Whilst I do get some nonsensical response, that big tech have great security, it does feel really lainful that there is basically no alternative. I really want there to be, but there just isn't a viable alternative.
There isn't? My Eastern European highschool had self hosted email since as far as I can remember hosted on some pentium PCs.
The issue isn't that there's no alternative, the issue is that, schools are unable or unwilling to bother doing things themselves and instead just go with Apple, Google, Microsoft, because it's easy and almost free.
In reality, the concern seems to be the law will not legally allow them to continue operating unless Google clarifies where the data is processed.
It's not "clarify where the data is processed" but rather "make sure it's not processed by an US-owned corp" (not to say that any other country is fine, their laws must be compatible with GDPR).
The major issue is that it's so centralised already that everything outside of the oligopoly is considered untrusted, but it doesnt take long to get trusted- even if you run marketing campaigns over email like I did for years in the mid 2010's.
I'm not sure if we're all collectively incompetent or if we're completely overblowing how difficult it is.
granted; while I managed email systems of various sizes... yeah I outsource it now myself; but that's MAINLY because I'm lazy, I don't want to deal with it and I don't have an obligation on those emails to preserve privacy or anything like that.
if it was my job to do that because there is a risk to the company; sure, not a big deal, sanitise some IPs slowly over time, configure your PTR records, DMARC/DKIM and SPF everything, ensure you're not an open relay and you probably have to look at it once a month for an hour or two to make sure you're not on a blacklist. -- people do this all the time (or used to) with active directory.
Yeah, its stateful and your deliverability is affected by idiots sending spam-like things, but it's not "hard".
Collective (learned) helplessness here is really going to fuck us over, we already forgot how to run servers it seems, now we're not even able to host services.. soon we won't know how to write code, I'm sure.
I agree with this 100%. It's bad and I think partially because at least as far as I know, there is no standard definition of how you'd need to setup your email server to guarantee some arbitrary email delivery success rate. And so it ends up being a combination of arcane knowledge together with slow feedback loop for debugging.
btw, if you have any good resources recommendations for successful configuration, I'd love to take a look at that.
The real fun starts after things are set up, as you start wrestling with deliverability issues, trying to get recipients to mark your mails as not spam, trying to avoid recipients to mark properly delivered mails as spam, while simultaneously making sure you prevent your systems from sending spam through hijacked accounts and loopholes.
But giving up? No, definitely not. It's quite doable, but not as straightforward as it ought to be.
Sure, it's definitely easier when you have _users_ sending mail. When you have _customers_, it gets a tad more complicated. Sure, you can be a good kid and keep IP's warmed up, set up authentication and make sure DNS is configured properly. None of those help when some spammers decide they like your hosting service and start purchasing accounts with stolen credit cards, nor when you have customers re-using passwords, refusing to use 2FA and so on, and their accounts inevitably get hijacked.
Office 365 and Gmail silently dropping mails doesn't make things easier.
Why can't the state build a data center and host some Matrix, Nextcloud and Moodle instances? To me that would seem like tax money being used as intended by the taxpayer.
Switching from a cloud run by professionals to a self-hosted Nextcloud would be a massive downgrade in information privacy.
We already know google, microsoft and apple have unfettered access to your data too. With self hosting, at least I have a chance of knowing when my data's being monitored & I can choose increasingly severe security around that system. The big players can only offer promises with little to no way for us to verify the truth of any one of their statements.
So, unless the big players offer e2ee as a default, it's best to assume the worst from them. With nextcloud it's far less necessary if you're rolling your own (but it supports a form of encryption anyhow)
C'mon really. The whole central point of this euro scaremongering is that Google will turn over your data to intelligence agencies when U.S. court orders it to do so. Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs. You are claiming this will be visible to you, that you will be able to defend yourself against hardware supply chain attacks, attacks on the media you downloaded to install CrapNux on your servers, attacks against your NextCloud auto-updates, attacks against the whole rest of your software supply chain, social engineering attacks against your sysadmins, attacks against your hard disk drive waste stream, and all the rest of it? And you will be able to achieve this on the budget on a Dutch primary school?
Look, I think it would be cool if nation-sized bureaucracies had the doctrines and practices that allowed them to be actually safer than the cloud, but as it stands they do not.
I am sure, Google has ways to abuse data that do not include any courts.
Euro scaremongering? [0] [1]
Particularly that court mention is weird, considering how the FISA court is very much just a rubberstamp formality.
> Now imagine that for whatever fanciful and obviously highly unlikely reason the C.I.A. wants your PDFs.
That "fanciful reason" could be that my company developed a breakthrough technology/medication/chemical.
Which is exactly the kind of stuff the NSA is very interested in, so it can "patent subsidize" US industries with them [2]
[0] https://www.theguardian.com/world/2013/jun/06/us-tech-giants...
[1] https://qz.com/1145669/googles-true-origin-partly-lies-in-ci...
[2] https://en.wikipedia.org/wiki/ECHELON#Examples_of_industrial...
> U.S. court order
If only it worked like that.
IMHO Europe should just do something like create an https://www.inria.fr/en for writing sane software that acknowledges and handles the complexities of governance. Can't image that paying tons of grad students good money to design and hack something in Ocaml/Haskell that actually works is more expensive than the status quo.
They can afford professionals.
https://www.dataport.de/pressemitteilung/dataport-stellt-ope...
That all seems solveable to me with enough money and time. What if a billion Euro gets invested into infrastructure and hardening of these tools? I think everything that you describe is a result of underinvestment. Extorting our kids data to Google cannot be better.
We aren't also outsourcing the military to Blackwater and the secret service to Facebook, just because they can run it more efficiently.
https://ico.org.uk/for-organisations/dp-at-the-end-of-the-tr...
That's not how it worked. The GDPR is a regulation which means that it applies as-is in all EU member states without being incorporated in to national laws. It is only directives that need to be incorporated in to national law (a process known as "transposition").
As far as the UK goes, because the GDPR was in force at the time of Brexit it continued to apply (the same with almost all EU law), although it was amended so that it didn't reference EU institutions any more (like removing the bits that talked about the EDPB or collaboration with other EU supervisory authorities, replacing references to the Commission with the Secretary of State and other things like that).
However, the Data Protection Act 2018 [1] does complement and supplement the GDPR in UK national law, including certain data not covered by GDPR, and more specifically apparently "implements those parts of the GDPR which 'are to be determined by Member State law'". This was before Brexit took place, and it was later amended to reflect non-EU status at the start of 2021.
For the GDPR specifically, the UK basically forked it and has what's known as the "UK GDPR". They basically just gave the powers that lie with the Commission to the Secretary of State and deleted the bits that dealt with cross-border collaboration between DPAs.
It’s a Brexit benefit or something.