Internet Mail 2000 | Hacker News Reader

Internet Mail 2000

cr.yp.to

69 pointspmoriarty66 comments

This was an interesting proposal at the time, but the problems it's trying to solve (storage, bounces) are very different from the problems we ended up having (spam, spam, spam).

Spam is a non-issue in 2022. Also in 2012. The available solutions all work extremely well, from rspamd to Gmail, and have for many years. We can thank Paul Graham for popularizing the solution, in fact. Thanks Paul!

The only real issue for email today is deliverability. That's getting worse, according to reports from people who have not had a stable verified public IP address for decades.

> The available solutions all work extremely well, from rspamd to Gmail, and have for many years.

When the "Unsubscribe" feature fails (about 10% of the time in my experience), then those emails are legitimately spam. None of the spam solutions work for those emails.

I see one or two messages per week, and I guarantee that my email addresses are on every spam list in the English-speaking world. (Also Chinese and Russian -- at a minimum)

If spam is a problem for you in 2022, you have a crappy email provider.

You didn't understand the point of my comment.

If you sign up for something (e.g. by purchasing goods from a legitimate store), those will virtually never be classified as spam. The reality is that it is hard to get off those lists - a lot of them have an "Unsubscribe" link that purports to get you off their list, but do not actually do so.

If you have a provider that is classifying them as spam, then you have a crappy provider.

The modern definition of spam, used by gmail & other providers is “email the receiver does not want to receive”.

I consider the unsubscribe button a courtesy, but the “mark spam” button is the real unsubscribe link. I wish modern email systems had a button which did both - “unsubscribe, and mark any future email from this domain as spam”.

Not that I normally use it, but at least on iOS the gmail app’s ‘report spam’ button gives just this; ‘unsubscribe and report spam’ as the first option.

I declared bankruptcy on an old email address (josephg@gmail) in part because of the quantity of junk that address receives. About 10-20 junk emails per day make it through to my inbox. In my case, it’s because there’s at least 3 different people who regularly misspell their email address and type mine instead. The emails tell their story - first through account creation emails, and then a series of emails with password reset codes. And I get a flood of attempts to reset my Facebook / Google / apple / etc account passwords. All mixed with genuine spam, phishing emails, pay stubs (!!), Indian cell phone bills, and all sorts of other cruft.

The spam has now filled up my Google storage quota, and I can’t use Google docs with that account any more. (I’ll probably just backup & delete all email in that mail box soon to restore the account)

If gmail’s spam detection is “crappy”, I’m very curious who you consider “good”.

For me my gmail was not in bad shape until a particular social network leak, now it gets signed up for every single website with a weak CAPCHA. Probably 4 or 5 websites and mailing lists a week now. I have learned which sites will let you sign up multiple times with the same email address. Some dating websites apparently don't check at all and I now have dozens of accounts on them. Hooray.

Plenty of websites also seem to consider email confirmations optional in their sign-up flow. Which is to say, if you never confirm your email address, plenty of websites will still consider your account active enough to spam you.

lol, exact same story for me. my 'crappy' new email gets several spam messages a day + regular false-positives but that's nothing compared to gmail.

Well, I'm disappointed to learn that Gmail is also crappy. My understanding was that they did this part well, at least. To be fair, legit emails to misspelled addresses are not spam, per se -- just a consequence of being @gmail.com (with a humane name).

FWIW, I run rspamd for half a dozen users. It correctly classifies upwards of 6000 spam messages, and ~300 non-spam messages per day. A dozen or so false positives get through per week, and I haven't seen a false negative in at least a year.

I'm probably more annoyed by spam than most people are, but it has barely occupied any part of my brain in a decade.

I guess my original comment should have been more specific. Spam detection is a solved problem in 2022, and has been for many years. That some providers implement it poorly is, well, crappy.

> Spam is a non-issue in 2022.... only real issue for email today is deliverability.

Well, that train of thought went downhill pretty fast.

