Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

151–160 of 247 posts

Re: Poste.io – Complete Mail Server

#151

Post by zacharyvoase »

daneel_w wrote: post #94
zacharyvoase wrote: post #51

> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. SHA512 isn't a good choice for this, because it's optimized for fast low-memory computation. Why not use bcrypt or argon2, which are industry-accepted best practices for password hashing?

Their rationale is probably because those two don't scale very well when you want to make their efforts count, whether bcrypt's hunger for CPU or Argon2's hunger for CPU and/or RAM. Bcrypt is very capable at bogging things down when you have lots of users authenticating very frequently, which is often the case with a POP3 server. A mere 100 e-mail clients authenticating every 2 minutes on average to check for new mai…

Well if you want passwords to be difficult to crack if an attacker gets access to the hashes, you kind of just have to deal with it.

Re: Poste.io – Complete Mail Server

#152

Post by ryanjshaw »

TedDoesntTalk wrote: post #125
brightball wrote: post #123

Earlier quoted context omitted.

How many servers do you have? Just curious if the rate limit is per IP address?

We have a Microsoft email subscription (all our mail is hosted with them), and their smtp server rate limits how much mail we send to our customers. We can’t even send 30 emails at once. We had to implement retry logic with back off.

Have you spoken to an account manager there? I send way more than that on a regular basis. I do it sequentially for simplicity, I wonder if that makes a difference.

Re: Poste.io – Complete Mail Server

#153

Post by hsbauauvhabzb »

that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

I refer to this as ‘the mail cartel problem’.

Re: Poste.io – Complete Mail Server

#154

Post by CodeWriter23 »

hsbauauvhabzb wrote: post #153
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

I refer to this as ‘the mail cartel problem’.

Apropos

Re: Poste.io – Complete Mail Server

#155

Post by smorrebrod »

imp0cat wrote: post #141
anaganisk wrote: post #124

Earlier quoted context omitted.

At least they are hashing and not storing encrypted passwords. But even a baby framework with may be 10s of deployments have switched to bcrypt, etc. Im not sure why they're boasting about SHA512. But I am a little lost on the RFC thing. Could you enlighten me. I thought they were standard ports for legacy,TLS, and SSL ports.

tldr; 465 is obsolete,you should not use it; 25 is for relaying mail between servers; 587 is the default mail submission port today.

Isn't 465 safer since 587 uses STARTTLS and STARTTLS can be downgraded?

Re: Poste.io – Complete Mail Server

#156

Post by louison11 »

kkielhofner wrote: post #143
hanniabu wrote: post #128

Earlier quoted context omitted.

Really hoping ENS can step in here and fill this gap. There's a lot of work being done on social and messaging infrastructure. Using that as an email and chat handle and social handle would be huge for maintaining open messaging. Unfortunately this relies on adoption and people living past their bias and admitting there's use cases.

I’ve been in the Ethereum ecosystem for over six years. I’ve heard “there’s a lot of work being done on…” literally thousands of times. Yet outside of the crypto-sphere I’ve only met a handful of people who’s life would be impacted in the slightest if the entire thing disappeared. Ethereum is eight years old and debates about use cases, etc aside I think even someone towards the middle of the debate can readily ackno…

100% agree. Been in crypto for 12 years. I’ve held this view for the last 7 years. So much delusion in the space. So much “technological orgasms” with no grounding in real world business dynamics and economics.

Re: Poste.io – Complete Mail Server

#157

Post by justsomehnguy »

smorrebrod wrote: post #155
imp0cat wrote: post #141

Earlier quoted context omitted.

tldr; 465 is obsolete,you should not use it; 25 is for relaying mail between servers; 587 is the default mail submission port today.

Isn't 465 safer since 587 uses STARTTLS and STARTTLS can be downgraded?

> since 587 uses STARTTLS and STARTTLS

Technically yes, but for the last decade I've seen only one instance where 587 was explicitly STARTTLS (Fastmail), everyone else just running TLS on it.

Re: Poste.io – Complete Mail Server

#158

Post by franga2000 »

foxylad wrote: post #116
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

How is spam related to SPF and DKIM? Those prevent forgery, but if a spammer actually owns a domain, they can send you whatever they want. That's where the majority of spam comes from, so it's far from a solved problem.

Re: Poste.io – Complete Mail Server

#159

Post by brnt »

ljm wrote: post #118
drchiu wrote: post #111

Earlier quoted context omitted.

As a user, I'd rather my receiving email provider (eg. Gmail, iCloud, Outlook) be less restrictive in their filters if it means individuals can host their own mail servers and we can have a more egalitarian internet. Extremely filtered emails is practically the same as a social network determining what I can see at this point.

Only it’s not a social network, not even close. Web standards have advanced to a level that walled gardens are replacing email. Email itself is still stuck on IE6 level standards. And SPF, DMARC and DKIM are a confusing mess to deal with.

Email is showing its age, but are SPF, DKIM, DMARC really confusing?

Re: Poste.io – Complete Mail Server

#160

Post by dingaling »

hardwaresofton wrote: post #85

Have written a bit about self hosting email[0]. I personally run: - Proton Mail (not self Hosted but for some addresses) - Haraka - Maddy For people new to self hosting email I recommend maddy over the usual postfix + dovecot [0]: https://vadosware.io/post/its-never-been-easier-or-harder-to...

A rather large caevat on Maddy:

Note: IMAP storage is "beta". If you are looking for stable and feature-packed implementation you may want to use Dovecot instead.

So at this point it replaces postfix.

Post reply on HN