Open Source AJAX Webmail

scrasher writes "It seems AJAX webmail is all the craze. Right on the heels of both Microsoft and Yahoo launching beta versions of their new AJAX webmail clients, an Open Source startup RoundCube has released an alpha of a GPLed AJAX webmail client. While there are still many features missing (like search!), the demo they have is completely cross-browser compliant and overall very impressive."

not a business startup

[jbellis]

When you stay "startup," it makes people think they're trying to start a business around this. They're not, at least not from what I read. It's just one guy's project on sourceforge.

Not all browsers supported

[gitana]

Unfortunatly, I can not try the demo because the mac specific Mozilla browser - Camino- is not supported. I may be able to spoof my browser and access the mail client without any problems but isnt that what we are trying to get away from?

Re:Zimbra

[ExKoopaTroopa]

except that is just another fancy name for a bundle of not so recent technologies

Re:Not all browsers supported

[Anonymous Coward]

Camio works I just tried the demo using it. It was very slow but worked.

Re:AJAX is a retarded term

[MankyD]

"AJAX" is a retarded and non-sensical name made up by a consulting company who wanted to make themselves sound important. I can't believe you people are falling for it.

And what would your rather we call it? And what magical consulting company is this? If they've done such a good job making themselves sound important then certainly you must be able to come up with their name off the top of your head. (oh wait, you didn't include their name in your post :P)

No one is "falling" for anything. It's a name that works for a useful technology.

Re:Zimbra

[fak3r]

Zimbra is pretty much full featured, and does allot more (AJAX wise and otherwise) than Roundcube. Give it a look too. Having said that, Roundcube is basically one person, and it's a very impressive project in that regards; nice clean UI, and a somewhat new way to deal with 'webmail'. I see Zimbra as being a great comapany (all stuff is 'ZPL' btw) but Roundcube should attract some devs now, and I expect it to be a real nice 'light' solution for us home mailserver folks.

AJAX Security

[webappsec]

AJAX Security [cgisecurity.com]

Re:Zimbra

[Wornstrom]

I would recommend that you use a system that has some horsepower. I installed Zimbra on a p4 3.0 Ghz HT 1GB ram box (my workstation), and experienced some heavy load. Not only that but it takes the liberty of rewriting your firewall ruleset, so I wouldn't use an existing system without being prepared for service / connectivity interruptions (linux gateway/firewalls). Sure, it is still in beta, so I will give it that excuse, I couldn't imagine releasing the horde on it for production use yet. If this one doesn't require all sorts of backends, I might give it a try.

Re:Installed! Looks nice thus far...

[rabel]

I haven't yet installed it, but it sure looks slick. Damn, and the installation requirements are just this simple. 1. Decompress and put this folder somewhere inside your document root 2. Make shure that the following directories are writable by the webserver - /temp - /logs 3. Create a new database and a database user for RoundCube 4. Create database tables using the queries in file 'SQL/*.initial.sql' 5. Modify the files in config/* to suit your local environment 6. Done!

Re:One comment and slashdotted!

[houston_pt]

If you have a Gmail account, next to the search buttons there's the "Show search options" link that opens a query form that does all that and some more :) If you don't have a Gmail account I can give you one ;)

pine + screen

[Dlugar]

I use pine + screen for 99% of my email needs. Works great! Long lasting taste satisfaction. (And I have squirrelmail installed for the rare occasion that [a] I'm on a computer that doesn't have ssh, or [b] I want to view an attachment.)

Dlugar

AJA not AJAX

[minddog]

Whats commonly confused in the community, if there is no client-side xsl transformations using the browser, their is still interface load. This is not a true AJAX imap client, it is an AJA, and the xml is rendered server-side to xhtml standards.

If you are interested in a pure implementation that has been around longer thats true ajax, check out http://www.communik8r.org/ [communik8r.org]

Re:Foldername length patch.

[mottie]

I have just installed it for the first time, but it appears that the caching portion is completely optional.
 
// enable caching of messages and mailbox data in the local database.
// this is recommended if the IMAP server does not run on the same machine

$rcmail_config['enable_caching'] = FALSE;

Re:AJAX is a retarded term

[Goaway]

And what would your rather we call it?

How about "Javascript", since that's all it is?

And what magical consulting company is this?

Adaptive Path, and here's the original Slashdot article where they started the whole thing:
http://developers.slashdot.org/article.pl?sid=05/0 2/23/1859222 [slashdot.org]

It's a name that works for a useful technology.

It's technology that already had a name and doesn't need a new one.

Re:Cross-browser?

[SillyNickName4me]

Ever read this [w3.org] thingy? Or any of the other publications from this w3c thing?
They pay a lot of attention to ensuring things keep working, and dgrade in a nice gracefull way instead of just borking.

And yes, in 2005 there are still quite a few relevant browsers that do not support JS, and which would be extremely usable with a webmail application still. This concerns virtually all browsers on handheld devices.

Re:Cross-browser?

[Anonymous Coward]

Javascript is an accepted WWW standard. There is no reason for any app developer to not use javascript to his heart's content.

Security? Privacy?

