Live data from Hacker News

JMAP: A modern, open email protocol

ietf.org

81–90 of 120 posts

Re: JMAP: A modern, open email protocol

#81
post #67
post #54

Earlier quoted context omitted.

> Yes, TCP streams are very complicated to work with (in my experience) -- there are way too many failure modes and corner cases to consider. Isn't it the same thing, but simpler and more flexible? You write a message, and then you read a reply, rinse and repeat. Could you expand on such things that are complicated with TCP that HTTP helps with?

When you're working with sockets there's lots to think about that you can simply ignore with an HTTP library -- connection setup and teardown, buffering, serialization, byte ordering etc. But more importantly, you'll have to build your own status/error handling, cache control, content encoding, TLS etc. (Simply, doing TLS correctly itself is not easy.) To be clear, I'm not saying that there's no place for socket prog…

Thanks for the reply. This gives me a better understanding of the issue here.

> connection setup and teardown

If there's no benefit in avoiding setting up and tearing down a connection with each request like one typically does with HTTP, then I can see how it might be an annoyance compared to making a single function call from a library that makes the request and returns the response.

> buffering

A parser should deal with that. It could be JSON parser.

> serialization

That's still a problem with HTTP. People typically use JSON for this and it doesn't depend on HTTP.

> byte ordering

parser/JSON's job.

> your own status/error handling, cache control, content encoding

That can be beneficial or it can be problematic. If you need such things, then yeah, it's cool to not have to think about making your own. However, if you don't or if your needs don't align with what HTTP provides, that can be problematic. For example, from a cursory search I see the following in the JMAP spec:

> Implementors must take care to avoid inappropriate caching of the session object at the HTTP layer. Since the client should only refetch when it detects there is a change (via the sessionState property of an API response), it is RECOMMENDED to disable HTTP caching altogether, for example by setting `Cache-Control: no-cache, no-store, must-revalidate` on the response.

So, HTTP provides caching, but not the caching mechanism that's needed, so it's recommended to explicitly disable it completely.

With respect to status and error handling, it seems JMAP still had to define their own errors to be described in JSON[1], so not a perfect fit there either.

On the content encoding, I'm not sure if JMAP would use something other than application/json, so it seems like something that wouldn't need to be specified if one didn't use HTTP.

I know the discussion is not really about JMAP. I'm just using JMAP as an example on the above.

> TLS etc. (Simply, doing TLS correctly itself is not easy.)

I would hope that there's a library equivalent of the shell's:

  openssl s_client -connect $host:$port
I don't know why a library would have to be much more complicated. Maybe I'm being naive, but I think that if one wouldn't specify special TLS parameters to an HTTP library, then there's no reason why one would need to if they skip the HTTP library and go straight to using a TLS library. IOW, I don't see why an HTTP library would be more helpful on setting up TLS than using a TLS library directly.

[1] https://jmap.io/spec-core.html#initial-jmap-error-codes-regi...

Re: JMAP: A modern, open email protocol

#82

One of the things I particularly recall reading is FastMail devs explaining that the standardization process led to changes and improvements. (Even their about page says that "JMAP was built by the community, and continues to improve via the IETF standardization process.") Really thrilled the FastMail team is working on this, and doing it in the way that changes to mail should be handled: Going through proper Interne…

The IETF's standardisation process almost can't help but improve whatever it is you're trying to standardize. Not only are you being shepherded by peers with expertise in whatever corner of networking you're excited about (the Area Directors for whichever Area your Working Group was assigned to) but you're obliged to put up with anyone who cares to offer an opinion mailing it in. Looking for consensus isn't a good wa…

> IETF's standardisation process almost can't help but improve whatever it is you're trying to standardize

I've read the SIP RFCs. That's not a hard rule unfortunately. (Unless it really was worse before, but I can't imagine that...)

Re: JMAP: A modern, open email protocol

#83
post #74

Earlier quoted context omitted.

Did you consider that they might only be wasting your time? I haven’t ever felt any frustration at any of the things you named.

Both are standard features on GMail, which beats your sample size of 1.

