> someone very helpfully suggested just wrapping the plain text email in a <pre> tag to protect against XSS

This is bad advice.

https://www.cs.dartmouth.edu/~sergey/langsec/occupy/

Hello, this was me; author of JMAP and lead architect of Fastmail's web UI. The advice was intended to be "render it as plain text" AND then put it in a <pre> to preserve white space. Turns out tweets are difficult to put technical advice into, especially when you are not sure of the context the person you are talking to will bring with (so to me "render as plain text" means insert as a text node, not as innerHTML, but looking back I can see that this may not mean anything to someone with a different experience of building web apps). My apologies for the confusion.

Overture is really great. Folks who regularly mix and match from NPM (and especially those publishing packages themselves) could learn a thing or two by studying it.

Thanks! Now it's all ES modules, you can easily just pull in the bits you need without having to bundle the whole codebase, which makes it much more useful for other projects too.

I actually realized that this must be on HN because 2 different people emailed me to tell me this XSS workaround was bad advice :). Updated the post.

Hey! Awesome that you updated it! Thanks for all of your blog posts. You’re one of a few go-to blogs when I want inspiration on new things to learn. I even used your website design as a model for the default template for a static site generator I built :)

The last mention of JMAP got me to sign up for three years of Fastmail. I used their auto-configure script to add it to my personal MacBook. The system then became more unstable than it has ever been, frequent crashes of the WindowServer and complete system lockups. Combined with scary messages about my Gmail and iCloud accounts asking for re-authentication. I seriously thought I had been owned.

I removed the Fastmail accounts (mail, calendar, etc.) and everything was immediately fine again. I'm scared to try this again to troubleshoot what is happening.

Wow, that's really worrying that an autoconfig file could even do that!

We have had reports of the autoconfig being annoying if you need to change any settings because it locks some of them in place, but I've never seen any mention of that kind of crash.

Regarding the re-authentication messages, I suspect the reason is that you have migrated calendar events across into Fastmail from those other systems, and those events contain links to authenticated resources which your Mac is trying to load. This isn't really something we can fix other than stripping those out of your events, but that has its own downsides!

I didn’t migrate anything into Fastmail.

When I removed the Fastmail accounts everything else went back to normal. It could very well be a problem with MacOS.

When I have time I’ll try setting it up again and see if it happens again.

Works fine on my iPhone.

If you do try it again, we'd be keen for you to contact our support if you have problems so we can look into if there's anything we can do at our end.

Were you just using Fastmail as a copy if Gmail? Or were you manipulating gmail through jmap?

Gmail and Fastmail were not linked in any way. I have had my Gmail account set up in MacOS for years. I added my Fastmail account. My system became unstable and all my Internet accounts started prompting for logins.

I've been using Fastmail, on my Mac, for six-plus years now, no problem.

Didn't use any sort of auto-configure script, though.

That sounds unreasonable. Did you directly download the profiles (.mobileconfig) from Fastmail?

Yes, directly from fastmail.

Not sure if MacOS tries to use JMAP or if this was IMAP. The system was completely unusable most of the time. I was able to delete the accounts between lockups. Didn’t do any troubleshooting beyond that.

Don't think MacOS has JMAP support at all, so most likely IMAP. Happy Fastmail user here. Used it on a MacBook up until about 2 years ago with no issues with native Mall.app. Used it on my iPhone until I switched to Android about 3 months ago—also no issues with the iOS configuration script which sets everything up on iOS with pretty much one click—very useful also for setting up family members' phones. Found Fastmail much, much better than Gmail IMHO who has the worst IMAP implementation I have ever seen. Bugs include command like deleting/moving/etc mail not actually having any effect over IMAP. Gmail only works in macOS/Outlook/etc apps I suspect because of all the workarounds Apple, Microsoft et al have implemented to paper over Gmail's IMAP bugs. Fastmail by contrast has worked as expected on all platforms, although I now just use the Fastmail app on Android and the Fastmail web interface on Firefox/{Mac,Windows} as Android/Windows's native apps are horrible compared to their Mac counterparts.

Yeah Fastmail works great on my iPhone, both their app and the native one. Setup was a breeze.

MacOS setup wasn’t hard to do, it just made my system unusable.

I'd love to see a non-Fastmail writeup of using JMAP - I was seeing if I could implement push notifications for certain emails coming in and it looks like I'd need to handle the entire mailbox.

