SquirrelMail is being removed from cPanel | Hacker News Reader

SquirrelMail is being removed from cPanel

blog.cpanel.com

71 pointsperch5662 comments

I'm honestly surprised to find out that it was still being ahipped.

It was the first webmail application offered at a .edu I worked at and that's been 15 years ago. It was -- or so it seemed -- "dead" then.

Suppose one was to write a decent webmail front-end, how exactly does one make enough money to sustain its development, even if it's a one or two person effort?

I love open source but there's also a need for developers to live off what they make.

Who has successfully made a webmail front end that they could sell?

What about https://sogo.nu ?

sogo stable builds are closed.

I think the rainloop developers make some income from support and custom installations.

IMO this is the best way to go for an open-source project.

Same way any venture does: by collecting money from people who want the product to exist. If there are too many freeloaders and not enough contributors, then free licensing is not a viable option. Development of the software can still be done in a public repo.

Making a living, or even half a living, off open source development would be a dream.

In the specific case of webmail[1], I would offer hosted instances.

OTOH, a need to commercialize a FOSS-project is always a latent conflict of interest and I personally only reluctantly make such software part of my stack: I might end up with core devs moving to a proprietary fork full time and not enough other devs to "just fork it".

[1] when did this even become a word?

As to the usage of the word 'webmail', I'd say it's been in techno-parlance for a long time, masquerading as recommended DNS settings.

By 'long time', I mean at least since the mid-to-late 90s. I would often see the word -- not in regular writing, but in tutorials, all the time. Setting up a cPanel instance, for example, you would often be instructed to set up your MX records as 'mail.yourdomain.tld', and your CNAME as 'webmail.yourdomain.tld', just so you'd have something convenient to type in your browser.

There was a time when reading email on the web was not a thing [0]. Reading mail on the web - as a new feature - is "webmail".

[0] https://en.wikipedia.org/wiki/Pine_(email_client)

> [1] when did this even become a word?

Around 1996-7? Right around the time that HoTMaiL came about.

Fun trivia, it was built on pretty much 100% freebsd, before Microsoft acquired it.

Yep, I can still remember the clusterf#ck migration to Win2K.

> Who has successfully made a webmail front end that they could sell?

FastMail, but they had to put a whole service behind it.

I wrote a successful Squirrelmail UI for the third largest Austrian ISP then. It was not sold, but used and liked. When I switched to working with cPanel I never thought of bringing along this patch, which was public decades ago, because I had more important things to do.

The other two options, roundcube and horde, which I updated recently at cPanel, are much better.

https://www.mailpile.is/

“Community funded and supported”

It's quite nice but I wouldn't consider it production ready really... I contribute to it every now and then

protonmail won my business (which is extremely hard to do because I'm a cheap) and I've been using the internet since 1992. I use to run elm on a terminal. They also have a VPN and when you email support, you basically get a 3rd level engineer response within an hour. I forward all my gmail mail to my proton account, and use it for personal and one of my business. I keep banking and bills on gmail for now.

Protonmail has no full-text search nor spam detection.

Which you probably don't notice because you forward Gmail -> Protonmail. ;)

I use ProtonMail and don't forward through GMail. Spam isn't an issue, and the available search is good enough.

ProtonMail is easily one of the best mail services I've used; particularly now that there's an IMAP bridge.

One example is Open-Xchange [https://www.open-xchange.com]

They make an open source webmail + drive + docs suite, and sell a commercial version (e.g. to ISPs). The software is great and they're still around, so it must be working out for them.

For those looking for good fully self hosted alternatives, two options:

Roundcube

Rainloop

Squirrel mail is dead, but self hosted webmail is far from dead. Some .EDUs with student populations of 12,000+ use roundcube for their https interface student mail.

> Squirrel mail is dead

I didn't even know... crap.

Spam domain filters virtually killed self-hosted e-mail and what I presume was their major use case.

There were times I thought that I'd have to give up, but it is much better than it used to be. I've been running my own email since 2002. There were some rough years, but I think we are past the days where you'd try to send to someone at {{big company} and get rejected. It's been quite a few years since I've thought too much about being rejected or fighting spam.

It is a pain to setup DKIM, SPF, etc., but it all works now. I had to say "etc.", mostly because I don't remember all the hoops I jumped through. THe good news is that it has been so long I don't remember.

I guess this period was a necessary evil to improve the email acosystem and make everyone a bit more concerned to setup their system correctly (even though it's non-trivial)..

I've run my own email out of my closet for close to 20 years and have no problem sending. I think DKIM/SPF probably help a lot, but I really can't say, as I've never been blocked (to my knowledge).

Same here.

We're a long ways from the days when your machine would come with sendmail running and accepting mail for your FQDN OOTB, though... so it's a little more difficult but certainly not out of reach of anyone who is willing to put into the time and effort to learn how to do it right.

(I plan on moving my mail to a new machine (well. new VMs) over the next few days and I expect to run into nearly no issues doing so. Then again, like rhizome, I've been doing this for ~20 years.)

Assuming you have a clueful and attentive upstream ISP and a static /29 or something, running your own mail out of your closet with proper rDNS, spf and dkim probably has better chance of delivery success than the same software setup, but on a dedicated server sharing a /24 of IP space with clueless and occasionally abuse-generating neighboring customers in the same netblock.

I have all that except for delegated reverse DNS, but that hasn't been a problem (again, to my knowledge!).

You don't really need rDNS delegated to you (and I'm pretty sure that's not what walrus01 meant), just so long as you can set (or have your ISP set) the PTR RRs to match.

Correctly set PTR RRs can (will) make a huge difference (lots of MTAs will reject if FCrDNS fails).

