Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After self-hosting my email for twenty-three years I have thrown in the towel

cfenollosa.com

Post reply on HN
Print view View original

191–200 of 744 posts

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#191

Post by orev »

oynqr wrote: post #168
LinuxBender wrote: post #140

Earlier quoted context omitted.

It could be we have different circles of acquaintances. I have managed to get non technical friends to GPG encrypt their emails. I also talked 2 lawyers into using this and the two lawyers are not only non technical but have nearly zero patience.

I guess a lawyer might know a thing or two about confidential messages.

I think you’d be very surprised at how much lawyers don’t know or care about any of that. They store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents).

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#192

Post by lolinder »

gpapilion wrote: post #164
lolinder wrote: post #79

Earlier quoted context omitted.

The paradox here is the same one patio11 discussed in "The optimal amount of fraud is non-zero", on the front page yesterday [0]. The more non-tech people have an email address, the more we have to prevent fraudulent email, and the harder it becomes to run your own email address. The original email users were much more savvy and needed less protecting against fraud. Now my grandma has an email, and if we're not caref…

I actually would rephrase it as there weren’t enough users with money to make using email a worthwhile scam medium. Email is low trust and almost any user is susceptible to being scammed, because there aren’t good trust markers in emails, and companies use it in ways that make it indistinguishable from spam.

I think both are true. The kinds of scams my grandparents (and even parents) fall for are trivially recognizable as scams to me. It takes more work to defraud someone who knows more about the way thing are supposed to work.

But yes, it's definitely still possible for anyone to fall for more sophisticated scams, and there being more money to be had is a huge part of it. Either way the effect is the same: more protection is necessary than was before.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#193

Post by Avamander »

teddyh wrote: post #147

E-mail is complicated, sure. But I’ve had it up to here with people who give up running their own server and then go on to vastly exaggerate how infeasible it is, in order to placate their own conscience. It’s not that they’ve gotten tired of doing it, oh no; (they say,) it’s entirely the fault of Google, Microsoft, etc. who’ve made it literally impossible to run your own e-mail server. Except it’s not impossible – l…

How is BIMI "monopolizing"? It's a trivial DNS record.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#194

Post by Avamander »

kortex wrote: post #183
jacobsenscott wrote: post #88

It was a huge mistake for email receivers to take on the cost of filtering spam. Of course given the evolution of the internet and email it is easy to see how that mistake happened. Nobody had a crystal ball. But the only solution here is to raise the cost of sending email to the point where spam is no longer profitable. It seems like one solution is to bcrypt hash (or some similarly expensive algorithm) the email an…

That is a clever idea but I think it'll still fail so long as email (SMTP) is a fire-and-forget architecture. As long as you have that asymmetry, your SNR is going to suck. If it were a back-and-forth protocol, more like TCP, then you have way more options for congestion control, error reporting, load balancing, and the like. The server can choose to accept the incoming request, ask for more verification, or interrog…

> If it were a back-and-forth protocol, more like TCP, then you have way more options for congestion control, error reporting, load balancing, and the like. The server can choose to accept the incoming request, ask for more verification, or interrogate the client in various ways.

That's basically what graylisting aims to achieve.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#195

Post by marvel_boy »

LinuxBender wrote: post #118
eikenberry wrote: post #55

Earlier quoted context omitted.

There is also a happy medium. Host your own MX servers but use someone else's SMTP servers. You have complete control over the incoming mail but dodge the filters by using the established business for sending mail.

Adding to the happy medium is to teach your friends and family to use Thunderbird so they can easily GPG encrypt [1] their emails keeping the nosey email providers off the email body. Also teach them to use the IMAPS (TLS) endpoint for their mail provider, usually port 993. There are probably simpler how-to's with pictures, I just do not have any of them handy. [1] - https://support.mozilla.org/en-US/kb/openpgp-thund…

Apple supports encryption on Mail:

https://support.apple.com/en-gb/guide/mail/mlhlp1180/mac

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#196

Post by LinuxBender »

oynqr wrote: post #168
LinuxBender wrote: post #140

Earlier quoted context omitted.

It could be we have different circles of acquaintances. I have managed to get non technical friends to GPG encrypt their emails. I also talked 2 lawyers into using this and the two lawyers are not only non technical but have nearly zero patience.

I guess a lawyer might know a thing or two about confidential messages.

They do. Most of them use proprietary https web interfaces that usually have "secure email" or "secure messaging" in the description but they are just fancy web portals. I despise those systems. The content is not encrypted at rest and can be leaked. With OpenGPG the emails are only decrypted on the recipients end points and can be deleted by request.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#197

Post by JumpCrisscross »

orev wrote: post #191
oynqr wrote: post #168

Earlier quoted context omitted.

I guess a lawyer might know a thing or two about confidential messages.

I think you’d be very surprised at how much lawyers don’t know or care about any of that. They store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents).

> store stuff in the cloud without ever having heard of the Third Party Doctrine (which allows the US government warrantless access to those documents)

Or because they know the third-party doctrine doesn’t apply to attorney work product and privileged materials.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#198

Post by toun »

The topic often comes up. Can't say I share the experience. My servers have never been put on a blacklist in the 7 years they've been running, and one of them operates from my residential DSL connection. Standard postfix+dovecot stack on an Archlinux VPS, I log in once a year to update the packages and make sure there is enough disk space left.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#199

Post by zikduruqe »

Avamander wrote: post #180
briandear wrote: post #171

Earlier quoted context omitted.

Apple mail support GPG easily. No need to use Thunderbird.

Can you please provide a few references to that claim?

They might be talking about S/MIME.

I use https://github.com/Free-GPGMail/Free-GPGMail which is a plugin for GNUPG, without the "support" plan.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#200

Post by teddyh »

Avamander wrote: post #193
teddyh wrote: post #147

E-mail is complicated, sure. But I’ve had it up to here with people who give up running their own server and then go on to vastly exaggerate how infeasible it is, in order to placate their own conscience. It’s not that they’ve gotten tired of doing it, oh no; (they say,) it’s entirely the fault of Google, Microsoft, etc. who’ve made it literally impossible to run your own e-mail server. Except it’s not impossible – l…

How is BIMI "monopolizing"? It's a trivial DNS record.

https://news.ycombinator.com/item?id=28196403
Post reply on HN