Hacker News Reader

One thing you almost certainly want to change is the site's behavior with Javascript disabled - right now, it just shows a white screen with the text "Loading FWD:Everyone".

It's a bit of a pet peeve for me to see pages like this that are primarily static but are not accessible without JS, but I can understand that making a page built with a JS frontend work without it might be more work than it's worth, at least for an early stage project.

However, you really should put up some sort of notice to users - while being able to read a short blurb about what the site is nice, even just "<noscript>This site requires Javascript to view.</noscript>" is better than a blank page or permanent loading screen.

Good suggestion on the noscript.

There is actually a bunch of animation and interactivity on the site though. E.g. if you click on anyone in a thread, you see their bio and their other threads. And when you hover over a user’s popsicle stick on the newsfeed it pops up, which is stupid but oddly satisfying... We tried to give it the feel of popping bubble wrap.

Anyway prerendering more stuff is on our roadmap, so once that’s set up we can reevaluate.

It's called CSS3 mate.

You're absolutely right! We'll get this up ASAP. Thanks for your interest in the site.

This also applies to the case where JS fails. What if the browser supports js, but the request failed, or there was a syntax error, or some other fatal that halts js? Your users will be left on a lark without anything to look at.

> - Permission requests are becoming optional, at least for now. Previously we required permission for all non-anonymized message contributors, now there will be an option to publish stuff immediately and let people anonymize themselves later if they want. If this is excessively abused we'll re-evaluate this, but we've tried to build things to incentivize good judgment.

This is horrible! I mean, people can always be jerks, and publish private email. But you're facilitating that. This could readily be used, as an example, as a type of revenge porn. Sure, victims can anonymize themselves. But only after the information has been published, and potentially scraped. And you know that jerks will be scraping your site, for just this reason.

The default must be requiring explicit permission from all participants. Without permission, even anonymization is insufficient to protect against abuse.

> The default must be requiring explicit permission from all participants.

That's still the default. There are lots of legitimate use cases for publishing stuff without permission though, e.g. emails from Steve Jobs or whatever.

Normally when social sites get a lot of traction and then die it's because they go into a death spiral of negativity: e.g. Secret, Whisper, Yik Yak, etc. The best practice for avoiding this is to err on the side of too much friction when launching, and then to reduce friction for people who are contributing positively to the community.

That's basically the model we're following. The whole point of the site is to showcase positive interactions between people. E.g. showing conversations between VCs, between academics, lawyers, etc. I think the site is too wonky to get overly negative, but if it starts going that way then we'll be very quick to change things up again.

> That's still the default.

That's good to know.

> There are lots of legitimate use cases for publishing stuff without permission though, e.g. emails from Steve Jobs or whatever.

Just because he's dead, and was a public figure, is it morally acceptable to publish private email? Or even legal, without permission from his estate?

A quick search gives me the following.

https://blogs.findlaw.com/law_and_life/2018/04/is-it-legal-t...

https://writersweekly.com/this-weeks-article/legal_emails

https://law.stackexchange.com/questions/3980/is-it-legal-to-...

Edit: Also:

http://nulawreview.org/extralegalrecent/do-not-forward-why-p...

Of course if he is dead and is a public figure and the other part discloses it the exchange is now part of history. What is wrong with that?

I love to read correspondence from folks like Newton[1] for example and I want my grandchildren to be able to read Jobs exchanges as well.

[1] http://www.newtonproject.ox.ac.uk/texts/correspondence/all

Based on the cites that I listed, it's not that simple.

Edit: Perhaps there's now legitimate public interest for most everything about him. But maybe some Apple-related stuff is still off limits.

In terms of legality there are two separate issues, invasion of privacy and copyright. Things like privacy / libel / slander generally don't apply to the deceased, so in this case I think we can safely ignore that.

With respect to copyright, when you send someone an email you're using an agreed upon protocol (RFC 5322, RFC 5598, etc.) that implicitly grants the recipient a copyright. Now you can say this is a bad argument because no one ever reads those, which is true. But if this weren't true legally, then every time you replied to an email it would be illegal since (in most clients) the full text of the previous email gets copied below the new text. Users also can't really use the platform to violate the copyrights of third parties (e.g. by attaching music or whatever), since the platform is tied to their email account.