Functionally from an smtp perspective it doesn't really matter if the rDNS is delegated to you, just that it's set correctly... ordinarily it's something you only have to set the PTR record for once, even if you need to manually ask your upstream to do it for the /32 that is your server, get them to set it to mail.whateverdomainname.net

IMHO if you do network engineering it's worth knowing the intricacies of modern SMTP setups. It is not that hard to build a wholly self hosted Postfix setup that has:

Working reverse DNS

SPF

DKIM signing

TLS1.2 transport to and from other smtpd, negotiated opportunistically. You can use a letsencrypt certificate.

Is definitely not an open relay

Requires TLS1.2 + SASL auth of your username and password to send outgoing mail (I use the same account credentials that are also my dovecot IMAPS account)

Roundcube is good enough. The only problem with my cPanel-powered shared hosting is that filtering isn't part of the Roundcube application but is taken care of by another cPanel app(let). I'd rather have it all in Roundcube.

Roundcube doesn't handle large inboxes well.

Squirrelmail had this nice option where I could set a BCC for every email - I BCC all my emails to myself (hack to get around another problem). Roundcube has no such option.

In my experience, I have seen no benefit that Roundcube has (feature-wise) other than being prettier.

How .... large?

I thought my 50k-70k inbox was huge, but I just typically order by date reversed ...

I probably have a 30k folder myself, and Roundcube still seems snappy.

I generally like it, but for some reason wish there were other things to try. Mailpile is a stand-alone server and thus is more complex to install and run (or at least that was my experience the one time I tried).

> Squirrelmail had this nice option where I could set a BCC for every email

I can see such an option in Roundcube 1.2.3. Under Settings/Identities/[WhateverIdentity] there is a “BCC” field, which seems to be exactly what you want.

(This is not an endorsement of Roundcube – I use Gnus myself.)

My provider must be using an older Roundcube. I don't have that setting.

There was talk about integrating Mailpile into cPanel years ago[1] - I remember discussing it with an acquaintance who worked at cPanel at the time. I wonder why it never gained traction with either them, or any other web hosting/control panels? Plesk for example, which is probably cPanel's biggest competitor, exclusively bundles Roundcube.

[1] https://features.cpanel.net/topic/add-mailpile-as-webmail-op...

I did some mail ui work while at cPanel. We have three options, the old Squirrelmail, the recently updated Horde, and Roundcube. That should be enough.

Squirrelmail was unmaintained, hence it's deprecated. I did maintain some patches decades ago, but don't work with PHP anymore for several years. And not with cPanel anymore either. Dropping squirrel was discussed 5 years ago already.

I kinda developed a little dislike about Horde, but I heard good things about Kopano, which also works as workgroup software.

I host my websites and have subsequent email via DreamHost.

When I first signed up right around their billing fiasco ~10 years ago, they where on SquirrelMail with a hardstop "convert to gMail" option. They have since switched to a different email default [AtMail] about 1.5 years ago.

On one hand I miss SquirrelMail. On the other hand, I now understand the change [ageing tech]. There has been a learning curve along with A/B testing, for example having the "hardcore delete all emails in your primary inbox" button right next to your "refresh your primary inbox" button... bad times which have been solved.

The headline is misleading by itself. SquirrelMail is still getting security fixes and is under active (but slow) development.

Is it in a fork? The official site isn't updated since 2013 and Debian removed it in recent versions (jessie is the last to have it) because of that. Do you happen to know where the new versions and development are? Squirrelmail is by far my favorite webmail setup, i use it for almost 15 years now and exactly what i like about it is that it has remained pretty much the same all these years, so i'd like to make a manual installation over a recent version (Debian seems to have an svn version from 2012) once i upgrade.

My, perhaps incomplete, understanding is that you can just run the old thing if you can support PHP5. Otherwise you can run the eternal dev version, but you will have access to fewer plugins.

Added: It appears there is some version 1.4.23 (the old thing) that will run on PHP7. I am currently running 1.4.22 on PHP5 under OpenBSD with no problems. The problem seems to be in figuring out what version to run.

I do not use any plugins so i'll probably try the "eternal dev" version. Hopefully it'll be fine.

The article is pretty clickbaity. While the assertion that Squirrelmail has died is probably correct, the title makes it sound like it would be an explanation on what happened. Instead, it’s just describing the motivations on why cPanel is removing Squirrelmail, while trying to proclaim the death of Squirrelmail in the process.

I'd wager cPanel accounts for the vast majority of Squirrelmail installs these days. If they quit shipping it, its remaining user base is going to quickly dwindle.

Or not so quickly, given the number of ancient cPanels out there, though those are all likely compromised by now.

Ok, we changed the title to use a representative phrase from the article.

There's a headline from ten years ago...

Is cPanel itself still widely used?

Yes, pretty heavily. If it is a marking/small business website there is a very good chance it is running on cPanel.

I would assume yes. I think its niche is the entry-level layman. Which is probably why a HN reader wouldn't encounter it very often.

Yes: https://www.shodan.io/search?query=cpanel

If you're logged in, https://www.shodan.io/search?query=title%3A%22whm+login%22+p... is a better query which shows 1.5M cPanel installs.

Yes. It's standard on most shared web hosts.

It's really good when you host small Web sites and don't want to fiddle around much. Especially cause I can setup resellers who can manage their own accounts. Agencies use it a lot. There whole business can run on a couple of servers running cpanel with WordPress on each account.

I loved Horde, and then tried AfterLogic Webmail Pro. Surprising there's no single robust mail offering

Sad day.

Reply on news.ycombinator.com