Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Hostile Email Landscape

liminality.xyz

Post reply on HN
Print view View original

151–160 of 251 posts

Re: The Hostile Email Landscape

#151

Post by [deleted] »

bachmeier wrote: post #129
grey-area wrote: post #113

Everyone seems to agree that email is broken (and yet incredibly useful and almost universal in reach). So moving on from there, how do we fix it? Who is currently working on fixing it? What would a new protocol look like?

Chat services such as Slack, and social media like Twitter, are excellent ways to communicate. It's pretty simple. If you implement a request system so that both parties have to agree to let the other send messages, all of the problems are solved. There's no good reason that we need a system that allows anyone to send an arbitrary number of messages to anyone else.

[deleted]

Re: The Hostile Email Landscape

#152

Post by z3t4 »

I guess big providers has to deal with "newbies" all the time, that don't know how to configure their server and run open relays. And don't know how to add extra headers etc.

That said, silently dropping messages without a notification is probably illegal! And pretty serious! So if you know what you are doing (and you are not a spammer) you should send a cease and desist!

Just make sure you use double opt-in and that providing an e-mail address in sign-ups/etc is optional!

Some will however put your mail in a spam-folder and it's not much you can do about it, just hope your readers complain to their provider.

So basically: setup your smtp relay correctly! Make sure you are not on any black-lists. Add extra headers like dkmi / precedence, add spf (don't froget ipv6) and ptr. Add your relays to white-lists. Publicly publish a privacy and e-mail policy (important! with opt in and optional clause); Link to them and fill out some "email provider" forms at gmail/microsoft. Send out a bunch of test mails. This will take a whole day, but if you do this, you will have no problems unless your IP or domain is perma-banned.

Re: The Hostile Email Landscape

#153

Post by cortesoft »

z3t4 wrote: post #152

I guess big providers has to deal with "newbies" all the time, that don't know how to configure their server and run open relays. And don't know how to add extra headers etc. That said, silently dropping messages without a notification is probably illegal! And pretty serious! So if you know what you are doing (and you are not a spammer) you should send a cease and desist! Just make sure you use double opt-in and that…

There is absolutely no law that says you have to accept an email, nor that you have to send a notification if you don't. A cease and desist?! Are you kidding?

Re: The Hostile Email Landscape

#154

Post by k2enemy »

The anti-competitive consequences of this are really interesting. Does anyone know if there are historical statistics on email provider market shares? It would be interesting to see how things have changed over time.

Re: The Hostile Email Landscape

#155

Post by lsc »

unclebucknasty wrote: post #150
lsc wrote: post #125

Earlier quoted context omitted.

>And, of course we attempted to identify the problem with the third party. If you read more carefully, you'll find that in my comment. Only after they insisted their classification was correct and refused to remove us from the list did we explore our legal options. My point here is that the recipients of the email and the senders of the email have very different ideas as to what constitutes a "correct evaluation." -…

You are really missing the point here and you have some key assumptions wrong. > recipients of the email and the senders of the email have very different ideas What does that mean? They sign up for our service and expect to get e-mails from us, which they don't receive. We have the same "idea", but the third-party is interfering with that "idea". > if the recipients can't complain, that's a problem I will repeat that…

>What does that mean? They sign up for our service and expect to get e-mails from us, which they don't receive. We have the same "idea", but the third-party is interfering with that "idea".

That's not quite how it works from the end-user's perspective.

Say I buy a product or service from you. Of course, you send me billing emails, etc. and that's fine.

The problem is that companies take this further and start thinking they have the "right" to send all sorts of garbage to that customer.

Now, they of course let the customer opt out... if the customer is willing to spend ten minutes digging through their interface. But most don't.

I know you love those newsletters; they make you money. But don't kid yourself that your customers do. Many are going to click 'report spam' if you send too many. Even if it's not spam by the definition that marketers use, it's still very clearly unwanted email, and marking it as spam is so much easier than going through the unique-to-you opt-out procedure. And if your list is like most, some of the members signed up years ago (or bought something from you years ago) and long ago forgot doing so, so of course they are going to mark it as spam.

If you want to send email to your customers, you need to understand this.

Note, I'm not saying that you can't send that email; you can. I send email to my customers, and some of it borders on being "newsletters" - I'm just saying that you need to be aware of the cost- that cost is that it will annoy some of your users. Getting your email marked as spam is only one part of that cost.

>Even if recipients did know about the third party, do you know the switching costs of e-mail? And, you're suggesting that we should wait until all of our affected members get fed up and change providers (hoping that provider doesn't use the same service, etc.)? All of this, when the problem is obviously being caused by the third-party's error, yet they have no responsibility?

My point is that third party has no responsibility to you. They have a responsibility to their customers, but none to you.