Cool beans, I love the simple and straightforward lightweight client based approach.

Shameless plug - I built the screening workflow / Imbox bit of Hey for IMAP servers about a month ago https://www.feval.ca/posts/screenr/. We're just missing a couple more features and we'll have their full feature set for any mailbox :)

And I built send plugin: https://addons.mozilla.org/en-US/firefox/addon/massfastmail/

Thank you for this!

I've experimented with JMAP a bit (related to my work with https://forwardemail.net). Cool hack.

The chaining of requests/method-calls is a really interesting concept.

Great write up! I actually lol’d at step 0. The irony of hey.coms vision to simplify email and you’re first intuitive step.. hilarious

For those who are perusing the comments w/o reading (like me all the time)...

Step 0: “make the feature simpler”

Fwiw I read the article but I don't remember that heading so also for readers without perfect recall it's good to reference what you're talking about.

Gmail is the worst of the worst in email support: It has none.

Always had great support experiences with FastMail. Spamming them hourly seems like being a bad customer though.

I've noticed there's only ever effusive praise for Fastmail on HN, which itself probably leads to the kind of thing that Feynman warned us about re oil drops.

Spamming folks notwithstanding, I also had a terrible experience with Fastmail on the two occasions that I filed support tickets. I once wrote before: if the options are no support from a service where it's never needed, versus the illusion of support from a different service (paid, even) where the emptiness of the promise will be made evident, then the former is better.

Having said that, I don't actually use or condone Gmail; I give my money to a Fastmail competitor.

I also had some bad experiences with Fastmail, they're very aggressive at shutting down your account if billing fails (expired cc) with zero warnings. Ended up missing emails on two occasions because of this (I was using fastmail for forwarding). For recovery, they offered to read my emails to confirm my identity which was the final straw. Related thread here: https://twitter.com/shazow/status/1021570521987731458

it's really worrisome that they offered to look through your email data to confirm your identity.

I'd be really curious to know more about what Fastmail does to safeguard customer data from malicious activity by employees.

Agreed! That's one thing that I know Gmail is _very_ good at, at least. I didn't get the impression that Fastmail cares particularly about that problem yet.

Do you mind sharing the company?

Not op, but migadu[0] and mxroute[1] are two commonly named competitors to fastmail.

[0]: https://migadu.com/ [1]: https://mxroute.com/

If you pay for gmail, the support is fine. Google One or GSuite have responsive support.

Fastmail has undo send. https://www.fastmail.com/help/send/undosend.html

So you started spamming their support and then you were surprised that they didn’t get back to you immediately?

I had great experiences with Fastmail support.

For anyone who find it hard to read (it has accumulated some IMO well deserved downvotes, possible from people who have served on helpdesk like me ;-)

> I started sending them hourly updates hoping for a faster response. Then I copied the CEO to the email chain. After about 20 emails to them I gave up.

> A few days later someone got back to me that every time you email their support it resets their clock on when they will respond...

I must say this sounds like a brilliant idea that lets you:

- 1. wait until people have calmed down

- 2. annoy loud complainers

- have plausible deniability for 2.

At the same time it's a horrible way to tank down time-crucial problems. World is ending now? Sure, but first wait until you've cooled down enough, even though might die in the meanwhile.

This measurement should only come after a first evaluation in priority to filter out the hot topics from the warm pockets.

I don't envy anyone whose world is ending because you have some issues with IMAP (but I guess it's not so serious that you can't temporarily use their web interface).

Also, if it actually is urgent, you don't send a support email, you call them on the phone.

They do not offer phone support.

I'm sure they can have a KAM assigned for the President, the army, the navy and the air force should they happen to use it in their official capacity / for work ;-)

I've always had sub-hour responses and generally solutions. I've been impressed with how informed and empowered the support people are, as well.

It's weird that you experienced "the worst in email support" when I've experienced close to the best. Maybe we're only hearing one side of the story...

If you were my customer, I would fire you.

Or a good spam prevention technique. I think it's a good idea to discourage sending large quantities of emails as a technique for contacting support fastest

Some CRM tools are a little too simple. If you are ordering tickets by the most recent update time, you will get this. Overall age and 'has agent responded' are much more valuable. This is also why I like phone calls. Now instead of being trapped in a badly ordered queue I have someone who is looking at my issue and only my issue. You can give anything critical priority in everything but name just by calling instead of emailing.