Re: gmail+imap+smtp (oauth2)

[Tim Cross]

Richard Stallman <rms@gnu.org> writes:

> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
>   > I disagree. The spec is open and anyone can implmeent it in any language
>   > they want and can license it according to any license they want.
>   > Google's implementation may not be open, but someone else could just as
>   > easily write an implementation which is. 
>
> I have to point out that whether a protocol is "open" is not what we
> are concerned about.  We do not advocate "open".
>
> Our concern is whether the Oauth2 protocol can be used to communicate
> with Gmail without using any non-libre software.
>
> Free (libre) and open are different ideas and not equivalent.  See
> https://gnu.org/philosophy/open-source-misses-the-point.html.

The answer is yes. You could implement an oauth2 client which would not
require running any non-libre software. However, this does not solve the
issue of the application ID being secret. This is essentially what
thunderbird have done (and it looks like, ignored the application ID
secrecy issue).