81–90 of 96 posts
Could anyone recommend a hosted email service that does not allow spying on users? Alternatively I wonder what Bruce Schneier recommends? Do you have to host your own email server?
Another option is to give a certificate to your contact and send all conversations encrypted.
edit: oops, I did not notice bhousel's post (posting the same in other words)
"The rumor that China used a system Google put in place to enable lawful intercepts, which I used as a news hook for this essay, has not been confirmed. At this point, I doubt that it's true." http://www.schneier.com/blog/archives/2010/02/more_details_o...
Could anyone recommend a hosted email service that does not allow spying on users? Alternatively I wonder what Bruce Schneier recommends? Do you have to host your own email server?
Earlier quoted context omitted.
Hear hear! I use a similar set up, and it truly is great. It's even caused me to seriously consider a service that sets up a Linode for people that wants something as awesome.
Yeah, I've been sorely tempted to make a Stackscript for this setup and make it public. There are two downsides: it's at least $20 a month to do it, and having your own mail server really isn't quite a set-it-and-forget-it deal. It requires an amount of attention that wouldn't make sense for a lot of people (or businesses).
I'm surprised by how many businesses (even small ones) don't run their own mail server, or at least have a proper outsourcing arrangement rather than just using a public service. We run our own (well, I run our own...) because we work with banks and all contracts we sign with them have clauses regarding where information from them gets stored and who could possibly have access to it - this is to protect their data in instances where we might be sent (intentionally or otherwise) information about some of their employees or customers. I'm guessing a great many businesses work with clients who have similar concerns so those clauses will be present in contracts that have signed too, so using a "public" service like gmail or hotmail just isn't compatible with them - we can't make any demands to Google about who can access what on their servers or audit them.
No business should use a public service like that and leave the mail on it. This isn't a dig at the public services like gmail, as they provide a valuable resource for those the resource is not wrong for, but they can not provide the accountability I would expect to be able to provide my clients as a business. Businesses should (IMO, and in order of preference) run their own server, use a service that has some contractually enforced security guarantee, or pull down the mail to local systems rather then leaving it on a public server - otherwise they can have no hope at all of controlling who can access their (potentially confidential and sensitive) mail.
Aside from the data security issue there are other potential problems that should be concerned about. If a public services goes down there is nothing you can do to help a fast recovery and you will not be their priority: your services will be available again when it is available again. Also you need to implement a good backup system no matter what you chose - you should not (as many people do) rely on a single service for both your live mail handling and backups.
The $20/month is nothing to a business (or should be), but you are right in that a mail server should never be considered a set-and-forget system so there will be technical resource cost involved with running a mail server and dealing with possible issues like "friendly fire blacklisting" so a reputable outsourcing arrangement would be more cost-/manpower- effective for many small businesses.
FYI: we currently use Zimbra's "community edition", though at some point I'd like to convince the powers that be that using the paid edition would be worth it for the support (there has never been an issue I can't resolve, and there is never likely to be, but I'm not here 24/7 and don't have someone with the right skills to delegate the job to when I'm not around). It is more resource hungry than Postfix+Dovecot+RoundCube though so needs significantly more the linode's $20 VM product to be usable, but I recommend people give it a try as its single install removes the need for you to perform any integration work putting a stack together and the feature set aside from email is no unattractive either.
I run my own mail server with a roundcube frontend interface, for $5 a month (if that) on Amazon EC2. What's the point of SSL in Gmail if Google has your certs?
How well does outgoing mail work for you?
Amazon EC2 IP ranges are considered a large enough source of spam for many people that they are blocked wholesale.
Earlier quoted context omitted.
Hear hear! I use a similar set up, and it truly is great. It's even caused me to seriously consider a service that sets up a Linode for people that wants something as awesome.