From an ethical perspective, the reason we specifically excluded whistleblowers as a user story is that you can't build a sustainable business around it, since you can only be a whistleblower once. we've designed it to force uploaders to have skin in the game. E.g. they can't anonymize themselves, and they're forced to link their Gmail accounts. I think that's enough to prevent the vast majority of bad behavior. E.g. you could also copy and paste someone's private email into a HN post, but it's just not done. The only thing we really do is make the process easier by letting people making redactions, anonymize people, send permission requests, etc., but that's not exactly a selling point for people who would be egregiously abusing the site.

IANAL, and so don't know how libel and slander apply to the deceased. I can imagine how estates might have claims. But ??? And even so, there are all the non-deceased correspondents.

I had no clue that email protocols "implicitly grants the recipient a copyright". What are cites for that? Neither https://tools.ietf.org/html/rfc5322 nor https://tools.ietf.org/html/rfc5598 includes "coptright" except in the "Copyright Notice".

But anyway, I get your point about "forc[ing] uploaders to have skin in the game." Maybe that will be enough. Because, as you say, there are many other ways to leak confidential stuff.

The protocols don’t talk about copyright explicitly, but they talk about replying and forwarding. Both of those behaviors are only legal if there is an implicit grant of copyright to the recipient.

Again, IANAL. But copying in replies seems readily distinguishable from forwarding and publication.

But anyway, sorry about taking this down the legality path. It is a cool service that you're providing. And I would never argue that you're legally responsible for what users do. I'm just concerned about the abuse potential.

Maybe you could enable publication without explicit authorization only when all correspondents were registered users. That would encourage users to get their contacts to register, increasing your userbase.

IANAL, but...

Replying is always legal (copyright-wise, at least, notwithstanding other laws that might prohibit it for some other reason, e.g. CANSPAM), so long as your reply does not include my original message or a portion thereof (aside from parts that I didn't really author in a meaningful way, e.g. email headers).

Replying with quotes, forwarding, or sending a paraphrased/summarized equivalent to my email may or may not be automatically legal depending on your jurisdiction's laws around fair use. Unless you know that it falls under fair use, it's almost certainly safer to treat it as illegal without prior authorization.

That line of logic doesn't work. A protocol is neither legal not illegal. It would be like saying that Swedish is illegal. The law largely doesn't care how you do something.

It's also not a necessary condition because an internal company mail server wouldn't run into copyright issues since the company owns the copyright on all their employees' work.

"Uploading a copyrighted work that I downloaded via GET with POST must be legal otherwise HTTP would be illegal."

> A protocol is neither legal not illegal.

My point is that when you send someone something you've written as an email, it constitutes an informal agreement (essentially a private contract) with the recipient.

> It's also not a necessary condition because an internal company mail server wouldn't run into copyright issues since the company owns the copyright on all their employees' work.

That's true, but anyone with a company email address is legally considered a representative of the company. (That's why you always need to deactivate people's email addresses when they leave.) So while the company (almost) always owns the copyright over work created, the employee is able to dual license that content by sending it via email.

Anyway just to be clear we're not saying you should go ahead and dox all your friends. We're not ad supported, that doesn't benefit us at all. (If your first experience with the site is getting doxxed, you're probably not going to sign up, and almost certainly aren't going to start paying for the business product.)

> it constitutes an informal agreement (essentially a private contract) with the recipient.

Is there any precedent you're basing this opinion on? Because it's not like your company just gets to decide this.

What are the terms of this supposed contract? If JK Rowling sent you the text of Harry Potter do you believe you have the right to distribute it through your site?

Do you believe that there would be a meaningful difference between Netflix sending you the same bits over email vs HTTP?

> Is there any precedent you're basing this opinion on?

There's no clear precedent. Clearly a judge isn't going to let us host a PDF of Harry Potter or whatever. If it ever came down to it I think there would just be a multi-pronged test, along the lines of the current test for fair use and securities law.

