Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 101270 - Webmail for Gentoo developers
Summary: Webmail for Gentoo developers
Status: RESOLVED OBSOLETE
Alias: None
Product: Gentoo Infrastructure
Classification: Unclassified
Component: Other (show other bugs)
Hardware: All Linux
: High normal with 1 vote (vote)
Assignee: Gentoo Infrastructure
URL:
Whiteboard:
Keywords:
: 468424 (view as bug list)
Depends on:
Blocks:
 
Reported: 2005-08-03 17:43 UTC by Donnie Berkholz (RETIRED)
Modified: 2013-05-03 12:55 UTC (History)
8 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Donnie Berkholz (RETIRED) gentoo-dev 2005-08-03 17:43:59 UTC
Let's get some webmail up in here. squirrelmail is easy, supports imap, gpg with
a plugin, all sorts of good stuff. also the groupware crap like
hula/ogo/whatever else.

Gentoo is the rox0rs!
Comment 1 Lisa Seelye (RETIRED) gentoo-dev 2005-09-02 14:00:05 UTC
"Me too!"
Comment 2 Lance Albertson (RETIRED) gentoo-dev 2005-09-02 14:01:33 UTC
Might want more input from the infra folks in general about the idea.
Comment 3 Kurt Lieber (RETIRED) gentoo-dev 2005-09-02 14:06:00 UTC
are we talking about webmail for access to mail on toucan?  or access to
arbitrary imap servers?
Comment 4 Lisa Seelye (RETIRED) gentoo-dev 2005-09-02 18:14:18 UTC
i'd want access to mail on toucan through something like squirrelmail
Comment 5 Corey Shields 2005-09-03 13:25:44 UTC
it wouldn't have to be on toucan..  I've already got this on my todo list (we 
use to have it via phpgroupware, Donnie was the only one testing it, and when I 
yanked it from him I promised one day we would have something else for him.. 
hence this bug to remind me) 
 
-C 
Comment 6 Kurt Lieber (RETIRED) gentoo-dev 2005-09-07 05:19:17 UTC
my question was more about whether the expectation is that all mail would be
retrievable via this client (including mail housed on non g.o servers) or if
we're just talking about mail that is stored on toucan.
Comment 7 Corey Shields 2005-09-07 11:56:50 UTC
I don't think outside mail is something we want to try and do.  could be a  
nightmare just from the support perspective of it.  
  
-C  
Comment 8 Corey Shields 2005-09-29 21:26:40 UTC
There are quite a few new secksi webmail programs out there now.  Anyone 
opposed to using one with AJAX features? 
 
-C 
Comment 9 Lance Albertson (RETIRED) gentoo-dev 2005-09-29 21:37:06 UTC
Define AJAX features and the deps they would incur.
Comment 10 Corey Shields 2005-09-29 22:32:23 UTC
No deps..  it's  a mixture of client side javascript and (usually) 
XMLHttpRequest to further communicate with the server. The use of this call 
varies between programming language, but most all browsers support it nowadays 
(including IE, >= 4)  The support for AJAX type stuff has been around forever, 
but nobody caught on to using it till Google started with the mutating search 
bar, gmail, and google maps. 
 
A good rundown is on wikipedia if you want more info:  
http://en.wikipedia.org/wiki/Ajax_(programming) 
 
Two apps that have gotten my attention are Zimbra and Roundcube. 
 
The functionality these apps are cranking out is fairly new, that's why I would 
hate to go with something more static just to want to change later.  Besides, 
squirrelmail seems to drag.. 
Comment 11 Lance Albertson (RETIRED) gentoo-dev 2005-09-29 22:35:51 UTC
Ah, another option is imp. K-State uses that for their webmail solution and it
seems to work pretty well. I haven't done much with it myself. I'd just be leary
about using something so new with any kind of upgrade headaches that could
happen. I don't think our devs need to have a google map in our webmail ;-) but
the idea seems cool. Also, you're forcing things on the client side which I
really don't like.

Just my $0.02
Comment 12 Corey Shields 2005-09-29 22:40:23 UTC
Last time I tried imp it was broken to pieces.. 
 
As for forcing things onto the client, that is a false statement.  If you want 
a plain text interface to your email, there is pine or mutt on toucan. 
 
but anyway, I'll leave it up to the requestors to chip in about that.  :) 
Comment 13 Donnie Berkholz (RETIRED) gentoo-dev 2005-09-29 22:50:28 UTC
(In reply to comment #12)
> As for forcing things onto the client, that is a false statement.  If you want 
> a plain text interface to your email, there is pine or mutt on toucan. 
>  
> but anyway, I'll leave it up to the requestors to chip in about that.  :) 

I agree with Corey. What I need is a way to access my Gentoo email from
computers lacking my SSH key, and I really have no need for a text-only interface.
Comment 14 Joe McCann (RETIRED) gentoo-dev 2005-11-20 08:43:52 UTC
Yea, lets get a pretty webmail interface up in this piece
Comment 15 Lance Albertson (RETIRED) gentoo-dev 2005-12-18 09:28:22 UTC
Is there any problem with putting something like squirrel mail or something up until the pretty/oooh!!! cool! one gets released and is stable? I think for now getting something up is better than waiting. We'll just need to let folks know that we'll probably switch to something better down the road.
Comment 16 Lisa Seelye (RETIRED) gentoo-dev 2005-12-18 09:39:41 UTC
SM is fine by me. Pity it's a tad on the slow side though. :(
Comment 17 Andrea Barisani (RETIRED) gentoo-dev 2005-12-28 06:25:44 UTC
imho we should encourage users to keep emails off toucan, imap/pop are manageable and acceptable, installing webmail would be pushing that logic
though. Not to mention that it would be an additional security concern and if it's a php app...well that would be even worse (security and admin wise).

