Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After self-hosting my email for twenty-three years I have thrown in the towel

cfenollosa.com

Post reply on HN
Print view View original

361–370 of 744 posts

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#361

Post by michaelmrose »

cowtools wrote: post #312
pas wrote: post #308

Earlier quoted context omitted.

signup confirm emails are like that. similarly, any "hello pls add me to your allow-list" emails could be made auto-disappear to the "will be deleted in 30 days" folder in ~10-15 minutes, so even if you get a 100 spam messages per day you only see the last of those, you can easily pick what you are looking for, and don't worry about the rest, they'll just disappear. (and you still have 30 days to look for messages th…

signup confirm emails are not what i'm describing, because you need to establish and filter the initial offer that they send you via email itself, which is still prone to phishing. What I'm describing is a situation where users themselves have to proactively subscribe to a connection using some sort of out-of-band mechanism. For example, if a website wanted to send you emails, they could produce some sort of "connect…

This is useless because users are stupid, people sending the mail are stupid, people getting the mail are stupid, UI people creating interfaces are so stupid society could be improved by putting them in a box and mailing them all to some wasteland and hoping they form their own society there or starve.

This would result in half the planet being frustrated all the time and the other half never getting their mail.

If your goal is to secretly destroy email this is the way.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#362

Post by thewebcount »

Totally naive questions:

Could we come up with a new protocol (possibly based on SMTP/IMAP/whatever), that would only guarantee to get your email to its recipient if you included some sort of token generated by the recipient and given to you? Something where you could text/message/whatever a unique token to a friend/business/etc. and then they can send you email? And if you email someone, your outgoing email includes the token necessary for them to reply? The contents (including who it’s being sent to) would be encrypted by default rather than being plain text that anyone in between sender and recipient (or at least sender and recipient servers) could read. Is something like that possible?

Obviously at first nobody would have it implemented, so you’d have to get developers interested in writing server and client software, and convince people and companies to use it instead of or in addition to regular email. But I wonder how many people would be interested in such a system and whether it would be workable?

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#363

Post by KoftaBob »

cowtools wrote: post #297
tinus_hn wrote: post #290

Earlier quoted context omitted.

Spam has been been fought for decades, you can rest assured any obvious solution has been tried and either doesn’t have the desired effect or is impossible to implement.

I think we ought to move email (or some future incarnation of email, like matrix) to a completely whitelist (opt-in to receive messages) basis.

That's essentially how www.hey.com works! I thought it would be tedious at first, but I don't mind it, and it's done a great job of making it so I only see what I want to see in my inbox.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#364

Post by patmorgan23 »

skywal_l wrote: post #218
jasode wrote: post #21

The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name and point the MX record to whatever hosting provider you want instead of self-hosting a server at home. Same philosophy for exposing a your personal blog of html files or content like mp4 videos. The sweet spot is to focus on buying a domain name you control. Then let Amazon S3, or C…

I am ashamed to admit that I have no idea how email works. Is there a dumb down explanation of what are the moving parts and how you can achieve that sweet spot?

Email is complicated but the jist is there are relays and mailbox/mail-exchanger servers (and email clients). And a million different anti-spam measures that make making sure people actually get you email difficult.

When you send an email you mail client contacts you mail-exchanger (MX) and drops the mail in your outbox. Then the MX will look up the MX record for the domains in the TO field and attempt to send the email to it using SMTP.

The first thing receiving server ussally does and look up the IP of the sending server and see if it's on a spam black list. If it is it will probably just drop the connection. Then it will look up the SPF record for the domain in the FROM address and see if the sending server is allowed to send that mail.

Larger email services will have an internal 'reputation' scoring system that will use data from reported spam to figure out what IP's and domains are sending spam emails and filter them out. They'll also look at if it's a residential IP, in an IP pool for a major cloud provider etc. Each provider has a different system and it can be really difficult to get a provider to trust your IP or whitelist your IP so you can make sure that your mail actually gets to who you're trying to send it to.

Relays are pretty simple they'll take email from one place and send it to the recipient. The mail exchanger usually has a built-in relay. A lot of people will use a third party relay service so they don't have to worry about managing the reputation of the IP of their sending mail server. They'll just add an SPF record for the relays service to their domain. And then configure their mail exchanger to send all outbound mail to the relay and then the relay will do the MX lookup.

A lot of mail services will also have their MX records pointed at relays. These inbound relays will often have a lot of those anti-spam services bolted onto them and they can also be used for load balancing to make sure that the service is always able to accept mail even if it doesn't make it in the mailbox immediately.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#365

Post by amelius »

jasode wrote: post #340
amelius wrote: post #320

Why can't we have an open source mail hosting solution that self-updates?

You've actually asked that question before and the answer is still the same: you can't embed "trusted sender status" into source code for a mailserver or a software package. The invisible rules for rejecting email is an emergent external property that exists outside of the software package : https://news.ycombinator.com/item?id=20853157 E.g. Software that "auto-updates" cannot solve the problem of how different parti…

Good catch :)

But I'm not completely convinced. Sender reputation is made up of at least two parts: the software (rules) used to send the emails, AND the actual emails sent, frequency of emails and number of unique recipients.

If you're a spammer you can still use the same software as everyone else, but your reputation will be bad because of the number of bad emails you sent.

In other words, if everyone used the same software to send emails, then anti-spam systems will have to use other metrics to blacklist people.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#366

Post by iam-TJ »

RunningDroid wrote: post #185
conradev wrote: post #72

Earlier quoted context omitted.