In the case of Harry Potter it's an exogenous work that was created and copyrighted outside of an email client, it has significant economic value on its own, and there would be substantial economic harm done from us hosting it. In the case of normal email conversations most of those factors wouldn't apply, especially since in many cases seeing how people interact with one another is more valuable that the content of any individual message.

Regardless, I paid my $6 to the library of congress to become a registered DMCA agent, so the copyright issue really doesn't apply unless we A) start ignoring DMCA takedown requests B) actively induce people to violate copyright.

You really, really, really need to get a lawyer, because this sounds like you're just spitballing here.

Granted that sending an email implies an informal agreement. But this agreement has to be thought of as giving exactly the rights needed to facilitate the email communication, and nothing more.

That means:

- copyright is still with the sender (or their employer)

- no rights to publish the message.

The users of your service will regularly violate copyrights if they didn't get explicit permission to publish.

Careful stating this so matter-of-factly. The law doesn't care about implementation details and implied copyright grants are tough to argue for. If I allow you to download a copyrighted work from my site it doesn't give you an implicit right to upload it to other people just because your browser has that feature.

Check out section A of http://nulawreview.org/extralegalrecent/do-not-forward-why-p....

Sending an email gives an implicit copyright license, but that license is related to how emails are normally understood to be used. It's not a total license to do anything with.

> The default must be requiring explicit permission from all participants

If you send me an e-mail, absent an NDA, I generally have permission to disclose it to third parties. If FWD:Everyone required permission from all participants, they would simply fall prey to FWD:Everyone2 who didn't.

What about claims for public disclosure of private facts?

https://injury.findlaw.com/torts-and-personal-injuries/invas...

From a GDPR perspective,sending an email gives the recipient the implicit permission to store and read the contents and metadata of the email, but not to transfer it to other parties (except the data processors that process the email) or publish it.

Does that mean I'm not allowed to forward emails you send me?

Nobody is going to be able to give you a definitive answer because it hasn't been tested in the US in the context of copyright or in the EU under the GPDR.

My guess is that forwarding would be fine but publishing wouldn't (in the US) and that you as an end user don't have to worry about the GPDR.

Hard to say, because the law is new. My guess is that it is legal as long as it is not in a professional/commercial context, or you remove my PII, or you have a clear and legitimate business reason, e.g. forwarding to a colleague within the company who is responsible for the subject matter.

Examples of illegal behavior would be publishing it, forwarding it to a marketer, or eg. for a recruiting agency forwarding to a company fir which I haven’t given permission.

If you send me an e-mail, absent an NDA, I generally have permission to disclose it to third parties

While technically true, I remember the days when publishing private messages was considered heinously rude. We didn’t need disclaimers and contracts and legalese for everything, because people - even on the Internet - behaved like decent human beings.

Yeah, I remember that from Usenet and mail-list etiquette.

I guess those were the days...

Before you use this service, I recommend to verify that it is legal in your jurisdiction to use this. E-mail, by default, is meant to be private (though the "private" aspect can be organization A plus customer X or organization A plus organization B or sysadmin logging the conversation and backing it up). If its meant to be public, there are mailing lists for that. And if GPG is used to encrypt the content, it for sure isn't meant to be shared!

"If you send me an e-mail, absent an NDA, I generally have permission to disclose it to third parties."

Permission from whom? Certainly not from me.

I am surprised about this point of view. When I send mail to someone, I do it in the belief the recipient can discuss it with whomever they want, even in public. Its their mail not mine. Also helps people behave nicely over mail if this pov holds true.

Guys, this is obviously situation-dependent.

If I e-mail a support engineer who is helping a customer with a problem, I expect they may tell the customer everything I say.

If I e-mail a colleague saying I'm worried our new product isn't up to our usual quality standards, I expect them to share that with other insiders but not risk embarrassing the company by releasing it publicly.

If I e-mail HR asking if our medical insurance covers syphilis, I expect them to keep that private even from other insiders :)

I had few people on my contact list sharing this pov a couple of decades ago. Hope they’re fine.