Even if we offer this as a low priority service my fear is that 50% of devs will
unfortunately start relying on it.

So I'm against this, 'cause I don't like webmail, 'cause it's an additional security concern and 'cause we have other priorities atm re mail that needs to be addressed.

If we do this we better find something that can use LDAP and protect the page
via certs or htaccess (with ldap lookup because otherwise managing htaccess would be a pain)

Just my 2 eurocents.

[this doesn't mean I wouldn't be happy to help if we actually decide to
implement it, quite the contrary if time allows]
Comment 18 Andrea Barisani (RETIRED) gentoo-dev 2005-12-28 06:26:19 UTC
Changing the title to something a bit more sane.
Comment 19 solar (RETIRED) gentoo-dev 2005-12-28 06:34:02 UTC
This service if implemented should be on https:// only.

It would be nice if we used .htaccess to explicitly limit the 
domains that could connect to it.

It's security track record is not exactly that good. (200405-16 being the real bad one)

200406-08 [U] Squirrelmail: Another XSS vulnerability 
200506-19 [U] SquirrelMail: Several XSS vulnerabilities 
200501-39 [U] SquirrelMail: Multiple vulnerabilities 
200405-16 [U] Multiple XSS Vulnerabilities in SquirrelMail 
200411-25 [U] SquirrelMail: Encoded text XSS vulnerability 
Comment 20 Donnie Berkholz (RETIRED) gentoo-dev 2006-01-02 22:00:02 UTC
(In reply to comment #17)
> imho we should encourage users to keep emails off toucan, imap/pop are
> manageable and acceptable, installing webmail would be pushing that logic
> though. Not to mention that it would be an additional security concern and if
> it's a php app...well that would be even worse (security and admin wise).

I don't always have the ability to install email clients on work computers I'd like to check email from.

> Even if we offer this as a low priority service my fear is that 50% of devs
> will
> unfortunately start relying on it.

I doubt that -- Gentoo mail is too high-volume to only use any webmail app I've used.

> So I'm against this, 'cause I don't like webmail, 'cause it's an additional
> security concern and 'cause we have other priorities atm re mail that needs to
> be addressed.

I think we can consider the first point moot in this discussion. =)
Comment 21 Ioannis Aslanidis (RETIRED) gentoo-dev 2006-04-10 16:05:11 UTC
I was commenting about webmail with ramereth and he told me about this bug. As far as I've read, apart from the security risks, one of the problems infra sees is that developers would relay on it. Personally, I consider that webmail would be used only if one is not in his home computer, that is for kinda casual checks.

Another issue that I think that lcars implied with developers relaying on it is maybe that developers might somehow increase the use of the gentoo mail if the webmail service is implemented. I'm not sure if this is a real issue and if lcars really implied it (correct me if I am wrong please); my point is, is it a real concern if the developers consume let's say 50% more of HD space?
Comment 22 Lance Albertson (RETIRED) gentoo-dev 2006-05-18 21:35:51 UTC
Reassigning to infra since Corey has retired.
Comment 23 Ioannis Aslanidis (RETIRED) gentoo-dev 2008-03-26 21:03:49 UTC
Hello! I want to cry out at this once again. Do we have any updates?
Comment 24 Ioannis Aslanidis (RETIRED) gentoo-dev 2010-01-01 23:15:26 UTC
Let's resurrect this topic once more, just for fun.
Comment 25 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2010-04-24 23:16:33 UTC
Is there still a large demand for this?
Comment 26 Arun Raghavan (RETIRED) gentoo-dev 2010-04-25 05:51:18 UTC
I think that there is some demand for this, I've had situations where I couldn't set up an email client and could have used Webmail. I've moved all my mail to GMail now, so it's not a problem for me, but I definitely see some value in this.

FWIW, I've used Horde, SquirrelMail and RoundCube, and only Squirrel was usable amongst these. There seem to be more options these days, though (http://www.noupe.com/ajax/10-ajax-webmail-clients.html). Shyam's got some experience with Zimbra, iirc.
Comment 27 solar (RETIRED) gentoo-dev 2010-04-25 06:06:33 UTC
(In reply to comment #25)
> Is there still a large demand for this?

I think we should close this as WONTFIX/LATER (sorry)
Comment 28 Petteri Räty (RETIRED) gentoo-dev 2010-04-25 07:46:56 UTC
(In reply to comment #27)
> 
> I think we should close this as WONTFIX/LATER (sorry)
> 

Using LATER is not allowed any more as you should remember from voting in the last council meeting.
Comment 29 Ioannis Aslanidis (RETIRED) gentoo-dev 2010-04-27 07:18:19 UTC
Nice way to keep a bug open for almost five years... please, remind us of the implications of having a webmail client.
Comment 30 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2010-04-27 08:33:33 UTC
Mainly concerned about the poor security history of most of the webmail apps.

Presently if I had to put one up, it would be behind SSL, and you'd be logging in twice, once for the HTTP auth layer and once for the actual IMAP layer.
Comment 31 Alec Warner (RETIRED) archtester gentoo-dev Security 2011-09-23 09:04:52 UTC
1/36 respondents (3%) voted for webmail in the latest infra survey I sent out. I believe the majority of developers are happy to grab mail via imap / pop or forward to other webmail products.

I recommend we focus our efforts on other services.
Comment 32 Alex Legler (RETIRED) archtester gentoo-dev Security 2013-05-03 12:55:33 UTC
*** Bug 468424 has been marked as a duplicate of this bug. ***