I think that besides having some sort of TOS, people should check who is behind the application. There was never a mention of who developed Twimailer, which from the beginning looked suspicious to me. On the other hand - you can easily tell who is behind Topify, Twitterfeed, Twittercounter and many other popular Twitter applications. You can trust these application because you know that their creators will never risk their reputation for quick money or dubious acts.

Arik

When this was originally developed we never considered there to be any security issues with twimailer. After all, all you're doing is changing your default twitter email and not handing over any of your login credentials.

This was also before twitter flipped the oAuth switch on so when this was developed there really was no other way around it.

It was later suggested that this could still *potentially* be a risk regarding twitter password resets. This was obviously NEVER our intention.

"Twimailer also never notified its users about the sale."

Actually, they were. From what I understand the new owner sent out an email to all twimailer users.

Thanks for the original writeup and for continuing to follow the story. Luckily, now twitter has rolled out oAuth this kind of thing will no longer be an issue.

The issue is that you sold this application without being transparent to your users. This is unrelated to the oAuth implementation you are evoking. This is not a security debate but a trust debate with users.

I see you have experience in selling apps you are building (like Twollow and Twitority). i assume you should be aware of that

This is why i switched from Twimailer to Topify

thanks to this blog for bringing some light

http://factoryjoe.com/blog/2009/03/04/how-to-use-twimailer-securely/

By the way if any Read Write Web reader would like to try topify here are 50 invites

http://www.topifybeta.com/invite.php?id=b93559b3f3d4a4d2176c040519bf2d83

Ouriel Ohayon

How about OAuth for Topify then. And what guarantees are you offering that you aren't going to be EVIL?

Now visiting Twimailer.com results in a MySQL error.

I suggest anyone who had changed their Twitter account's registered email to the one Twimailer provided, restore the email address as soon as possible.

First of all I want to point this: my conversation with Arik was a private one so he shouldn't have made it public. He's been playing dirty from the beginning.

Also, saying bad things about your competition isn't good business practice. In fact, our sign-ups grew with 10% since Arik started talking bad about us.

As you can see on http://mvdmedia.ro I have more than 20 projects and I'm working on 3 new ones so this was the real reason to sell.

Since I've been thinking of our users I've tried to let them on the good hands of Topify. But I think they're afraid of growth :)

When you emailed us you never asked not to share the conversation. Besides that all of the information we posted is publicly known - including the information about the sale, the fact that Twimailer's Twitter account was suspended or that you have issues lately.

As for the email that every new user gets - it says that you're invested in Twimailer rather than bought it. For new users it doesn't have much difference, but for the already exiting users it does have a significance the choice of words.

And we don't delete comments from our blog. It was marked as spam by Disqus (see here: http://twitpic.com/2zu99) - maybe it says something about you...

Good luck with your projects.