51–60 of 66 posts
Earlier quoted context omitted.
More and more "compliance" is an IT industry excuse for "because we want to."
Honest question, why would you "want to" adhere to compliance? It's almost always more work and more cost, I think .
When I get spam email, I usually check the headers and if it's coming from a reputable service (Postmark, Sendgrid, etc.) they usually have a web form or an abuse@ email to send the headers to so that they can shut down the account. Months ago I received spam from a Mailgun server and tried to use their web form[1] to report it, but it was broken. I reported both that bug and the spam email to their support, which ac…
Postmark costs money, Mailgun does not.
This was used to steal bitcoin cash tips on Reddit by hijacking password reset emails ( https://www.reddit.com/r/bugs/comments/7obxkb/mailgun_securi... ) I find it amusing they still have a "trusted by Reddit" blurb on their homepage after this!
On 12/31, Reddit received several reports regarding password reset emails that were initiated and completed without the account owners’ requests. We have been working to investigate the issue and coordinating with Mailgun, a third-party vendor we’ve been using to send some of our account emails including password reset emails. A malicious actor targeted Mailgun and gained access to Reddit’s password reset emails. The…
Why would employees need access to client API keys, as opposed to just client ID? Furthermore, this seems to indicate that the API keys are not hashed. I would expect some bits of the API key to work as an identifier and the rest of the bits treated as secret material (properly hashed). As a Mailgun customer, this is concerning..
Er, can we expect more information to follow? 1. How was the employee's account accessed? No 2FA? 2. Do employees ordinarily have access to customer secrets (e.g. API keys) or was there some further exploit? 3. The advice in OP for affected customers is to roll keys and SMTP logins. Couldn't/shouldn't you do that for them? Surely security should trump up-time/deliverability?
I seriously suspect this was the job of an insider, not a compromised employee laptop.
Earlier quoted context omitted.
Postmark is free up to 100 mails / month. But mail deliverability issues are a hell that I'm happy to pay a small fee to avoid.
Do they have an overage charge for the free 100/month, like the 1.25/1000 they list for their non-free use? So you could be free most of the time with the occasional 1.25 charge if you have a busy month?
> We offer a Free Trial plan for testing purposes only. The Trial is limited to 100 emails a month with no overages allowed.
https://postmarkapp.com/support/article/1107-how-does-monthl...
When I get spam email, I usually check the headers and if it's coming from a reputable service (Postmark, Sendgrid, etc.) they usually have a web form or an abuse@ email to send the headers to so that they can shut down the account. Months ago I received spam from a Mailgun server and tried to use their web form[1] to report it, but it was broken. I reported both that bug and the spam email to their support, which ac…
> I've been very happy with Postmark. Postmark's service is great but their new min $10/month pricing scheme is a retrograde step and penalises small companies sending less than 1000 emails a month. Deeply unhappy with the change, and wish more companies would follow the Amazon AWS pricing model.
> Finally, we’d like to assure our customers and partners that we take security at Mailgun very seriously. So very seriously that they don't even use https for their blog...
Come on, Mailgun. Let's Encrypt is free and takes less than 5 minutes to set up (using certbot).
Automating that crap in ansible is almost too easy.