Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

161–170 of 247 posts

Re: Poste.io – Complete Mail Server

#161

Post by kedihacker »

daneel_w wrote: post #94
zacharyvoase wrote: post #51

> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. SHA512 isn't a good choice for this, because it's optimized for fast low-memory computation. Why not use bcrypt or argon2, which are industry-accepted best practices for password hashing?

Their rationale is probably because those two don't scale very well when you want to make their efforts count, whether bcrypt's hunger for CPU or Argon2's hunger for CPU and/or RAM. Bcrypt is very capable at bogging things down when you have lots of users authenticating very frequently, which is often the case with a POP3 server. A mere 100 e-mail clients authenticating every 2 minutes on average to check for new mai…

Just assign passwords.

Re: Poste.io – Complete Mail Server

#162

Post by rakoo »

dsr_ wrote: post #9
sam_lowry_ wrote: post #5

Dovecot, Roundcube, ClamAV, Rspamd are all battle-tested and reasonable choices, but the choice of Haraka, a Node.js-based SMTP server, feels dubious. Why not exim or something similarly solid and well-understood?

I generally recommend replacing Roundcube with SnappyMail ( https://snappymail.eu ) -- not having to deal with a database by not maintaining much state is a win. I was expecting to see Postfix instead of Haraka. I wouldn't have been very surprised at exim.

Wow I finally find what migadu is using for its webmail, thanks !

Re: Poste.io – Complete Mail Server

#163

Post by hardwaresofton »

dingaling wrote: post #160
hardwaresofton wrote: post #85

Have written a bit about self hosting email[0]. I personally run: - Proton Mail (not self Hosted but for some addresses) - Haraka - Maddy For people new to self hosting email I recommend maddy over the usual postfix + dovecot [0]: https://vadosware.io/post/its-never-been-easier-or-harder-to...

A rather large caevat on Maddy: Note: IMAP storage is "beta". If you are looking for stable and feature-packed implementation you may want to use Dovecot instead. So at this point it replaces postfix.

Yeah it's "beta", but I've been using it for years at this point.

That warning has been there for a while -- I don't think it's accurate at this point -- You can use SQLite or other DBs to hold your IMAP data:

https://maddy.email/reference/storage/imapsql/

https://maddy.email/reference/blob/fs/

https://maddy.email/reference/blob/s3/

I've used all three of these actually (over the years -- more recently I've moved a bunch of my imapsql workload to S3-compatible storage on Backblaze) and they work great.

If you're sending and receiving gobs and gobs of email maybe think twice, but for someone who is dipping their toes into self-hosting email maddy is one of the best choices out there.

As usual YMMV, and back things up, if they are important to you.

Re: Poste.io – Complete Mail Server

#164

Post by ponytech »

pbreit wrote: post #130
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

Why are the email providers so bad about this? When I check my "spam" filder in Gmail, around half the email is not spam. Is it because humans are so bad at classifying spam?

May I ask, why are you still using Gmail then?

This is an honest question, in my opinion the only way to make Google more friendly with self-hosted mail servers is their users complaining about or leaving Gmail.

Re: Poste.io – Complete Mail Server

#165

Post by tux2bsd »

hsbauauvhabzb wrote: post #153
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

I refer to this as ‘the mail cartel problem’.

[dead]

Re: Poste.io – Complete Mail Server

#166

Post by smorrebrod »

justsomehnguy wrote: post #157
smorrebrod wrote: post #155

Earlier quoted context omitted.

Isn't 465 safer since 587 uses STARTTLS and STARTTLS can be downgraded?

> since 587 uses STARTTLS and STARTTLS Technically yes, but for the last decade I've seen only one instance where 587 was explicitly STARTTLS (Fastmail), everyone else just running TLS on it.

How can I check if a connection is TLS or STARTTLS?

Re: Poste.io – Complete Mail Server

#167

Post by lillecarl »

hanniabu wrote: post #146
kkielhofner wrote: post #143

Earlier quoted context omitted.

I’ve been in the Ethereum ecosystem for over six years. I’ve heard “there’s a lot of work being done on…” literally thousands of times. Yet outside of the crypto-sphere I’ve only met a handful of people who’s life would be impacted in the slightest if the entire thing disappeared. Ethereum is eight years old and debates about use cases, etc aside I think even someone towards the middle of the debate can readily ackno…

You must only be following at a pretty surface level if you think "things are being worked on" is just a meme

Things are being worked on but nothing changes, crypto is still just a speculative asset for people to try making big bucks quickly with, people use monero to buy drugs. Those are the two usecases, it doesn't matter how much people work on cool crypto things if the usecase stays the same.

Re: Poste.io – Complete Mail Server

#168

Post by 3r8riacz »

that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

We use Mailgun as outbound relay for self-hosted email stack, and no more problem with delivery. As a home user you can even stay within the free tier and never pay a dollar for it.

Re: Poste.io – Complete Mail Server

#169

Post by imp0cat »

smorrebrod wrote: post #166
justsomehnguy wrote: post #157

Earlier quoted context omitted.

> since 587 uses STARTTLS and STARTTLS Technically yes, but for the last decade I've seen only one instance where 587 was explicitly STARTTLS (Fastmail), everyone else just running TLS on it.

How can I check if a connection is TLS or STARTTLS?

Connect to the smtp server and issue `EHLO something` command, then check if STARTTLS is mentioned in the server response.

Re: Poste.io – Complete Mail Server

#170

Post by mittermayr »

foxylad wrote: post #116
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

Spam is only solved by the large mail providers (who have enough data to act on it within a split second).

After the great Gmail exodus two years ago (when they killed then unkilled legacy domain accounts), I moved to MXRoute — and the amount of unfiltered spam I get is insane. It's a daily nuisance. I have added about 200 filter words now, blocked hundreds of e-mail addresses, but it's next to impossible to filter out sometimes.

From conversations and threads online by the MX Route admin, it seems like this is a nearly unsolvable problem, still. Spam evolves so fast and uses throwaway one-time approaches only, so once you've filtered for a pattern, the next campaign looks completely different.

So, yeah, sorry about the long response, but I don't think Spam has been solved, at all, at least not if you're using an e-mail that's been around for longer than a few years (and appeared at least in one leak).

Post reply on HN