I browse with Javascript turned off by default (Maxthon [maxthon.com] makes this really easy; it's two clicks to enable it for the current tab), and I thus don't see any pop-ups, rarely get asked for cookies (most sites seem to use Javascript for this!) and thus my computer can theoretically only get compromised if there's a bug in the HTML parser. (as opposed to this week's script-related exploit that makes it possible to, say, access the user's filesystem through some obscure object)

Javascript-less browsing isn't dead. It's both painless (less ads) and occasionally frustrating (you wouldn't believe how many forms use Javascript for stuff that doesn't need it, like submitting the damn form!), but it's overall better than browsing with scripting enabled.

Re:Zimbra

[AvitarX]

yeah, Zimbra is a collaborative suite, presumably a replacement for another one.

Roundcube is a nice client for IMAP email access that leaves everything in tact (probably a lot lower requirements too).

Re:Cross-browser?

[freshman_a]

The big question is: Does it run on Lynx and Links?

Although the summary states that it is "completely cross-browser compliant", RoundCube's website lists it as having been tested with Firefox, Opera, Safari, and IE. Some people still do use Lynx and Links.

Anyway, I tried it with Lynx and Links and didn't have any trouble logging into the demo. However, it appears that the Compose, Reply, Forward, etc., commands are all represented as images without alt tags, because I was shown the folder list and a bunch of [IMG] tags.

So while it works with Lynx and Links, it's not yet very usable with them.

Re:Buggy

[Anonymous Coward]

Photoshop ain't crap, son.

Re:Call me old fashioned...

[El_Muerte_TDS]

I prefer MUTT http://www.mutt.org/ [mutt.org]
And I use Zoe to search through my mail (not that it happens that often), all I need is Zoe inside my MUTT

Re:Installed it, easy install, not bad

[hrbrmstr]

I have to agree. It took about 3 minutes to get up and running after the download on my linux box. Those just starting out will probably need a bit more time. A setup program would be in order, either via browser or just on the command-line.

Definitely more eye candy than SquirrelMail - www.squirrelmail.org - (which hasn't had a real update in how long?), but the initial hit on the IMAP server did go quite slowly. I'm running UW IMAP and it looks like the RoundCube backend doesn't know enough (not a dig at all) to limit the scope of the traversal (since it goes through every file and folder in my local account and then identifies which files/folders contain mailboxes).

No configurable refresh interval (from the GUI, anyway). Login options need to be more site-customizable (yes, it's OSS, so I could write it and contribute, thank you for asking). Didn't try it on a PDA, but it should also be able to work somewhat on a limited platform (SquirrelMail is quite functional on a PocketPC browser).

It writes files to local directories, and I didn't do a check to see if they are easily moved (i.e. out of the web docs tree). .htaccess files are nice, and all, but I'd rather they not be near a bot or a malicious moron at all. Adding an option to log to a DB as well (or just to a DB) would be nice.

It doesn't look like global address books are available.

And, it defaults the "FROM" to be [e-mail] g. Gak.

Overall, I'm really impressed with it and I, too, will definitely be keeping an eye on future releases. I'll be keeping SquirrelMail for the time being, tho.

Re:AJAX Security

[booch]

First of all, I don't see much security-related content on that site. Second, the issues that are raised all seem to be issues in non-AJAX web development as well.

For example, in AJAX Considered Harmful [intertwingly.net], using HTTP GETs to change state is a well-known no-no. (Google Accelerator recently broke some sites that violate this principle, but it's been known since at least HTTP 1.0 times that infrastructure would break sites that were coded incorrectly.) But XMLHttpRequest supports POSTs (and PUT, and probably all the rest). It also supports HTTPS.

As far as stealing content [whirlycott.com], that can be addressed (well enough for 95% of cases) by checking the Referer field. (I think that should work -- I wasn't able to find any documentation whether the browsers add/override that header when submitting XMLHttpRequests, like they should.) Although the random session token he suggests is a pretty good solution as well.

Kerio's had this for a while now...

[jerkychew]

Kerio MailServer [kerio.com] is a nice Exchange replacement that runs on Linux and Mac OS X. It has a really nice AJAX webmail app that is a feasible replacement for a desktop app. It's not free, but it is cheap, and it's not Exchange :-)

Re:Zimbra

[fak3r]

right, so I see it like this:

RoundCube = Squirrelmail = Horde != Zimbra = Hula Project = OpenExchange = Exchange

Ok I'm oversimplifying it, but that's how I'm thinking of the relation of the various projects now.

Re:Zimbra

[Matt Perry]

no-one was really using it until Google Maps first came along

Not true at all. A lot of people were using it. However, it didn't land on a lot of developers radar until Google started using it for projects like Maps, GMail, and Google Suggest. For a majority of developers that was their first exposure to it and that's when it hit the mainstream.

Re:Zimbra

[ceejayoz]

As the AC says, XMLHttpRequest was in Microsft's Exchange webmail in the late '90s. Note, for example, this September 1999 article [microsoft.com] that mentions XMLHttpRequest in IE5.