You have permission to disclose it to 3rd parties, but reproducing and publishing the content is a different beast.

This is one of those cases where the CS logic of "If I can show one person I can show n people" doesn't apply.

I really hope this does well (because I'd like to discover more interesting and useful content).

I've been on the home page a few times and haven't yet signed up.

My behavior on the homepage has been to click the "more example threads" button.

I'd guess that the thing that would make me more likely to sign up is to be able to see/discover more great threads before signing up. (Similar suggestions that people have given to twitter, i.e. provide max utility for logged out users so people who aren't yet converts can experience the magic. I think that might apply to your site)

Hope this helps and I'll look forward to seeing the site succeed!

Tl;Dr I'd personally be interested in seeing more cool threads on the homepage and perhaps displayed in a way that makes it easier to find ones that are particularly interesting to me, so that I can get "hooked" on the service.

(Makes me think of Chamath's talk, where he talked about facebook's magic moment being 7 friends in 10 days https://ryangum.com/chamath-palihapitiya-how-we-put-facebook... - I wonder if your magic moment is getting people to discover a thread that is both really useful or interesting to them and that they feel is secret/that they likely wouldn't have been able to find elsewhere on the internet)

> I really hope this does well (because I'd like to discover more interesting and useful content).

Thanks! Expect to see more content in the near future.

And we definitely need to redo our front page and incorporate more cool content. It's a lot better than when we launched, but I feel like we haven't quite hit a level of professionalism that's reflective of the rest of the site.

We’re trying to avoid raising capital, so what we’re really looking for right now is a larger company (1,000+ employees) to adopt us for a year so that we can keep evolving the internal tooling and make sure it’s satisfying a real need. (If anyone is interested, send me an email.)

Best of luck :)

If you want the old school Fortune 500 folks you should take aim at Sharepoint. It's still how this kind of thing (internal corporate blogging) gets done at big old corporate beasts.

Do you even have a sharepoint add-in?

Thanks for the advice. We've been talking with a couple Fortune 500 companies who are using Exchange and Sharepoint, so if we end up building out an enterprise deployment for them then we'll probably end up doing this. I don't want to start building out enterprise stuff though until we have a paying enterprise customer who is asking for specific things. The product is good enough for enterprise, the real issue is just making sure the upload process is aligned with the workflows of people within the company so that way the effort and cognitive overhead of contributing is low enough that lots of documentation gets created.

> - You can now anonymize any message contributor.

[...]

> - Permission requests are becoming optional, at least for now. Previously we required permission for all non-anonymized message contributors, now there will be an option to publish stuff immediately and let people anonymize themselves later if they want. If this is excessively abused we'll re-evaluate this, but we've tried to build things to incentivize good judgment.

This is a really an abuse of trust. When I send an email, I expect it to exist for a certain audience that's it. If I wanted it to be public, I would have posted it on a public forum. It's not up to the recipient to decide what should be done with my content. I'm the one that decides that. If you want to get legal about it, as the author, the copyright is mine, not the person I send it to.

Not only are you running afoul of privacy, and abuse issues, you're running afoul of legal issues.

This is a really abusive idea.

> If you want to get legal about it, as the author, the copyright is mine, not the person I send it to.

Are you sure about this? I doubt that communication can be copyrighted. Once you sent me your email, it's mine, not yours.

Otherwise email forwarding in general is completely illegal.

This may depend on your jurisdiction but I'm 99% sure this isn't how things work in Germany.

First of all, the author retains ownership of the copyright. They can freely redistribute copies of what they have written unless they're subject to an active contract limiting their use of those rights (e.g. a time-limited exclusive license -- IANAL but AIUI there is no such thing as a permanent exclusive license unless you also get perpetually reimbursed).

So if you're sent a copyrighted work by its author, you may legitimately infer that you have the right to access it but you don't have the right to republish it or make copies accessible in any commercial way (like an ad-sponsored online platform).

Additionally communications are subject to privacy laws. So you may be in violation of the author's personal rights even if you publish their e-mails non-commercially because you violate their "reasonable expectation of privacy".

