Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

After self-hosting my email for twenty-three years I have thrown in the towel

cfenollosa.com

Post reply on HN
Print view View original

281–290 of 744 posts

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#281

Post by tsimionescu »

lisper wrote: post #201
mmsnberbar66 wrote: post #138

Earlier quoted context omitted.

What would be the advantage?

There are many benefits to running your own server. The three biggies for me are: 1. Control. A third party can change anything about the service any time they want, and if you don't like the change they made you're screwed. 2. Expectation of privacy. Because I am not contracting with a third party, the government cannot argue that I have waived my right to privacy. (As a practical matter of course this matters not a…

> The Right Way to filter spam is to use your outgoing mail as ground truth for what is not spam

Could you elaborate? Does this mean that email from people/domains you haven't corresponded with before is spam?

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#282

Post by nullc »

jasode wrote: post #21

The sweet spot for having control over your email while simultaneously minimizing unforseen headaches is to simply own your domain name and point the MX record to whatever hosting provider you want instead of self-hosting a server at home. Same philosophy for exposing a your personal blog of html files or content like mp4 videos. The sweet spot is to focus on buying a domain name you control. Then let Amazon S3, or C…

> The sweet spot for having

no forth amendment protection for your email because its stored by a third party.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#283

Post by Avamander »

teddyh wrote: post #273
Avamander wrote: post #261

Earlier quoted context omitted.

Showing any BIMI logo is an absolutely unreasonable thing to demand from a large-scale BIMI implementation. It does not make it "monopolizing", I don't think you even know what the word means.

So VMC isn’t optional?

Is it that difficult to grasp that there's a "depends" option between "optional" and "not optional"?

Nobody really forces you to use HTTPS either, it's not a "monopolizing" standard if someone doesn't trust you without.

And again, if you have a way of establishing just as much trust without such a labour-intensive/expensive verification process, please do share.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#285

Post by znpy »

In fairness, things like postfix usually ship with very poor (not to say “moronic”) defaults.

Like, postfix won’t even try to connect to tls-enabled smtp for outgoing email by default, and you have to explicitly point it at the certificate bundle it’s supposed to consider valid.

And you have to tell explicitly to reject incoming plaintext connections from the public internet.

And quite a bit more… Like, why doesn’t postfix have its own freaking spf/dkim implementation BUILT IN?

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#286

Post by jwildeboer »

My little e-mail Server on an OVH VPS is happily sending and receiving e-Mails to/from the big ones without problems for my 20+ domains. Just a basic postfix/dovecot setup with letsencrypt certificates and SPF/DKIM/DMARC working the way it should. I described everything in a short blog series at https://jan.wildeboer.net/2022/08/Email-0-The-Journey-2022/ in case you are interested.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#287

Post by Fuzzeh »

tannhaeuser wrote: post #84
aimor wrote: post #46

Funny thing happened to me today: Gmail sent its own Google Fi customer support email to spam. Haha, wish I noticed that before spending my morning going in circles with chat support.

gmail also puts mails from mailing lists into spam, despite repeated "not spam" tagging. Wondering whether mail getting flagged as spam is even a problem anymore as people get used to erratic results, at which point we can get rid of spam filtering, or what's left of it, altogether when on balance it does more harm than good, such as preventing SMTP self-hosting.

And yet I continue to get "Walmart Confirmation Receipt" or "Verizon Confirmation Receipt" all coming from addresses like "verizon_info_nlAT2Q7uf0d@zfgfdyyqsckxbvwg.linenight.com" which means google are't even trying for some.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#288

Post by teddyh »

Avamander wrote: post #283
teddyh wrote: post #273

Earlier quoted context omitted.

So VMC isn’t optional?

Is it that difficult to grasp that there's a "depends" option between "optional" and "not optional"? Nobody really forces you to use HTTPS either, it's not a "monopolizing" standard if someone doesn't trust you without. And again, if you have a way of establishing just as much trust without such a labour-intensive/expensive verification process, please do share.

When the big providers all require VMC to show BIMI, then VMC is not optional, no matter what the spec says. Claiming it is optional is then disingenuous.

As I said in the linked post, logo verification is not a problem which can be solved. Identical trademarks can legitimately be issued in different fields, and both still be valid. Let’s say you are a brick manufacturer, and have paid an arm and a leg to a VMC certificate authority (previously a HTTPS EV certificate authority) for your logo, a nice iconic square logo. Then someone else can simply come along, register a flower shop in another country, use a different VMC issuer and get an identical logo issued to them. They can now send e-mail invoices to your customers with your logo on it, legitimately obtained, and the BIMI system will have trained your customers to trust your logo.

Any fix for this you try to implement will make the system even less usable for its stated purpose, or more suited to only large players and unusable in practice for smaller operators.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#289

Post by Avamander »

bArray wrote: post #278

I know of some small servers that get a lot of spam and hacking attempts, and their most effective tool against abuse is an IPv4 block ban. Increasingly this became more and more difficult, and I assume email servers are at the same point. Thanks to VPNs, people appear to be able to spawn insane numbers of random IPs. One solution this decentralized server system came up with is the concept of accounts that have some…

> One solution this decentralized server system came up with is the concept of accounts that have some barrier to entry to create (which involves a delay and proving identity). This account has a private key and it uses this to access the servers through any IP. Abuse on this account and any connected accounts of course leads to the key being temporarily revoked. Lots of positive interactions with well established accounts increases your credibility. Lots of reports decreases you credibility.

That's essentially DKIM being fed into your average domain reputation system.

Re: After self-hosting my email for twenty-three years I have thrown in the towel

#290

Post by tinus_hn »

ratata wrote: post #270
api wrote: post #259

Earlier quoted context omitted.

It’s just because of spam. All open systems that do not impose a cost to participate are destroyed by spam.

True. But they are not calling for a completely open system. I like this proposal from the author. > Change blacklisting protocols so they are not permanent and use an exponential cooldown penalty. After spam is detected from an IP, it should be banned for, say, ten minutes. Then, a day. A week. A month, and so on. This discourages spammers from reusing IPs after the ban is lifted and will allow the IP pool to be cle…

Spam has been been fought for decades, you can rest assured any obvious solution has been tried and either doesn’t have the desired effect or is impossible to implement.
Post reply on HN