Could it be perhaps that mail is becoming undeliverable precisely because effective anti-spam is so burdensome that only major players can eat the cost, while pushing massive externalities to every other mail provider?

Nope. I run a mail server and do not have many problems. All the problems I have had the IT of the destination in question was courteous enough to resolve.

"Spam is a non-issue in 2022."

Except when spam filtering effects deliverability and results in mail the recipient wants to receive going to a spam folder, with no way for the recipient to change the filter. For example, I have a friend who has his own domain based on his surname and his mail from that domain goes to Gmail's spam folder even when the recipient marks it as "Not spam".

I have a domain I've been using for some 20 years as my primary email address. There are some gmail users I can send mail to without any problems at all. For other gmail users, my messages appear to go into a black hole, not even showing up in their spam folder. Looking at my postfix logs, I can see gmail's SMTP servers don't report any problems at delivery time. It's frustrating.

I actually get lots of spam in my gmail account’s inbox

Speak for yourself. I deal with both false negatives and false positives not even on an everyday basis, but every day.

I agree for Gmail, but I know people who can't or don't want to use it, and spam is still a huge problem for them. Most "Freemail" Providers are not able to create a product like Google did with Gmail.

would'n't that solve spam ? I imagine spammers would go overquota very fast

You can store a lot of spam in a $200 hard disk.

But how long can you keep your host deliverable?

I'd imagine at least until the disk fills up. If it's spam we are talking about, it can even be rendered at delivery time, it could be more than the useful lifespan of the device.

>I'd imagine at least until the disk fills up

No, until every spam-filter knows your host is a spamer, that is 30min-2h normally.

No, because you don't don't actually need to store one messgae per sent message. You just need to be able to recreate the message upon request. Die to the nature of spam being identical or slightly modified messages it is trivial to just generate the messgae on the fly.

This is solvable: when the recipient client accepts the senders notification, they return a nonce. Later, when they look up the message in the sender's inbox, they reject the message if the sender can't include the nonce.

On the other hand, disk space is so cheap this doesn't help very much.

Yup, with cheap disk space your nonce would need to be huge to actually be a deterrant. Especially if you only need to keep messages for a week or two for 99% of people who will ever read it to read it.

You know, I used to love reading DJBs bitch slaps in his replies to people. He was legendary in the way Linus is legendary...

"...But I do know that she likes my in your face attitude" -- Bender relaying Leelas remarks on him in Futurama, S1E7.

On a non-related note, I used the hell out of Qmail and DJBDNS for years. I sometimes look out into the darkness before I drift off into unconsciousness and wonder why I do not use them today.

The architecture of both qmail and djbdns are excellent. However, the lack of a clear maintenance team means that they fracture whenever a new must-have feature comes along.

If you need dynamic DNS support, djbdns needs something else to handle it. If you need TLS for your mailserver, qmail needs something to handle it. Greylisting? Something else.

If qmail and djbdns had communities the same size as Postfix and Knot, they would be excellent general-purpose choices.

This sounds like a nightmare, mostly because the implication is that refreshing my inbox would amount to pulling emails from thousands of 3rd party servers, any one or more of which may be down at any given time.

You make that sound like a negative.

I run my own email server and have implemented greylisting [1]. Greylisting easily drops my incoming email by 50%, but that 50% was being sent by non-compliant SMTP "servers" (probably, a program running on an exploited box somewhere to spam email). Legitimate email servers will always queue email and try again when they encounter a transitory error.

[1] https://en.wikipedia.org/wiki/Greylisting_(email)

Greylisting is good stuff. I have found similar results.

Until we need mail for 2FA, then it becomes an unworkable pain in the arse.

* the delay makes 2FA super frustrating

* a number of the larger services have pools of mailservers; when they retry the send, they retry from a different random host in the pool. Naturally this breaks greylisting completely.

You don't have to use the full IP address of the relating party when matching greylist entries. Even just ignoring it, and greylisting solely on (sender, recipient) is better than nothing... especially if you're already enforcing based on the sender's SPF record.