This is not entirely dissimilar to the case of "revenge porn" by the way: if you send your loved one an intimate picture for private use, you can not only ask that they destroy the picture at any point but they are also prohibited from publishing it without your approval. Of course in this case the violation of personal rights also stems from the fact the photo is a depiction of the author.

But if you really need a clear example, imagine you are sent the draft of the next Game of Thrones season (or what have you) by its author. Unless you have explicit permission, you have no reason to assume you would then be allowed to go on and publish that document. Even without an NDA there's likely a "reasonable expectation" you will treat it as confidential and you'd be in violation of that by passing it on.

Note that I'm talking about my understanding of German (and likely by extension EU) laws, not necessarily American laws. I'm well aware the US has different laws and I suspect those might vary on state level too.

I know US HN sometimes has a problem understanding consent and fair use, but those are essential if you want to intuit whether forwarding an e-mail is legal or not.

If you're not sure whether the author of an e-mail is okay with it being forwarded, maybe try asking them? If you don't think they'd allow you to (and there's no legal reason to ignore their wishes, e.g. to submit the e-mail as evidence of harassment), maybe you shouldn't?

Yes it can, emails that are more than a few words meet all the criteria for a copyright protection. So it's a case where not every email is copyrighted but almost all non-trivial ones are.

"Once you sent me your email, it's mine, not yours."

"Once you let me download Star Wars, it's mine, not yours."

Email forwarding in general isn't illegal. There are plenty of times where you could forward an email where there are no issues of copyright. Like an autogenerated notification for example, that email wouldn't be copyrighted at all. On the flip side if I send you a copy of my book in an email you certainly don't have the right to forward it as that would be an unauthorized reproduction. The question is generally where certain types of personal and professional communication fall.

Disclaimer: IANAL. This comment is not a substitute for legal counsel.

"Are you sure about this? I doubt that communication can be copyrighted. Once you sent me your email, it's mine, not yours."

If you and the recipient both reside in countries which are signatory to the Berne Convention, then this is very much incorrect. Copyright is automatic, and goes to the author. The medium by which I distribute my copyrighted works does not somehow invalidate that automatic copyright.

"Otherwise email forwarding in general is completely illegal."

In a strict sense, yeah, probably. This is why the FSF and OSI don't consider programs without any license to be suitable for FOSS: in the absence of a license, most countries - thanks to the Berne Convention - assume no permission from the copyright holder at all by default unless otherwise established via a license agreement.

Of course, the average person is not going to start suing you for every email from said person you've forwarded without explicit permission; indeed, the average person probably won't know you've ever violated that implicit copyright at all if you're only forwarding it privately. That dynamic changes entirely, however, if you then go on and publish that email as part of a blog post.

Well... it is weird. I kinda like that.

I recall an app that (I want to say it was for Mac) that turned the trash into a recycle bin and actually "recycled" the content in the sense that files were then sent to other users to look at and if they took them out of the trash the file was gone for everyone else (as if it was a physical print out).

It was kinda neat... weird... probabbly a security nightmare... but interesting.

The security story will definitely be better once we have the plugin, but it's already quite good. So under the current read-only OAuth model:

- Tokens can only be used from our servers, and their use is logged by both us and Google

- Tokens are rate limited on Google's end, both per user and per app.

Both of these combine to make any sort of large scale breach essentially impossible. We also don't access and store any email messages until you've already chosen to publish them, and even then they're stored encrypted unless they're publicly accessible. (E.g. the remain encrypted if not everyone gives permission or if you're publishing with a private repository.)

I filed a feature request ticket with Google asking them to log when an app accesses a full message, so that way we can prove that we aren't accessing any emails except the ones you choose you upload. So we'll see if that gets added.

We also have very extensive tests for everything privacy and security related on the back end, which helps.

The main thing to note is that we're explicitly not designed to be a platform for whistleblowers. One of the design decisions we made is to associate threads with email addresses rather than usernames. This is useful because it let's people give permission or anonymize themselves without first making an account, and then later have their threads associated with their account. Great for usability, but it also means that if you want to be an anonymous whistleblower there are other platforms that are better suited for that.