Please do! I think something like this could be valuable to a lot of small to medium companies who atm can't resist subscribing to Google Apps (50,- per user you could have instead). I think with a service like that, the main goal would be to stay as simple as possible while still offering the "Exchange" integration with people's current infrastructure. I would do the user side web frontend last and concentrate on a…
Some people on this discussion mention that they simply run their own mail servers -- that's dandy for incoming mail. But how do you guys make sure your outgoing mail is not blacklisted/ignored/considered spam? That's been a non trivial problem for me in the past when I was running a mail server (and spam was not such a big problem back then). Also, is there any mail server you can run/recommend that has gmail-speedy…
Despite not doing much beyond SPF, I have never had any problems dealing with my outgoing mail being blacklisted/ignored/considered spam.
Downtime has not been a serious issue for me as my host (Linode) has generally been very reliable. Most of the downtime my mail server has experienced has been due to me. If having 100% mail uptime was really important to me, I'd set up a secondary server at a different data center.
For backups, even though Linode offers backups, I use Amanda to back up everything to my local backup server.
For security, I allow TLS connections, but relatively few servers eagerly try to encrypt connections. I also use full disk encryption on my server. Ultimately, I think that if you have sensitive information to e-mail, you cannot rely on the mail system to protect it. You should rely on something like GPG to encrypt the contents of the e-mail.
As far as searches and tagging go, that's really a mail user agent problem. So that needs to be solved either in your webmail or mail client software. I do run maildrop to do some preliminary sorting on a lot of my e-mail. It's a program similar to procmail, but it works my virtual mailboxes.
In the end, running my own mail server has been a good experience. It took some time to get it properly configured, but running it day-to-day hasn't been much of a problem.
I use PostfixAdmin to manage things like adding new mail aliases. It's pretty easy to use. My wife, who is tech-savvy but doesn't know anything about running a mail server, uses it to manage her own mailboxes
Earlier quoted context omitted.
Hear hear! I use a similar set up, and it truly is great. It's even caused me to seriously consider a service that sets up a Linode for people that wants something as awesome.
Yeah, I've been sorely tempted to make a Stackscript for this setup and make it public. There are two downsides: it's at least $20 a month to do it, and having your own mail server really isn't quite a set-it-and-forget-it deal. It requires an amount of attention that wouldn't make sense for a lot of people (or businesses).
I am a linode user myself and I was interested in setting up a mail server of my own for personal use, but I will admit I don't know much about it.
Earlier quoted context omitted.
How are your backups? And what happens if it goes down for a few hours? Would you not get that mail?
> How are your backups? A server in another data center does differentials of the entire mail server every hour on the hour, and weekly fulls. Differentials are stored for 14 days and weeklies are stored for 120 days. If a customer accidentally deletes an individual message, we can probably restore it; if a customer nukes their entire mailbox, we can restore it. > And what happens if it goes down for a few hours? Wou…
Basically it adds another address as alternative for delivery for your domain. That server is configured to forward the mail to your primary server or hold it until it comes up again.
Works great, and you could even use it as a spam filtering option, since legitimate servers should only try the first server, but a lot of spammers use the second one thinking that it probably has less spamfiltering or something.
Earlier quoted context omitted.
Yeah, I've been sorely tempted to make a Stackscript for this setup and make it public. There are two downsides: it's at least $20 a month to do it, and having your own mail server really isn't quite a set-it-and-forget-it deal. It requires an amount of attention that wouldn't make sense for a lot of people (or businesses).
Do you mean from a security perspective, such as keeping software on the stack at the latest versions? I am a linode user myself and I was interested in setting up a mail server of my own for personal use, but I will admit I don't know much about it.
Probably my number one time sink on the mail server is, "Where is the email from X that I've been expecting?" A close number two is, "I'm getting too much spam." If you're paying for hosted email from someone else, you can just give them a call and make it their headache. If you're doing your own, it's your own headache, and it's a headache that can easily consume a few hours at a time.
You also should regularly check in with various system and software logs, to make sure that someone isn't trying a novel new attack against the mail server, or that a process isn't struggling for some reason.
Most of the software does a pretty good job of being rock-solid, so I don't find myself having to tune things all the time or nudge dead processes or anything. But, I did find that if I left the mail server alone for a while, then when something did go wrong, it took me a lot longer to resolve it (I think mostly because I'd forgotten where everything was), which is not what I want in a downtime situation.