Hacker News Reader

Comment by grinich | Hacker News Reader

Hi folks -- I work at Nylas and would be happy to answer questions about N1.

If you haven't seen it, the code for N1 and the sync engine are both open source available on our GitHub: https://github.com/nylas

View on HN

I don't really have much of substance to add but I wanted to say that N1 is shaping up really well. The last two releases have introduced snoozing and unified inbox, which are both strong features. I've had a play around with writing an extension for N1 too and that experience was pretty sweet. So: thanks for your hard work, keep it up!

Glad to hear it-- thanks! :)

Is there any way to make Nylas NOT store every email in your account?

I've got a google account with a few gigs of emails, but I don't need emails from 2004 on a daily basis. It would be awesome if it would only download (and have available) files from the last year or so.

In Gmail, under IMAP Settings, set Folder Size Limits to number of emails you want it to sync. By default, its set to no limit. Then you can control by number how many emails to store in the email client.

Glad to see you here. The first time I learned about Nylas (here on HN, can't find the link atm) someone complained rather loudly that the open-source version of the sync server doesn't support 'proper' authentication.

I never saw a reply to that. Do you understand that criticism? Do you understand what they might've been talking about? Looking at GitHub I guess they were talking about https://github.com/nylas/sync-engine#nylas-api-service and the need to pass the id via basic auth/as username.

Hm, I haven't heard about that being an issue. If you can dig up the thread, I'd be glad to take a look.

Rummaging a bit I came up with the two comments at the bottom of the post. As I said - this was the first time I read about Nylas. When I see something potentially shiny I tend to react the same way as if I'd view an Amazon product listing: Scroll down, look at negative reviews..

So - the threads below seem to complain that the sync server has no authentication schema whatsoever (seems to be true after skimming GH/the link above) and - this is what I'm really curious about - even claims that you wouldn't accept free contributions to implement that.

What I'm trying to ask, I guess:

1) Why no authentication for the sync server?

2) Are you really against any such contributions, if you don't intend to build those yourself?

3) Do you have any recipes/ideas/reports from happy users how you'd secure the sync-server in its current state, in a "let's play" deployment?

1: https://news.ycombinator.com/item?id=11061717 2: https://news.ycombinator.com/item?id=11122802

I think these are actually two different questions. One is asking about new auth APIs so you don't need to run a script to connect accounts. We're working on that!

The second is about how to do API authentication, i.e. how API requests are secured. The sync engine just provides all API data as a service, namespaces by account ID. Developers need to "secure" this by either running it behind a VPN, adding a proxy layer like Nginx, wrapping API calls in their own application layer, or dozens of other solutions. Everyone does this differently so it doesn't make sense to include as part of the default sync engine.

The simplest version is probably to just block access to `/accounts` for external users and treat those account ids as authentication secrets. (They're just opaque long strings.)

We're not against contributions, and nobody has actually built an auth system and submitted a PR.

Hi, how does the read tracking work. Does it mean that your users depend on some server-side code to get the ping-back ? If that is the case, what did you do to preserve the anonymity of your users ?

It's kind of like Bitly-- we have a redirect server that just keeps a count which is secured with your access token. This is infrastructure we're actually going to also open up to developers once we iron out the bugs. Stay tuned! :)

Are there plans to work on integrating PGP encryption? N1 really looks nice but there are many people, like me, who can't move over until it gets e-mail encryption support.

Yep! https://github.com/nylas/N1/issues/96

How do you fetch user information to be displayed on the sidebar? I've noticed some are not up to date (like Twitter bio and Gravatar images).

It comes from FullContact right now. We're investigating alternatives since the data isn't great.

Thanks for the mention Rafael! Would be happy to see if we can help grinich. Just shot you an email if you'd like to run a data test.

I'm not sure but Clearbit might be a good option: https://clearbit.com

Why swipe? Isn't swiping kind of an odd interaction w/ a mouse and keyboard?

It works great on a trackpad, and lots of folks have touch screens these days.

We also have keyboard shortcuts, fully customizable in the preferences window.

If I snooze on my desktop with N1, will it properly notify me on my phone if I subsequently shut down my laptop?

Huh! Am I missing something? I didn't think Nylas had any kind of mobile support yet. How does this work?

Hi, I'm an engineer at Nylas. Basically we have a server side process which moves snoozed emails back to your IMAP/Exchange inbox when it's time to unsnooze them.

Yep!

Is that still true if I'm self hosting the sync engine on that laptop? Or is it the kind of service that should be run on a separate server?

Ah unfortunately not. Unsnoozing is essentially a cron job that needs to run on a different service.

Could Nylas be a substitute of gmail + evernote? Aka mail + notes in the same app.

Just realised that Nylas business model is exactly based on this (developing specific use cases for businesses).

Another question - this one only by curiosity - are you ditching coffeescript for es6?

Edit - the answer is here: https://github.com/nylas/N1/issues/9

Help us migrate! :)

Are there plans to add Exchange support to the self-hosted version of the API?

You can actually sync Exchange mail using the open source sync engine if you enable IMAP/SMTP in the Exchange server settings. (We've had lots of students do this at universities.)

Oh, thank you. I might have been unclear in my understanding (or maybe it needs updated), on the open source sync engine page it says: "The open-source Nylas Sync Engine does not support Exchange, but the hosted version does." Is this out of date? Or just an undocumented feature?

It doesn't support ActiveSync, but it supports open protocols like IMAP, SMTP, ICS, etc.

Reply on news.ycombinator.com