Re: The Hostile Email Landscape

#156

Post by thoughtexpt »

lsc wrote: post #85
nabla9 wrote: post #59

Earlier quoted context omitted.

http://cr.yp.to/im2000.html Internet Mail 2000 IM2000 is a project to design a new Internet mail infrastructure around the following concept: Mail storage is the sender's responsibility.

Bernstein is an incredibly smart guy. But he's also an example of how the social stuff matters. His software would run the internet if he put a little more effort into the social/political side of things. The big problem with IM2000 is that it doesn't solve the real problems. It's focused on the economics of storage of mail, which, yeah, are a thing for a few mail administrators, but generally is considered less impo…

That his software does not "run the internet" does not make it any less good. It's there for whoever chooses to use it.

That he focuses on the software instead of pandering probably makes his software better than the alternatives that aim to please even the most foolish of users. At least I think so.

Maybe I interpreted the proposal incorrectly, but I always saw IM2000 (minus the "notifications") as a "pull" solution.

By contrast, conventional email relies on "pushing" spam to the recipient (in practice, a middleman called an "email provider").

A smart IM2000 recipient perhaps would not pull spam from the sender's server.

As such, the spam would never enter the network. It would just sit on the sender's server.

Therefore, IM2000 not only conserves storage but also conserves bandwidth.

Re: The Hostile Email Landscape

#157

Post by mhurron »

sydney6 wrote: post #126
tacon wrote: post #97

I've managed my own mail server since 1993, and my email address has been the same that entire time. Here are some tips for maintaining sanity: Greylisting still works amazingly well. With a long, long whitelist and greylisting plus DNSBL, I don't even bother running a spam filter, since the little bit of spam and emails from new senders ends up in its own directory as it came from a non-whitelisted sender. Comcast f…

One "could" have a VPS SMTP server transporting inbound mail to a mail server at home and relay outbound mail through e.g. Amazon SES via the same vps-smtp host. But still.. this is bullshit.

I have a VPS for sending, it is set up as a smarthost to relay from my internal mail server. It is included the SPF record for my domains along with MX records. I receive on my firewall at home, that host is what the MX record points at.

It is very easy to set up.

The full setup for inbound mail is - OpenBSD spamd (greylisting) -> internal postfix

Outbound is - internal postfix -> VPS postfix

Re: The Hostile Email Landscape

#158

Post by unclebucknasty »

cgriswald wrote: post #105
lsc wrote: post #93

Earlier quoted context omitted.

so... your customers were paying a third party to block you, so rather than working with your customers to figure out what the problem was, you threaten to sue the third party.

That's a rather glib and obtuse way to put it. I'm an Amazon customer. If Amazon can't reach my gmail address because Google started using some third party filtering service, what exactly would you expect me to do? Even if I had the ability, I certainly don't have the inclination to spend time resolving this issue. I'll go so far as to mark something "not spam", but that's about it. The cost to me of not hearing from…

Exactly. I would add though that it can be a customer problem too. For instance, when customers order from Amazon, they expect an order confirmation, and generally find it helpful. Likewise, if customers need to reset passwords, etc.

In fact, we learned of the problem when customers suddenly began to complain that they weren't receiving their password reset emails from us.

Re: The Hostile Email Landscape

#159

Post by motoboi »

McAfee Mail Gateway also uses a reputation, called GTI. Appliance hashes the message, looks up it on this online service and get back a score.

There is a KB explaining that new senders get a high score.

Re: The Hostile Email Landscape

#160

Post by geofft »

ryan-c wrote: post #112
geofft wrote: post #15

Earlier quoted context omitted.

Crossdomain web hosts are also a thing, and HTTPS works fine. (Sometimes with particularly hilarious definitions of "fine", like CloudFlare's former practice of putting dozens of customers' websites in the same certificate, via subject alternative names.) If you're worried about the fact that your mail host and web host can now impersonate each other, we can just define a new X.509 extension for "I can only be used f…

If someone spoofs a CNAME to evil.com in response to DNS query for google.com, your browser will not accept a certificate from evil.com as valid for google.com, whereas if you send mail to gmail.com and someone spoofs an MX record for mx.evil.com, a vaild mx.evil.com certificate will be accepted.

Right, so "don't do that." There isn't a clear standard for what subject to accept, out of the two options. The obvious correct one is to check for google.com, even if you're talking to a server named mx.google.com -- just as you don't trust CNAMEs and you check the original name, don't trust MXes either. It's just that most people don't have those certs configured in their mail servers, so doing that check today would lead to widespread failures and it's a bad default.

Postfix, for instance, lets you configure what it checks via the "smtp_tls_verify_cert_match" option. If you set it to "nexthop", it'll require google.com. The default, "hostname", will check against mx.evil.com.

http://www.postfix.org/postconf.5.html#smtp_tls_verify_cert_...

Post reply on HN