Hacker News Reader

Comment by ryandrake | Hacker News Reader

There doesn't seem to be a good solution. Self-Hosting E-mail requires a high degree of technical wizardry, but relying on a cloud E-mail host means you are one inadvertent TOS violation away from losing access to your entire identity (all password reset features ultimately rely on access to E-mail).

View on HN

Which is why you split the difference. Own your own domain, and host at a reputable, reliable mail service provider like Fastmail. If you get taken down by a TOS violation, you didn’t lose your email address, just the contents of your inbox — which you hopefully have backed up, at least in your local mail client. Update your MX records to a new mail provider, and you haven’t lost what’s essentially your digital identity at many SaaS services.

Everyone in my family has their own domain. The instructions for renewing a domain, a list of reputable mail service providers, and instructions for pointing MX records at a new service provider, are not very complicated for somebody that can work a computer at a basic level of productivity. Many email service providers will even run nameservers on your behalf so you don’t even have to mess with individual DNS records. You can fit that in about one formatted page of instructions to include in your online contingency plan you share with love one(s).

Note also that a dedicated email service like Fastmail has a lot fewer ways you can accidentally violate TOS than, say, GMail. Your google account can get TOS'd for activity on YouTube, Drive, Chat, Photos, Docs, Blogger, etc. When was the last time you heard about someone getting TOS'd for the contents of an email being misunderstood?

> Which is why you split the difference. Own your own domain, and host at a reputable, reliable mail service provider like Fastmail.

I do the same, but your argument is a little dishonest: You can lose your custom domain and lose your provider account, so you've essentially gone from one point of failure to two.

The novelty domain is totally worth it though, at least to me.

Honestly, the state should provide every citizen an official email address and make it a requirement that every invoice, contract etc is provided to this account...

Not sure about the privacy ramifications if that though.

You mean wrt the state provided email address?

That's solvable issue with multiple solutions.

I.e. making the address routeable to another provider by configuration. Imagine an address like yourchoice@$identifier.TLD.mail

The state could give you the option to set the MX record for this subdomain to a provider of your choice

You can use your own domain with commercial email hosters, and switch hosters when needed. The important thing is to have your domain at a registrar that is not also your email hoster.

I also don’t know why GP has to “log in at the registrar to constantly renew the domain”. Auto-renewal exists. I haven’t lifted a finger for any of my domains for many years.

Not only that but you can renew most domains for many years. I have mine paid up for 10 years.

With a MS/Gmail/etc. account you're also a violation away from losing your identity. At least with your own domain you can port it over to any hoster you like as the domain remains yours.

For my website, I own the url and pay siteground to host it. If siteground and I have a falling out, I can take my content and my url somewhere else. Isn't the same true for email addresses associated with that domain? Can't you get another cloud provider to host, so you can always access email-based password recovery? (I'm ofc talking about @mypersonaldomain.com addresses, not @gmail.com or whatever.)

Nobody owns a URL. You lease them at the registrar’s leisure by following your registrar’s policies.

Well, if you own the domain you can point the MX record elsewhere if one host starts jerking you around. Of course you can have problems at the registrar level, but having used 100% self-hosted email, 100% hosted email (their domain) and hosted email pointed at by my domain, IME the hosted but my domain option is the most resilient.

My as-yet unlaunched solution to this is mutual.email - mutual, as in mutually owned. The idea is to have democratic, member led decision-making, while eventually farming out the technical work to a managed hosting provider, or staff. One of the key criteria is that it should be able to outlive any of the parties involved in using or delivering it - something only an organisation can do.

I pay for an email address connected to a domain that I own. It's fairly inexpensive and I could switch email providers relatively easily.

How often do people break a TOS? I’m not sure that’s a problem normal people should worry about. There’s always a TOS, whether it’s at the email service or the ISP or the data center.

I don’t know why this is getting downvoted. If you self-host your email, you are still beholden to your ISP’s TOS. Maybe it’s an improvement because it’s less likely you’ll be found infringing, but it’s still quite real.

Let’s not forget your domain registrar either…

It seems every couple of weeks we have a new "I was banned by $COMPANY_X and lost access to everything! They won't tell me why." HN article. It's probably rare, but happens often enough and the consequences are severe enough that it's a risk worth considering.