> * the delay makes 2FA super frustrating

I think you misunderstand. If I'm expecting to log in via 2FA with my email client, I'll have my email client open (and polling for email in IM2K, or in an SMTP-world, my MX points directly at my email client) so the message won't be delayed if I'm expecting it.

I think it's okay to delay unsolicited mail, after all, I have to sleep some time...

> * a number of the larger services have pools of mailservers; when they retry the send, they retry from a different random host in the pool. Naturally this breaks greylisting completely.

I don't think this is true; Can you explain a little why you think this is a problem?

Back in the late 1990s and early 2000s I ran a large mail server (queue on NFS) and had this problem, and I solved it by hashing the authenticated sender and using that to choose the pool of addresses to try for that week. This way, a bad actor might burn 3-4 IP addresses by spamming and get me added to one of the popular blacklists, but they don't take out my entire system, and that gave me time to correct the problem. When Greylisting started becoming popular, I had some slightly longer delays than the more popular single-node mail servers out there, but I tweaked this to simply prefer the same address until seeing some headers then retry on the alternate to see if we get a different answer. Now it's 2022, and I suspect any big mail server knows these tricks and more, and any operator who doesn't know about greylisting in 2022 is going to have other problems.

2FA has never been an issue with me. If it's a one-time thing (like signing up for a website) the wait doesn't bother me, and no services have ever rejected me because I didn't respond within five minutes. If it's a recurring thing, I can always whitelist the domain, the IP, the sender, or all three.

Even the senders with pools of mail servers hasn't been an issue---the email will eventually get through. As far as I can tell, in the fifteen years I've been using greylisting, that has just not been an issue.

When I first started with greylisting, I set the embargo time (minimum time to reject emails) to an hour. I later dropped it down to 25 minutes, but that's just me being a bit over-cautious. Just a one-time temporary reject is enough to filter out something like 80% of what I catch with 25 minutes.

Odds are more likely that you have less than 100 messages waiting and more than 80 of them are stored on major, reliable hosts like Gmail, Amazon and Microsoft.

Well, maybe your preference is not to leak your confirmation time. In which case, you’d set up a background process to automatically retrieve and store. This is congruent to the traffic shape today.

And it wouldn’t be bad if store-and-forward catches on, because it relieves the storage pressure for big, free services, which would be the largest burden attempting free, anonymized messaging at scale.

I like it. It would make it much easier to control incoming messages… such as retrieving only the most recent of ads from a retail company.

The only other solution I have thought of is to charge for email. Say a few cents per message would go from sender to receiver. That would definitely reduce spam.

This was the origin of proof of work.

> The only other solution I have thought of is to charge for email. Say a few cents per message would go from sender to receiver. That would definitely reduce spam.

Spam would still come from hacked boxes, being charged to the owner of the hacked box.

I don't understand this one:

> In IM2000, mailing lists are a purely local matter for the receiver's software.

We still need to manage list of users we want to send notifications to, right? ("The message isn't copied to the receiver's ISP. All the receiver needs is a brief notification that a message is available.") Or is it expected there will be no "push" notifications for mailing lists, but I will actively ask about new messages in the list on every inbox refresh? That seems a bit wasteful, especially when this protocol seems to be concerned about efficiency.

Somebody copy pasta the "so you think you can fix email, this is why your idea won't work" thing.

Meanwhile every time this subject comes up (and cascades into side topic posts about how it is hard to self host and mutt vs thunderbird) I'm left wondering why we even need internet mail anymore when there are so many other overlapping communication channels already.

You message your normal friends on WhatsApp.

You message your nerdy friends on Signal.

You message your drug dealer on Telegram.

Nobody writes email sized messages anymore just like nobody writes letters anymore.

You message your in-laws from an incognito Facebook tab a couple times a year.

Sometimes when you want to message no one in particular you shout into the void on Twitter.

