Comment by dane-pgp | Hacker News Reader

Comment by dane-pgp | Hacker News Reader

Parent Full thread

> Every organization, whether tiny or enormous, needs a members-only messaging service that cannot receive traffic from external or unapproved senders.

> Organizations that need to let certain members hear from the general public, or communicate with untrusted (perhaps anonymous) customers, may establish a separate service instance for that purpose.

Rather than throwing away all existing email clients and servers, couldn't this be achieved by configuring an inbound mail rule to drop all email from addresses that aren't in your address book (and from servers that don't support DKIM)?

It doesn't seem very meaningful to say "Users should only receive messages from approved senders, unless they need to receive messages from unapproved senders". Email is useful precisely because it doesn't have the extra step of requiring users to manually add an address to their address book before receiving a message from a new contact, such as a receipt from an online purchase.

Thanks for your question. There's a lot more to TMTP than limiting who can send you arbitrary content.

One of its features is that your correspondence does not transit a TMTP server operated by a third party. As with HTTP, its client connects directly to the ultimate host.

Re "users should only receive..." TMTP allows arbitrary content only from approved senders, and limited content from others (see Ping & GroupInvite). There's no manual addition to your address book on the receiver's part.

Thanks for your response. I sort of like the idea of restricting the content that can be sent by unapproved senders, and wonder if this could be adopted by email systems.

Suppose that the major email service providers and client developers agreed that from a certain date, all emails received from addresses that a user had not seen before would be truncated to 256 plaintext Unicode characters. The client UI would offer the option to whitelist that sender for future messages, which would also cause the existing message to be displayed in full.

Goodness; and here I thought mnm was ambitious! :-)

I think we'll see better results by defining and implementing a simple new protocol that addresses all of the significant security and productivity problems with email.

Note, the current draft isn't a 1.0 candidate; there's more to come, for instance meta-messages.

Unfortunately, it's easier to get half a dozen entities to agree on something which is aligned with their incentives (a small UI change to make email more usable) than to get literally billions of users and systems to switch to a completely new technology which offers at best an incremental improvement over email.

You haven't computed the effect of phishing on the fate of email.

At least 100M users have already seen intra-office email replaced with chatrooms. (Which, altho it solves the phishing issue, has created new productivity problems.)

TMTP doesn't have to replace SMTP overnight to be successful.

I'll leave it at that; thanks for the discussion!

Reply on news.ycombinator.com