Anyway once we have the Gmail Add-on, that will make it so we only have read-only access to the currently active thread where you activate the add-on. It's only a couple weeks of work, right now I'm just hoping we can get Google to add a couple more API wrappers so that we don't need to write any new code to parse threads.

I would like a way to proactively opt out of your application/service, so that there is no chance you ever host an email thread I'm on. Do you provide some mechanism for this? Frankly, I'll take legal action if one of my emails ever ends up on your site.

If there’s a need for this we’ll build it. Right now we’ve had a bunch of people express concern about getting too many permission requests or about having emails they don’t want posted without their permission, but neither scenario has materialized yet.

The other option would be to have threads go live in X hours unless someone opts out. Right now our main goal is to have the permission options be clear, intuitive, and consistent so that people start to build up a mental model of how it works.

"If there’s a need for this we’ll build it."

There's a need for this. Please build it.

"neither scenario has materialized yet."

Well yeah, it's a young product. Only a matter of time before it's abused.

"The other option would be to have threads go live in X hours unless someone opts out."

Substitute "hours" with "days" and I might be okay with this. "Hours" is way too short.

I’m really impressed by the email parsing success. How did you tackle the hellscape that is parsing replies out of emails?

Thanks! I didn't really understand all the email specs when I started working on the parser, so it was mostly written using guess and check.

For plaintext emails without forwards, we use a slightly modified version of Email Reply Parser to strip replies. We made a couple changes so that messages with inline replies aren't stripped.

The next step is running everything through through BeautifulSoup. We use this to strip out most of the garbage from the HTML and rewrite it to make it beautiful. For example, paragraph text within divs gets unwrapped and placed within paragraphs. And text within divs that's styled to look like blockquotes gets placed within actual blockquote elements. This is not only good for SEO, but makes it easy for us to normalize the typography and style across threads to create a consistent reading experience.

There's also some logic here for formatting emails from things like Zendesk and Mixmax correctly. And this is also where the highlighting and redaction get applied.

Right now we just unwrap text within tables and place it in paragraph elements, I need to change this algorithm a little though to allow actual tabular data.

The next step is running the text through Bleach, first to linkify any plaintext URLs (and sanitize URLs), and next to remove all the remaining markup and attributes we don't allow.

Then you enter the death field of regex. The algorithm we use to unwrap text within divs and tables creates some extra whitespace before and after the newly created elements, so when you have nested divs and tables some of this needs to be stripped. We also strip out semantically invalid markup and empty elements. E.g. there is a lot of stuff that looks vaguely like this:

body = body.replace('<li></ol>', '</ol>')

The last step is that we run everything through BeautifulSoup again to make sure the whole thing is idempotent. I hear this isn't the Computer Science approved method of guaranteeing idempotence, but in this case it works. (Basically there are just a couple cases where the regex can lead to having unbalanced tags, so we need to make sure it's valid markup again.)

Overall the whole process is pretty easy to read and understand, and it generally produces better results than Gmail so I'm pretty happy with it. If we were processing millions of emails per hour I'd probably put more work into making it more efficient, but for now it's fast enough to feel instantaneous even for threads with dozens of messages.

Cool, much thanks for the detailed reply!

Certainly intriguing. I _really_ like the notion of automatically correlating and tagging work emails to internal business content, or wiki. Not sure about the "public" tracking side of the site.

Both of us come from situations where this product would have saved so much time and energy in a business setting. It really influenced our design of the org and repo features. Let us know if you have any questions or want to kick the tires in an organization setting.

hello@fwdeveryone.com

I registered and verified my email address, and then tried to log in only to find it didn't accept my password. The "reset password" doesn't respond or do anything so I'm unable to log in or reset my password.

Please reach out to myself or Alex to get this worked out:

alex.krupp@fwdeveryone.com alex.sheehan@fwdeveryone.com

The reset password button should send an email, there just isn't currently a modal giving any indication that it did anything. The front end is currently in a feature freeze until we finish the React re-write, but then we'll fix this.

In general though there is no max length on the passwords and all characters are valid.