Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fastmail.com suffering DDOS attack

fastmailstatus.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Fastmail.com suffering DDOS attack

#11

Post by toast0 »

cbg0 wrote: post #7
toast0 wrote: post #5

Earlier quoted context omitted.

> 2.) Use gmail or Google Apps. Things just work. Cede control to Google. Until they don't, and then good luck with getting ahold of someone who can actually do anything to fix your problem(s).

If you're paying for Google Apps, you get e-mail and phone support.

Yes -- but the people you can contact may not have the ability to fix problems if they're complex. For example, we wanted to disable clicking on links in email for our users because of phishing -- support wasn't able to help with that.

Re: Fastmail.com suffering DDOS attack

#12

Post by JoshTriplett »

tshtf wrote: post #2

Not many alternatives: 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. 2.) Use gmail or Google Apps. Things just work. Cede control to Google.

> 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM.

And if someone wants to DDoS you, you're a lot more vulnerable than a major provider like Fastmail.

Personally, I use a hybrid solution: I use Gandi's SMTP servers for outbound and inbound mail, but I run my own IMAP server for unlimited storage under my control.

Re: Fastmail.com suffering DDOS attack

#13

Post by leblancfg »

corford wrote: post #9
delroth wrote: post #8

Earlier quoted context omitted.

> They can't really be blamed for a DOS attack. That doesn't really hold when their competitors have teams of engineers working on DDoS mitigations and successfully handle most of these attacks. Falling to a DoS is a technical failure just like other causes of outages.

A ~1 hour response time from identifying to mitigating the DDoS isn't exactly bad. I'd say their engineers did a pretty good job.

Security really isn't my strong suit, but isn't it standard practice to automate DDoS mitigation strategies?

Re: Fastmail.com suffering DDOS attack

#14

Post by corford »

leblancfg wrote: post #13
corford wrote: post #9

Earlier quoted context omitted.

A ~1 hour response time from identifying to mitigating the DDoS isn't exactly bad. I'd say their engineers did a pretty good job.

Security really isn't my strong suit, but isn't it standard practice to automate DDoS mitigation strategies?

Depends on the type and size of the DDoS and where on the network path it's hitting.

Re: Fastmail.com suffering DDOS attack

#15

Post by peterwwillis »

Something i'm realizing more and more... What the hell do I really need remotely hosted mail for?

We all know mail is insecure. Unless you look really really hard, you aren't sure if the mail you received was spoofed or modified, a child can spoof mail and any MitM can modify it. So in general you can't trust your mail anyway, even if it's received by a reputable company. Sending mail is almost just as subjective... a random ISP's mail smarthost is just as good for getting your mail delivered as a hosted mail provider.

All I really need is a way to get my mails, once. Once you have the mail, you can back it up to an infinite number of places (Git repository, anyone?) if in the future you need to search it.

So really, the only thing I need is 1) to receive mail, 2) to filter the spam, and 3) to keep a backup of my mail somewhere.

Considering this, why do we even need domain-specific mail? Like, myusername at Gmail dotcom, for example. I don't need it sent to GMail... I need it sent to me. I don't care what server receives it. I don't even need to store my mail there once i've read it - I can keep it offline, and back it up to remote repositories to search. With a format + protocol like Git, this would be fast, efficient, reliable, secure, and compatible.

So really, if we just had a distributed decentralized peer-to-peer mail network, a unique address system, and a retrofitted mail storage protocol (IMAP5?), we could send mail anywhere, receive it anywhere, store it anywhere, and spam could be filtered by whatever product or company was hosting your Git backup. With the new address system we could even build in personal crypto keys and teach people how to send real, honest-to-god, secure mails, potentially even anonymously.

Now somebody tell me how someone already thought of this and how it won't work :-)

Re: Fastmail.com suffering DDOS attack

#16

Post by b101010 »

JoshTriplett wrote: post #12
tshtf wrote: post #2

Not many alternatives: 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. 2.) Use gmail or Google Apps. Things just work. Cede control to Google.