You communicate with your team by hooking up GPT-3/perl-script to your corporate slack for your first gig and Microsoft Teams for the secret second gig. Just be sure to not send the emojis after work hours.

That open source project you like is now increasingly sequestered on some discord instead of a traditional mailing list.

What is left for internet mail to do? Seems like it mirrors the real life postal service and has been reduced to mostly junk mail and newsletters you aren't going to get around to reading because you're busy slogging through your RSS feeds (what is dead may never die).

Maybe we've been so obsessed with figuring out how to operate our own postal service like in the frontier days we forgot to ask ourselves whether we should want to in the first place.

Neither snow nor rain nor heat nor gloom of night stays these couriers from the swift delivery of plain text messages over an open protocol via the public net. For What?

I write (and receive) a lot of email-sized messages, and email / phone are pretty much the only ways I communicate with clients. Most client emails involve lists of features and questions which we reply to with line-by-line comments (think red/blue, quotes within quotes). To me it's more efficient and less distracting to have all my work comms in a single email thread per project than scattered across different services. I've tried doing this with shared documents and spreadsheets, but found it's a mess, because no one checks and notices when you change them, or scrolls around to find the thing you added or commented on. The issues are complicated and technical enough that chat format, especially thumb-typing, is not helpful. With email, clients usually see and respond quickly so I can get on with work. And there's a consistent paper trail to refer to. If the issue needs a discussion that's too complex for the email chain, or if they don't fully understand the options or limitations I'm describing, I call the client and hash it out, then put the result we agreed on into an email and send it to them.

> because no one checks and notices when you change them, or scrolls around to find the thing you added or commented on

Isn't there an email on change functionality, heh.

Either way, work email is from the work address on the work mail server. Which is, lets face it, hosted by Google or Microsoft if not some big corp IT. That's already a thing, what is there to fix.

I run a mail server for my own business and a few of my clients. I love the idea of making spammers pay for storage. But I agree in general this wouldn't make much difference for most people. And it would be more worries for me in the end if I had to ensure that emails my clients sent were permanently stored and available on the server.

Spammers wouldn’t store anything, they’d adaptively generate a message upon each load.

Email is open. Every single one of those services you've listed could close down tomorrow.

I mean I think you were joking, but just in case you weren't.

When I sign up to get my Electricity bill, what do I give them? My Whatsapp? My Twitter?

> When I sign up to get my Electricity bill, what do I give them? My Whatsapp? My Twitter?

Postal address...?

Big electricity prefers to send bills “paperless” using electronic mail.

Many utilities charge extra for paper bills. Screw that.

I have for some time wondered why that most obvious of institutions, the USPS, does not offer a digital counterpart to snail mail. E.g. getting digital mail to your postal address, or opening & scanning mail to make it available online, or provide a guaranteed digital delivery service, things like that. They have a pretty strong incumbent position to offer such a service. Perhaps it violates some government regulation on what services they can and cannot provide.

Here in the Czech Republic, the national postal service does offer a "digital snail-mail" or "bureaucratic email" and it's used for official communication by government branches, insurance companies and some big companies. Nobody wants to use it for simple receipts, because messages are paid. A centralised service like this from a traditional company (so no VC-backed company with a generous free tier) just can't compete against the "simplicity" of sending email.

Really not unreasonable. Postage is expensive- on something like a mobile phone bill just that would be 1-2% of the gross, before printing etc. And moreover enormously wasteful of resources where email seems to work pretty well. (And for handling commercial invoices dealing with people still sending paper ones is an expensive irritation)

In many countries you increasingly can actually give your WhatsApp/local-equivalent. But sure, I'd say make yourself a sequestered legacy email address. One per utility.

> You message your normal friends on WhatsApp.

I don't.

> You message your nerdy friends on Signal.

I don't.

> Nobody writes email sized messages anymore just like nobody writes letters anymore.

I do. But I'll grant few do.

> You message your in-laws from an incognito Facebook tab a couple times a year.

