Hacker News Reader

Comment by yosito | Hacker News Reader

> Given Fastmail is an Australian company focused on privacy, I was somewhat surprised by their servers being hosted in New Jersey and Washington and nowhere else.

I find that a bit surprising as well. Though my threat model doesn't currently account for state actors, if it did, this would be concerning.

View on HN

if state actors where your threat model you should not be using email in the first place for communication, and if you do at minimum you should be using encryption inside the communication not relaying on a 3rd party to protect your messages.

Further if you are a US Citizen talking with Other US Citizens, then having your data in the US is the best place for it... Putting it outside the US automatically eliminates any of the paper thin constitutional concerns the state actors would have to pretend to care about... If your email in a 5 eyes nation then it makes their job even easier.

We're there because it's where we've found reliable enough remote hands and network. And yes, the thread model of "the USA goes off the internet" is bad enough that we figure things are much worse than us being much use at that point.

And regarding the privacy risk, we haven't seen a credible threat that would have our servers accessed directly by US law enforcement that isn't just as credible anywhere else in the world. It hasn't happened, we don't believe it will happen.

So yeah, we disappear in an interesting little thought experiment like this one (despite having Australian-owned IP space, it's advertised and routed into our US locations, so fair enough it's blocked in this case)

I do think the timing is ripe for us to look at having more datacenters around the world again. We have had both Iceland and Amsterdam locations in the past, and neither were reliable enough to put production traffic to, multiple hour network outages and inability to contact support and get them fixed - but maybe the landscape has changed enough that it's viable again now.

I hope fastmail puts some servers in Eastern Europe or South east asia.

Fastmail's clients are mostly online only and dont cache much information.

It takes ~5-10 seconds to go from clicking on a notification to actually being able to read anything. It's really not a good experience.

Yeah, that is pretty painful - how does it compare to other sites in the USA? I'd be interested in seeing a traceroute. JMAP is designed to be pretty good in that situation (we're in Australia and ~280ms away from our primary datacenter) with minimal round-trips.

Hey, here is traceroute/mtr of a few addresses from India to USA.

https://paste.debian.net/plain/1282885 (Zoom out a bit to see it properly)

I also created a few measurements on RIPE Atlas.

Ping from all probes in India to api.fastmail.com: https://atlas.ripe.net/measurements/55469007/

Traceroute from all probes in India to api.fastmail.com: https://atlas.ripe.net/measurements/55469042/

Ooh, that's obnoxious, you're being routed the long way around the world because the closest cloudflare entry point is Singapore, by the looks of things.

It's not massively worse than what I get from here:

11. 103.168.172.63 0.0% 5 251.0 251.2 250.8 251.9 0.5

We're using cloudflare for DDoS protection and hence our packets all go into their edge where they get scrubbed before being passed to our hosts. They don't inspect the content at all, so they can't terminate early, which means every packet is round tripping that 350ms.

BUT - JMAP should still mean it's only a couple of round trips to have a fully loaded mailbox.

The Australian government is hostile towards privacy IMO. I wouldn't trust a privacy focused company based in Australia.

EU seems to be only one trying at least something... And even the governments get their dirty hands on things.

South Korea has a pretty strong privacy law, although their government tends to have a lot of authority.

EU is currently working hard on implementing Chat Control 2.0 with the purpose of monitoring all private communication.

I can vouch for the fact that Australian law enforcement view the usage of privacy software as suspicious internet activity.

Probably a big chunk of Fastmail's customers are in North America, so they probably host there for lower latency.

I specifically didn’t pick Fastmail because of their US-only setup. Luckily there are a bunch of other non-five-eyes providers available.

Reply on news.ycombinator.com