And I didn't care about them there either.

But you know, you could send them the feature requests - they actually implemented something I asked for on mobile, so at least one team is listening.

Re: JMAP: A modern, open email protocol

#85
post #66

Unpopular prediction: Gmail will never implement JMAP, so it's already dead in the water.

Gmail on Android is already embarrassingly bad for IMAP... The minimum sync period is 15 minutes and it won't sync subfolders until you open them, defeating the entire point.

Don't look to Google to do anything in this space but continue to push their creepy ads and lock people in.

What I want to know is whether JMAP can help push end to end encrypted email for everyone. Probably not, because that's not part of FastMail's feature set.

Re: JMAP: A modern, open email protocol

#86
post #50
post #11

Earlier quoted context omitted.

Being unauthenticated as a default certainly doesn't jive with modern security practices.

SMTP is the protocol that's used to route email between servers. How is Fastmail supposed to authenticate with Gmail or Yahoo with Hotmail? Better yet, how is a new mail server in the internet supposed to authenticate with all existing mail servers? Really, authentication for all uses of SMTP doesn't make sense.

If only there were infrastructure and standards for asserting ownership over domain names.

Re: JMAP: A modern, open email protocol

#87
post #5

I clicked on this with a lot of hope — alas, this only seems to address the "mailbox access" part of E-mail. I think that part actually works fairly well today (not optimally, but well enough in practice). The part that really needs fixing is SMTP.

It actually addresses email submission, even if it doesn't cover server-to-server SMTP.

Re: JMAP: A modern, open email protocol

#88
post #4

Earlier quoted context omitted.

I haven't read JMAP, but I don't think that's the problem it's tackling. Also, I think SPAM is as solved as it can be with blacklists, heuristics-based filtering software like spamassasin, and personal filtering with sieve scripts. What else would anyone suggest?

Spam could be half-fixed with forcing DKIM, SPF, DMARC and TLS. The very least there would be no impersonation of other domain names (filtering the rest into a spam box will become much easier after that) and insecure transportation then.

How would sender authentication solve the problem? A large amount of spam is sent from throwaway domains with SPF and DKIM in place, and another large part of it is sent through hijacked web sites and email accounts.

Re: JMAP: A modern, open email protocol

#89
post #63

Earlier quoted context omitted.

> You write a message, and then you read a reply, rinse and repeat. well, no, you don't "read a message" with TCP, because it is a stream-oriented protocol. you read bytes that keep coming and wait until you have enough or reach a delimiter that you chose.

Yes, that's what I meant. I would expect a good parser to hang until the message is complete as determined by the syntax of the protocol and return that, leaving the stream at the point the next message should start. I'm getting the feeling that the popularity of JSON and HTTP come by good part from the lack of good parsing libraries in many languages. People generally only know how to work with what regexes are able…

> I'm getting the feeling that the popularity of JSON and HTTP come by good part from the lack of good parsing libraries in many languages. People generally only know how to work with what regexes are able to handle and nothing more.

Even if you have good parsing libraries, parser combinators, etc, you still need to write the grammar - which can be hard if you are not accustomed to that... years after I still find an occasional bug in grammars I've written in the past. Compare this to JSON over HTTP which ends up basically being

    var xhr = new XMLHttpRequest();
    xhr.open('GET', "https://my/api.json", true);
    xhr.onreadystatechange = function(e) { var response = JSON.parse(xhr.responseText); }
what other format allows to get objects over the network that easily, without any special libraries ?

Re: JMAP: A modern, open email protocol

#90
post #51

There is so much NIH going on in this protocol, it's as if the authors we're completely unaware of modern HTTP API design. They're not just doing IMAP over http, they invented their own error bodies, schema's , negotiation and RPC.

I think their goal is to have transport layer be a pluggable subsystem, divorced from their request-response protocol. They even essentially say that HTTP is not necessary to their protocol, so I think it's pretty apparent that HTTP is a utilitarian choice, but they're not trying to build email-over-http.

”pluggable subsystem”

SOAP had same rationalization.

Post reply on HN