Gluon, a high-performance IMAP library
I spent the better part of 5 years playing with IMAP. This is a huge step in the right direction but there’s a lot with email this is missing:<p>- Nobody reads or interacts with emails anymore, they use threads. Threading is one of the most impossibly hard challenges to solve and requires a thread-first view of the inbox.<p>- IMAP represents now a small minority of servers. ProtonMail may be embracing it but for actually interacting with mailservers, don’t expect good interoperability or fast interactions when working with the two big dogs (Exchange and GSuite)<p>- Similarly most mailservers don’t act in good faith, their rate limits for non-internal clients are ridiculously low for modern email, and the failure rate is surprisingly high for commands<p>- There is no real spec for IMAP (the article quotes 3501, but 4549 and 6531 are also “standards”), it’s a suggestion at best and every mailserver goes its own way. For example deleting a message does different things in Exchange and GSuite. GSuite has “labels” which are represented as IMAP folders but don’t always act like them.<p>- It’s unclear what the mailserver will accept. Valid MIME isn’t always going to get through<p>- Most email that’s important is business email nowadays. These are 80% Exchange. Exchange&#x2F;365 tenants for the most part block IMAP (found this out the hard way) and Microsoft really wants to push Graph (just like they tried to push EWS). This manifests in weird ways like big angry red warnings on the dashboard if you try to enable IMAP, and automatically disabling it on new tenants, so most IT admins will refuse to turn it on even if you explain it’s just as secure.<p>- Remaining 20% are mostly GSuite. Google, as usual, is trying its hardest to create an email client monopoly for its users, and so there’s a $75000 annual fee for “security audits” by “vetted firms” regardless of how many real compliance certifications you have. They say this is for privacy and security but it’s just a gatekeeping fee and this is obvious due to the large number of email data abusers out there (looking at Unroll). There are even companies (Nylas) that run their whole business by speeding up the certification process and providing an API that works better than Google’s poorly documented own SDK. If you get through all of this your users are shown a consent screen where everything is unchecked by default, which sounds cool but basically means many of your users are going to login without knowing how to give consent to your email client.<p>Overall, the space is characterized by Google trying its hardest to kill any startups in the space and prevent innovation that could threaten their consumer monopoly, and Microsoft trying to keep people in their ecosystem by just changing their external API frequently to force competitors to rewrite their codebases constantly.