I don't.

> Sometimes when you want to message no one in particular you shout into the void on Twitter.

I don't.

> Somebody copy pasta the "so you think you can fix email, this is why your idea won't work" thing

The author in this case has also written what was for some decades one of the better MTAs you could run, namely qmail. Granted, I've always despised it for its hostility to administrators not named Daniel Bernstein, and ran Postfix instead for all 17 of the years I spent administering my personal mail hosts. I don't like djb's style, either, and while we've never directly interacted I strongly suspect we would not get along at all. But none of that changes the fact that djb did in fact fix a lot of what was wrong with email, by providing an alternative that at the very least was both a lot faster and a lot more secure than sendmail, back when good alternatives to sendmail were pretty hard to come by.

He's certainly not always correct, but he is at least always worth listening to.

I think all of that is fair, except perhaps for the characterization: A lot of sysadmins liked the djb way too. It's 2022 and I still prefer daemontools to systemd and multilog to syslog; I chain lots of little unix programs instead of writing big honking super-servers all the time. I use cdb and fghack-like tricks a lot. And we still feel the pain of fhs...

And who knows, you might agree more now that he's changed some too: After ten years of qmail[1], his list of "distractions" is remarkably reflective, and he seems quite willing to admit some of the contortions he did (and put us users through!) to get privilege separation, or to annoy attackers (and the users!) didn't gain anything at all and cost much.

[1]: https://cr.yp.to/qmail/qmailsec-20071101.pdf

Thanks for linking that! There's a lot of good analysis in there, and it does indeed ameliorate my opinion somewhat.

Just chiming in to say I agree with this take. My work communication is 95%+ Slack, including shared channels with external vendors. Family and friends are all in private group chats on Telegram, Messenger, and Discord.

At $DAYJOB we sponsored a hire from another country recently, and their new landlord wanted an email address instead of adding them on WeChat/WhatsApp. It was a culture shock. They created their first email account in 2020 at age ~30.

Email has been EEE'd by the big players - e.g. Gmail conversations and labels don't work properly in plain IMAP (extend) and they block messages from independent mail servers (extinguish).

Email is obviously still popular, but I think it's fair to say most people do not use it. Email is for receipts. I think its demise is closer now than at any point in the past.

>My work communication is 95%+ Slack, including shared channels with external vendors

>I think its demise is closer now than at any point in the past.

Quite the opposite here (we're b2b in Europe), most of business communication is via email. It's the easiest way to contact a business because virtually everyone uses it, as opposed to the hugely fragmented market of Telegram/Whatsapp/Discord/Slack/Messenger/whatever is the new shiny thing this week.

Our SaaS is about eLearning, we have thousands of clients in US, Europe and Asia, from all sorts of industries. A company usually registers all their employees in our system, and every employee has a profile where they can specify their email (which is optional). I worked with tech support and although I don't have exact statistics, my impression was that the majority of employees have emails assigned, it was the norm, rather than an exception. I've noticed it's usually retail where employees only have a phone number.

We do use Telegram/Whatsapp for announcements, but I don't see email go away any time soon. I can't imagine myself having an official business correspondence on Discord.

> I can't imagine myself having an official business correspondence on Discord.

https://www.whatsapp.com/business

>WhatsApp Business is a free to download app available on Android and iPhone, and was built with the small business owner in mind. WhatsApp Business makes interacting with customers easy by providing tools to automate, sort and quickly respond to messages.

So it's a way for small businesses to communicate with customers. Not what I was talking about (business-to-business interactions)

I did a warranty replacement on a Dell monitor entirely on Whatsapp. I have to say it was a super slick process. Even down to taking a picture of the problem and the serial number and not having to attach it to an email or upload it into some ticketing system. So it's not just small businesses.

I mean I guess if "leave all messaging to corporate walled gardens" sounds like a good idea to you, then okay.

I think email is fantastic.

Reply on news.ycombinator.com