You can also use an MX backup service which will accept mail when your server is offline (and it will resend it when the server comes online) You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It's just a mailbox, after all

> You can also even keep Gmail as your MX server! Just move messages off of it as soon as they arrive. It's just a mailbox, after all Do you have more information about this? I've been looking to do something similar so that I can have my mail sorted into folders without setting up the same rules on multiple clients. (Gmail's sorting doesn't seem to support some of the sorting I'm currently doing in Thunderbird)

I've been hosting and operating my own MTA MX with Postfix since 2005. I have Postfix set to use "MailDir" format storage (one file per email) and then use Procmail filters to direct emails into per-sender or per-topic specific folders when they arrive on the server - nothing needed to be done in the email client. Dovecot provides the IMAP4 client interface. Thunderbird connects via IMAP4.

Each domain has its own user home directory so for each there is a /home/${domain_name}/Maildir/ directory as the base for storing emails, and each IMAP4 folder has an associated directory. Snippet:

  $ ls -1da  Maildir/.Technology.FOSS.Projects.Linux*
  Maildir/.Technology.FOSS.Projects.Linux
  Maildir/.Technology.FOSS.Projects.LinuxContainers
  Maildir/.Technology.FOSS.Projects.Linux.drbd
  Maildir/.Technology.FOSS.Projects.Linux.kernel
  Maildir/.Technology.FOSS.Projects.Linux.linaro.dev
  Maildir/.Technology.FOSS.Projects.Linux.linux-i2c
  Maildir/.Technology.FOSS.Projects.Linux.linux-input
  Maildir/.Technology.FOSS.Projects.Linux.linux-pci
  Maildir/.Technology.FOSS.Projects.Linux.linux-usb
Here's an extended snippet example from $HOME/.procmailrc that directs deliveries into the correct directory (IMAP4 folder):

  :0H
  * ^List-id: .*linux-usb\.vger\.kernel\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linux-usb/
  
  :0H
  * ^List-id: .*linux-wireless\.vger\.kernel\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linux-wireless/
  
  :0H
  * ^List-id: .*yaffs\.lists\.aleph1\.co\.uk
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.yaffs/

  :0H
  * ^List-id: .*util-linux\.vger\.kernel\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.util-linux/


  ### LinuxContainers
  :0H
  * ^List-id: .*lxc-devel\.lists\.linuxcontainers\.org
  $HOME/Maildir/.Technology.FOSS.Projects.LinuxContainers/

  ### Linaro
  
  :0H
  * ^List-id:.*linaro-dev\.lists\.linaro\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linaro.dev/

  :0H
  * ^List-id:.*linaro-kernel\.lists\.linaro\.org
  $HOME/Maildir/.Technology.FOSS.Projects.Linux.linaro.kernel/

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#367

Post by rnd0 »

mordae wrote: post #222
jasode wrote: post #21

The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name and point the MX record to whatever hosting provider you want instead of self-hosting a server at home. Same philosophy for exposing a your personal blog of html files or content like mp4 videos. The sweet spot is to focus on buying a domain name you control. Then let Amazon S3, or C…

You are totally missing the simple fact that the number of blessed email providers to choose from is slowly going down. I've seen ISPs with thousands of clients to give up and move the mailboxes to large players simply because their clients' email was ending up in the spam so often that running the support has gotten too expensive. It's definitely an anticompetitive practice.

>It's definitely an anticompetitive practice.

yeah, but in this climate what are you gonna do? It's not like there's any kinda recourse for monopolistic behavior that has any teeth to it.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#368

Post by GekkePrutser »

IgorPartola wrote: post #295
ratata wrote: post #270

Earlier quoted context omitted.

True. But they are not calling for a completely open system. I like this proposal from the author. > Change blacklisting protocols so they are not permanent and use an exponential cooldown penalty. After spam is detected from an IP, it should be banned for, say, ten minutes. Then, a day. A week. A month, and so on. This discourages spammers from reusing IPs after the ban is lifted and will allow the IP pool to be cle…

Is there any actually money to be made in hosting email for people? I genuinely don’t know but my suspicion is that GMail, Yahoo, Outlook, et al are loss leaders for their owner companies. I suspect people at those companies would be quite happy if the protocol got unfucked enough that it small players could participate without negatively impacting the network.

O365 web costs me 5 bucks per month and I only use it for a few emails a week so I doubt it's a loss leader.

If I'd actually use all of it a lot, sure but I don't.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#369

Post by pif »

Part of the problem is that the wrong people are complaining.

Using Google as an example, the author has no right to push anything to a gmail inbox. Google has no contract with the author to accept mail from him.

What Google is doing, it's failing its customers, the people who signed on gmail to have an address where other people could send data to.

And now those people are not receiving everything they could, but it's only up to them to decide whether this is actually a problem and whether it's serious enough to contact gmail support.

I do understand the point and the spirit of the author, but he is actually conflating the freedom of speech with the right to be listened to.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#370

Post by srkaplan »

mordae wrote: post #222
jasode wrote: post #21

The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name and point the MX record to whatever hosting provider you want instead of self-hosting a server at home. Same philosophy for exposing a your personal blog of html files or content like mp4 videos. The sweet spot is to focus on buying a domain name you control. Then let Amazon S3, or C…

You are totally missing the simple fact that the number of blessed email providers to choose from is slowly going down. I've seen ISPs with thousands of clients to give up and move the mailboxes to large players simply because their clients' email was ending up in the spam so often that running the support has gotten too expensive. It's definitely an anticompetitive practice.

I just randomly looked at 8 different emails in my inbox. All of them were from different email providers (except google which was there twice). There's hundreds or thousands of email providers you can chose from.

iphmx 1 google 2 kornet 1 linkedin 1 secureserver 1 amazonses 1 self hosted university email 1

Post reply on HN