Viewing profile — robn_fastmail

I don't know about bounties, because I'm not personally in favour of vigilantism, but I do take your point. Honestly, I think the ease in which people can be anonymous is major pro…

Generally, we talk about what we're doing because we're all excited about what we do. It's always been that way for us, and our customers really appreciate the honesty and transpar…

Quite. As my dear colleague said this morning, "hubris" is the word of the day. Still, I'm not sorry we posted it.

Datacentre confirmed a DDoS attack, which took a little while to mitigate. We're looking good now, but we're continuing to monitor.

Indeed. As I note in the post, this wasn't something we _needed_ to do at that time, we were just curious. Replacing a function with a faster implementation is trivial; its just an…

The results in the tests are all with optimisations (-O3 -march=sandybridge -mtune=intel), as mentioned in the post. The exception is the Debian packaged version of zlib, because w…

I think that mostly, your benchmarks have to match your workloads. Most of the CRC32 benchmarks I've seen are looking at larger buffers. The xxhash function mentioned elsewhere in …

Same day, in fact: https://git.cyrus.foundation/diffusion/I/browse/master/lib/c...

My quick tests here (using the same methods outlined in the post) suggests its around 30% faster on 64-byte buffers. If we're ever shopping for a new hash function entirely, I'll m…

They do work, but only if you upload them via CardDAV - we don't have any UI for them in the web client yet.

Not a chance :)

In what way do you consider the privacy policy cavalier? What would you prefer it said? I don't believe we made any claims that Australia is a "privacy Eden" or that we're "paragon…

Maybe. They'd have to issue that warrant to our datacentre operators though, not us, because there's nowhere to send the documentation. And then they can compel our datacentre not …

Yes, we're an Australian company. https://www.fastmail.com/about/company.html

Dumb storage is fine if you only have a single actor that can maintain a copy of the state at all times. As soon as you've got multiple actors on the data (another client on your d…

> JMAP server implementations probably will require a good database, not just a dumb FS like in remoteStorage. To do JMAP well you need to be able to calculate change sets, which d…

No, because it's an actual application. Edit this and submit a PR: https://github.com/jmapio/jmap-perl/blob/master/htdocs/index...

If you want a laundry list of SSRF methods you should protect against, a great place to start is this slide deck from a talk at ONsec a couple of years ago: http://www.slideshare.n…

Done: http://jmap.io/software.html

There's not much around yet. The only things that are in any kind of usable/complete state are the proxy, the demo client and the JS client library, all mentioned in the original p…

I don't believe there's anything in it that would prevent that. If you squint, the auth exchange looks a lot like SASL, and that supports pretty much anything. This is something we…