app or a browser add-on that would handle everything locally, without sharing the access token with your servers.

How many emails clients do you know that don’t need access to your mail?

The better question here is: how many websites (with their own servers!) did you give full access to your email inbox?

I didn't give it out to anybody else that Google. Google I trust implicitly because they host the server, so the email is already read by them before reaching the interface. Thunderbird stores email locally doesn't need to push it out. I wouldn't give Facebook ever access to my email account.

Why should I give Darwin access AS A WEBSITE when it's not clear to me that they NEED to run their SERVER? If the interaction is done through JS entirely and the whole thing runs in the browser between me and Google, they can easily pack it as an extension.

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#149
post #26

I tried to test it, but I literally don't feel comfortable giving somebody full access to my email. I don't know your practices, security protocols, etc. I'd feel way more comfortable if this would be an app or a browser add-on that would handle everything locally, without sharing the access token with your servers.

Part 1: I understand your worry. It's perfectly within the realm of reason. Please allow me to help alleviate your worries. The following are a list of the permissions DarwinMail requests of you. PS: WE NEVER store any email data that belongs to you. Google has verified our compliance via a lengthy audit! Manage mailbox labels — this allows DarwinMail to add and remove labels (inbox, snoozed, spam, etc) to your email…

Thanks for the pointers. I understand well how the OAuth scopes work. What I don't understand is - if the server doesn't handle my email, why does this need to be hosted on a server? Package it as a browser extension and this way I can be sure that my email is not leaked.

Re: Show HN: I Built Darwin Mail as a Google Inbox Replacement

#150
post #26

I tried to test it, but I literally don't feel comfortable giving somebody full access to my email. I don't know your practices, security protocols, etc. I'd feel way more comfortable if this would be an app or a browser add-on that would handle everything locally, without sharing the access token with your servers.

Part 3: How does DarwimMail actually work? So what happens exactly is: The user logs into DarwinMail.app, DarwinMail makes a login request to Google's servers, Google logs the user in, DarwinMail asks for the users emails at which point this data is rendered in the user's browser. None of this email data is stored on DarwinMail's servers. There is no need! Think of all the space it would take up and the time that wou…

I think there is at least one variant of the OAuth2 flow that doesn't require the use of servers to complete the authorization. I know Implicit Grant is broken in some ways, but Google supports it: https://developers.google.com/identity/protocols/OAuth2UserA...

You also say this has been audited by Google. Mind if I ask under which program, and how did you get Google to audit it?

Post reply on HN