Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After self-hosting my email for twenty-three years I have thrown in the towel

cfenollosa.com

Post reply on HN
Print view View original

371–380 of 744 posts

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#371

Post by almog »

> The industry should fix email interoperability before politicians do. We will all win.

Not sure if by "politicians" he means legislators, but given very few players that control today's email deliverability, while doing very little to provide observability (=feeback loop) to the users who needs it most (that is users who cannot afford to build an expensive pipeline that optimize deliverability), given all that, I think regulation around distributed protocols observability/fairness is not unlike AI explainability regulation, only I expect that with mail it shouldn't be as hard to implement.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#372

Post by quickthrower2 »

barrkel wrote: post #102
jacobsenscott wrote: post #88

It was a huge mistake for email receivers to take on the cost of filtering spam. Of course given the evolution of the internet and email it is easy to see how that mistake happened. Nobody had a crystal ball. But the only solution here is to raise the cost of sending email to the point where spam is no longer profitable. It seems like one solution is to bcrypt hash (or some similarly expensive algorithm) the email an…

Something different: a hash which is expensive to calculate but cheap to verify. E.g. calculating a string of bytes to append to a hash stream on order to produce a hash with a certain number of leading zeros; you provide the hash and the bytes, and it's trivial to verify.

Like cryptocurrency this will be a moving target. You would need a difficulty setting - but where as cryptocurrency only has to track one thing "total hash rate" this would need to track two things "minimum supported hardware for legit sender" and "hardware threshold for attacker to be successful with a mining rig they can afford, based on the income from the spam".

Each email provider might come up with different difficulty levels based on what they thing this is. So some handshaking might be required. And less computer literate people would be stressed why their email is taking 6 minutes to send. I think it would be hard to implement.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#374

Post by hug »

dane-pgp wrote: post #330
ratata wrote: post #270

Earlier quoted context omitted.

True. But they are not calling for a completely open system. I like this proposal from the author. > Change blacklisting protocols so they are not permanent and use an exponential cooldown penalty. After spam is detected from an IP, it should be banned for, say, ten minutes. Then, a day. A week. A month, and so on. This discourages spammers from reusing IPs after the ban is lifted and will allow the IP pool to be cle…

> I don't mind doing some paperwork or paying a fee to prove I'm legit. Then how about this: The big email companies all declare one day that any newly registered domain (with an MX record) needs to post a bond for good behaviour in escrow somewhere. If any of them find the domain being used to send spam, they can slash the bond (sending it to some charity or something). This has the advantage that it doesn't affect…

I can just imagine the headline. “Ask HN: Google sent my mail bond to charity for no reason and has torpedoed my small business, and I can’t get in touch with anyone to make it right”

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#375

Post by jasode »

amelius wrote: post #365
jasode wrote: post #340

Earlier quoted context omitted.

You've actually asked that question before and the answer is still the same: you can't embed "trusted sender status" into source code for a mailserver or a software package. The invisible rules for rejecting email is an emergent external property that exists outside of the software package : https://news.ycombinator.com/item?id=20853157 E.g. Software that "auto-updates" cannot solve the problem of how different parti…

Good catch :) But I'm not completely convinced. Sender reputation is made up of at least two parts: the software (rules) used to send the emails, AND the actual emails sent, frequency of emails and number of unique recipients. If you're a spammer you can still use the same software as everyone else, but your reputation will be bad because of the number of bad emails you sent. In other words, if everyone used the same…

>In other words, if everyone used the same software to send emails, then anti-spam systems will have to use other metrics to blacklist people.

Right, and the "other metrics" is what spam heuristics already use now.

In other words, you replied to this author's problem with "self-updating software" but software cannot solve his outgoing email getting rejected/spamholed. It's those "other metrics" that made him give up running his mailserver from home.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#376

Post by baskethead »

Nah. I'm glad that people like the OP are squeezed out of sending their own email. I have no problem with an email oligopoly at this point.

For every "good" email server owner, there's probably a million bad ones. And the problem of spam is a big one. If you want to send your own email, get used to telling people to check their spam lists and/or add your email account.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#377

Post by chrismeller »

prox wrote: post #344
chrismeller wrote: post #342

Earlier quoted context omitted.

Substitute “HTTP” with “SMTP” and you already have that today… SMTP in plain text isn’t generally used anymore, it’s always transported over TLS. Of course you can run whitelist-only, but how is that ever going to work? SMTP is text based and we’ll defined, so I would also argue that the transport being “simpler” is nonsense.

Whitelist is easier. If I added an mail of a friend in this system, we can communicate. Everything else goes blackhole. Nothing is easy about email! Having worked for years just to get reliable in and outboxes is definitely not trivial. Also SMTP is a system out of your control if you want anything verified and actually delivered.

Of course whitelist is easier, but how valuable would your email be if you only allowed your friends to email you? Goodbye order confirmations, subscription reminders, recruiter emails, notifications…

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#378

Post by pas »

armchairhacker wrote: post #156

I support the author but let me tell you a counterargument I don’t think he devotes enough to: Spam is a real issue. The amount of spam emails which get sent are absurd and likely orders of magnitude more than non-spam . And spammers do a lot to mimic real emails, including just hacking legitimate addresses and adding them to botnets. Even on gmail, I still get spam sent to my inbox. Fortunately very rarely, but it s…

email spam is not a real issue. big uncooperative gigacorps fucking it up for everyone is.

responsibility for spam (and other kinds of abuse) can be delegated via simple reputation scoring for netblocks, sender authentication and a proper feedback mechanism along the chain.

when the user clicks "spam" gmail already uses that to train their fancy AI and if you are not a small nobody, then they already alert you that ooops you sent something spammy via a feedback loop [1]. (see also how Mailchimp proudly claims they work with big integration partners like gmail ... https://mailchimp.com/help/how-mailchimp-prevents-and-handle... )

whitelist clearinghouses exist [2] but they are not terribly useful, because there's most of the signal to use for reputation is hidden :/

[1] https://en.wikipedia.org/wiki/Feedback_loop_(email) [2] https://www.dnswl.org/

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#380

Post by flomo »

klabb3 wrote: post #243
klibertp wrote: post #203

Earlier quoted context omitted.

This indeed looks like a good direction. A decade ago Freenet (not sure if it still exists?) had a problem with spam on its equivalent of USENET. It was pretty bad, until they changed the protocol so that it's the sending node that keeps the message, which is then pulled (or not) by the recipients. It made a lot of sense to me: I'm the one sending you the message, I want you to see it, while you don't even know wheth…

Wow that's ingenious - and obvious when you think about it. I guess evolving the email standard is a much bigger obstacle though, no matter how clever the proposal.

An attempt was made.

https://en.wikipedia.org/wiki/Internet_Mail_2000

Post reply on HN