> 1.) Run your own SMTP infrastructure. Setup SPF/DKIM/DMARC. Realize your outbound emails still don't always reach their destination. Also you have to fight inbound SPAM. And if someone wants to DDoS you, you're a lot more vulnerable than a major provider like Fastmail. Personally, I use a hybrid solution: I use Gandi's SMTP servers for outbound and inbound mail, but I run my own IMAP server for unlimited storage un…

If the attacker has ever seen the headers of a message you sent through fastmails SMTP service they have your public IP (Received from header) and can Dos you directly anyway.

They do something similar with their webmail service, but the data is encrypted so it can't be read by a third party.

https://www.fastmail.com/about/reportabuse.html (last paragraph)

EDIT: Fastmail is fairly priced (for me) and i like the features they offer but i wish they wouldn't do this (or rather, i wish they would do the same for the SMTP service as they do for the webmail service)

Re: Fastmail.com suffering DDOS attack

#17

Post by cjcole »

peterwwillis wrote: post #15

Something i'm realizing more and more... What the hell do I really need remotely hosted mail for? We all know mail is insecure. Unless you look really really hard , you aren't sure if the mail you received was spoofed or modified, a child can spoof mail and any MitM can modify it. So in general you can't trust your mail anyway, even if it's received by a reputable company. Sending mail is almost just as subjective...…

> format + protocol like Git

> distributed decentralized peer-to-peer network

> a unique address system

> personal crypto keys

Funny. You just described a perfect fit for Urbit.

Re: Fastmail.com suffering DDOS attack

#18

Post by superuser2 »

peterwwillis wrote: post #15

Something i'm realizing more and more... What the hell do I really need remotely hosted mail for? We all know mail is insecure. Unless you look really really hard , you aren't sure if the mail you received was spoofed or modified, a child can spoof mail and any MitM can modify it. So in general you can't trust your mail anyway, even if it's received by a reputable company. Sending mail is almost just as subjective...…

Fighting spam (solely) by analyzing its contents turns out to not really work that well. You also need to be very picky about which SMTP servers you will accept mail from.

In practice, this means that if you do not route your outbound mail through a reputable hosted mail provider, it is significantly likely that messages will not make it through to their recipients. Even if you do SPF/DKIM/etc correctly. SMTP servers are not interchangeable. They have reputations, and the IP address blocks they reside in have reputations.

That doesn't always mean Fastmail/GMail/Live, etc. Businesses do run their own Exchange servers successfully. They do so from high-quality IP address space which is closely guarded, not handed out to any idiot with a cable modem (most recipients blacklist all residential IP address space) or $5 (cheap hosting providers are similarly suspect).

>I can keep it offline

You are referring to POP, which predates IMAP - the server just gives you the new emails since last checkin, and then they are gone (from the server's perspective). If you use multiple computers, or a computer and a smartphone, this really sucks. Most people are not going to hack together Git and rsync; they want the same view of their email on whatever device. So we get IMAP.

Re: Fastmail.com suffering DDOS attack

#20

Post by peterwwillis »

cjcole wrote: post #17
peterwwillis wrote: post #15

Something i'm realizing more and more... What the hell do I really need remotely hosted mail for? We all know mail is insecure. Unless you look really really hard , you aren't sure if the mail you received was spoofed or modified, a child can spoof mail and any MitM can modify it. So in general you can't trust your mail anyway, even if it's received by a reputable company. Sending mail is almost just as subjective...…

> format + protocol like Git > distributed decentralized peer-to-peer network > a unique address system > personal crypto keys Funny. You just described a perfect fit for Urbit.

Urbit seems to try to provide a centralized, personalized model for application services. I don't think centralizing is the way to go, mainly because my entire digital life is dependent on de-centralizing all my services. They try to make it out to be like some kind of container you can put anywhere, but that's like saying we should all use one kind of bag for everything we ever need to carry in our daily lives. There's good reasons I have 10 different kinds of bags at home.
Post reply on HN