Comment by jrootabega | Hacker News Reader

Comment by jrootabega | Hacker News Reader

The risk about self-hosting that still worries me the most: what happens when you piss someone off, they email you highly illegal images, and then they alert the authorities? It's in your mail, on infrastructure you own (for the moment), and possibly in your home or on your personal devices. With a larger provider, they would at least have a chance at blocking the content, and hopefully be involved in any investigation that happened. They probably know how to deal with that well because it probably happens from time to time. If you self-host, it's probably going to be a very direct, unpleasant, and harmful matter between the authorities and you, and the authorities will probably not be willing to understand your hacker ethos if they can just assume you're an evil scumbag.

EDIT: I'm assuming here that, if you use e.g. gmail, you would be suspicious of any unsolicited attachments and not sync them to your personal devices.

EDIT: If you're not worried about this happening once, what about if it happens once a month for several years?

Well, clearly they sent it to you, so they're distributing the images. The E-Mail headers, especially if they contain a dkim signature, are likely sufficient proof for that. If not, the provider they used might be able to back your claims up. If you were using some E-Mail provider instead, those images would still land on your client devices, and the situation would be almost the same. And of course let a lawyer do the talking

Ah, but they send and report it anonymously, mitigating the risk to themselves. And the popular conception is that once that content is on your devices, it doesn't really matter how or why it got there. You're effectively ruined. That may be inaccurate but it's still a popular idea.

And re: client devices, with a provider you don't control, you at least have the option not to download or access content you are not confident is safe. If you self-host, just accepting the message is storing the content on your device.

This could happen to everybody having an email address. Why is this self-hosting specific?

That's a good question, but it's so obvious that that's almost the point. So, to look at it another way, this isn't something anyone really worries about today with gmail et al. I agree.

But if you host your mail on your cloud server, or even in your home, wouldn't you feel especially worried if you saw that you had received such illegal material? What do you even do? Do you wipe the server? How many logs do you keep just in case? Do you keep them for 5 years? 10?

If you feel even slightly differently about those two options, that's the concern that is still unresolved for me. If you honestly don't, after having thought about it, then I would consider that a valid point of view here.

One reason I would feel safer with larger providers is they would be better-equipped to block the content, better-equipped to deal with the authorities, and liable for the infrastructure itself. If the cops come to confiscate or investigate some of the hardware, they're going to be dealing with Google. They may also deal with you, but if you're savvy enough not to download attachments you don't expect to receive, you may have SOME buffer there. If it's clear you are hosting your own mail, you have absolutely no buffer. It's very likely to get all your home/cloud computing equipment seized. Maybe THAT's the part that's not realistic?

> But if you host your mail on your cloud server, or even in your home, wouldn't you feel especially worried if you saw that you had received such illegal material?

Why would you be worried? In Law the main thing that matters to make a case against someone is demonstrating intent, and if you had no intent in receiving the material, not sure why you would have to care about that kind of risk.

Reply on news.ycombinator.com