Re:Zimbra

[Thundersnatch]

Microsoft Outlook Web Access, included with Exchange Server, is widely recognized [wikipedia.org] to be the first real AJAX application. The 2000 version was the first browser app I every used that made me say "wow, how the hell did they do that?". No Java applet or ActiveX, but it felt like a real, usable desktop application. Context menus and everything, with few full-page refreshes.

Google has done quite a bit to elevate the profile of AJAX with the Slashdot crowd, but other people were definitely "really using it" long before Google.

Re:Outlook Web

[Anonymous Coward]

When you use it in firefox, it's essentially as static as yahoo or hotmail. When you when it with IE, you get all the whiz-bang AJAX features.

Re:AJAX is a retarded term

[Goaway]

What is wrong with calling it AJAX instead of Javascript?

Why make up new words when old ones exist and have the same meaning? There's nothing to be gained, and it only sows confusion and fragments language. And in this case, the word "Ajax" is, on top of it all, a lame marketing attempt.

Nothing. If anything, 'Javascript' has problems, because the word 'script' -- as in script kiddies -- has negative connotations. Add on 'Java' and either your talking about Indonesia, which makes people think of outsourcing (or will, in the next decade), or you're talking about coffee -- and do we really need people associating a useful tech with video game pron mods?

Don't be intentionally daft. You're just insulting everyone's intelligence.

Re:AJAX is a retarded term

[Goaway]

Are the two terms absolutely equivalent?

As near as I can tell, yes. And, (if you need an argument from authority here to know I'm not just talking out of my ass) I've written apps that would fall under the term "AJAX", such as this:

http://wakaba.c3.cx/desktop-test/desktop.pl [c3.cx] (login/pw is test/test)

Sarcasm. Pointing out how ridiculous your argument is by doing the same to the opposite position. I know /.ers often have trouble with non-literal interpretation (myself included), but really... wasn't it obvious?

Yes, far too obvious. Which is why I said you were intentionally daft, and didn't just call you an idiot. Sarcasm is no substitute for insight. Please try to think up and present actual arguments in the future.

Re:One comment and slashdotted!

[jallen02]

This is where having an understand of where IMAP, SMTP, and POP3 are very helpful. MySQL is only used for storing preferences and very limited amounts of data relating to user specific settings in RoundCube. The actual mail retrieval and sotrage is all handled via IMAP. This means that this program is really nothing more a stand alone mail client, only as a web application. SMTP pushes mail around. It is then stored somewhere. On Unix type systems that is typically maildir or the mbox format. Then IMAP and POP3 (independent of SMTP) look at, and modify, the maildir or mbox stores.

So MTA = transfering mail. SMTP strictly moves mail around. I don't know of many MTAs that use SQL for mail storage, though I am sure people have implemented them. RoundCube is a client and would start at the very top of a digram where the user is at the top and their phisycally stored mail is at the bottom.

Mail Client --> IMAP/Pop3 --> mbox/maildir

In the setup I manage we have Postfix using a MySQL database for all mailbox configuration. We use courier IMAP which reads the exact same database to get the configuration data. IMAP then goes and reads the actual mail stored in Maildir format. So the SQL database is an important part of storing routing information for email. It is not, yet, used to store the actual messages. Though I suppose a relational data store for an MTA would make for an interesting project. So we really have two separate databases. One that IMAP and Postfix use for handling mail account creation and aliasing and one for RoundCube preferences. I actually set RoundCube up. It is VERY basic, but what is there works reasonably well. Its a nifty project to play around with I imagine.

Jeremy

Re:AJAX is a retarded term

[Goaway]

Dude, it was an actual argument, the argument being that your reason for disliking new names for things is also ridiculous.

Maybe that's what you thought, but it sure wasn't what you wrote. You wrote a bunch of ironic gibberish. If you want to have an argument, then state your opinion, and don't act like a retard.

Perhaps you think calling someone daft or an idiot construes an argument, since that is how you addressed my point?

You refused to present your point, and I refused to second-guess what you wanted to say.

Re:AJAX is a retarded term

[Goaway]

Reread my first post. I most definitely made a point, in my very first sentences.

OK.

What is wrong with calling it AJAX instead of Javascript?

Nothing. If anything, 'Javascript' has problems, because the word 'script' -- as in script kiddies -- has negative connotations. Add on 'Java' and either your talking about Indonesia, which makes people think of outsourcing (or will, in the next decade), or you're talking about coffee -- and do we really need people associating a useful tech with video game pron mods?

You can call it whatever you like (you can call it Fungrifoo, if you like, in your notes to yourself) -- but whatever name dominates mindshare is the one I'll use when communicating with others about it.

A contentless first sentence, a paragraph of nonsense, which is what I was referring to, and an argument about "dominating mindshare". I must confess to not knowing what this means, but I'm guessing you mean "whatever name everybody else uses". That would be (since I see you like the latin-named fallacies) argumentum ad numerum, "if a lot of people believe it, it must be right!"

And, BTW, an ad hominem comment is far worse than using sarcasm to illustrate a point...

Who's using ad hominems? I've merely told you not to act stupid when you aren't. This is a personal attack now?