It's likely a lot more rare to get banned from your VPS or ISP than it is to get banned from something like Google, since who knows what the rules are there? Your kid could upload an inappropriate video to YouTube or something, and they'll associate IPs with your account and suddenly you lose access to Gmail.

Yeah, it just happened to me a while ago. Banned from an online game inexplicably, for something I am absolutely innocent of. Their support team refused to do anything, assured me "the ban is correct". Only got lifted because of knowing someone who knew someone and was able to have it actually looked into, rather than the usual non-investigation you'd typically get. I know numerous people who have lost their entire Microsoft or Google account (or other services), with zero explanation, zero recourse, just everything permanently nuked. This can happen to anyone at any time, as erroneous false positives happen seemingly arbitrarily.

You generally don’t self-host your email via your ISP, you use a VPS, and you can switch that at will.

I haven’t heard of any case where a domain registrar took away a domain other than as a consequence of criminal prosecution or court orders.

In any case, it’s far more robust than e.g. Google shutting down your account for unknown reasons.

The problem is not breaking TOS in general. In general if that happens because of you, you simply apologize to the company, pay a fee or something and continue. The problem is breaking TOS of the internet monopolists. If that happens you don't know if you broke the TOS at all, if yes, then what part of it, how to remedy it and what the rules are in general. Instead you are nuked from existence with all dependent services immediately and forever, have zero recourse or understanding because reasons are always secret, so you can't even dispute a mistake of a dumb script on their side or abuse of third party (i.e. fraudulent DMCA strike). And after erasing your existence, Google or Facebook will sic their shitty scripts on you, to prevent you ever interacting with their services.

Not all TOS are equal, and not all services are equally important and have same severity.

The main threat for normal, well-behaved people is the growth of services that encourage us to put all our eggs in one basket, multiplying the routes by which you might attract the wrath of The TOS Overlords.

An example would be the number of people who don't want to issue perfectly valid chargebacks against Amazon because they'll lose access to digital purchases (kindle, audible, etc) in retaliation.

So more on-topic, it's conceivable that, for example, you have a dispute over a Google Play purchase, and in trying to exercise your consumer rights, you lose your access to your gmail account.

You don't need to be a troll to be violating a TOS, "if they're being punished they must have deserved it" is no more valid online than off.

Yes, this is exactly where I was going with the TOS comment. To take this risk to the extreme: Imagine in the coming future, when every service you rely on or use comes from the same company, and any TOS violation or dispute on one of those services gets you banned from the rest of them. That's the world of hosted services we are slowly moving towards.

I see, I guess I should have specified that I was talking more about email services like Fastmail, where you are just paying for email and if you break the TOS you probably were doing something absolutely bone-headed, and if not then you can just move your domain easily and take your email backups to another provider. Another example would be using some GUI or CLI utility and any generic S3 service to backup data, where you can move the backup to any S3 service you want to. I think that's a reasonable medium between losing everything because you put all your eggs in one basket with Google or with your HomeLab. Family can pretty easily pickup a Fastmail account and understand how to work it, and the same with a simple backup program on each computer plus S3 storage. I feel like this is the "golden path" through the middle of today's SaaS economy without having to train a replacement from your family like you're running an IT dept.

tl;dr: Everyone keeps saying Google/Facebook/etc but I am talking about hosting your services with individual corps, not "all eggs in one basket" style.

Unless you're in the habit of regularly getting into serious social trouble (as opposed to the normal, run-of-the-mill, unserious social trouble), the risk of violating that TOS and getting kicked off the platform is likely much lower than the risk of the proverbial parent poster getting hit by a bus.

If you think I'm being facetious, I'll point out that at this point, I have several hundred person-years under my belt of the use of various online services, and I've not had issues with getting unfairly banned from them.

I do, however, expect to die, and anything I built to crumble to dust and bitrot long before I have several hundred person-years of life under my belt.

I, personally, worry more about a Google algorithm deciding I'm trying to hack my own account, a la https://news.ycombinator.com/item?id=34116361 / https://news.ycombinator.com/item?id=31681221 , than I do about a ToS violation.

Sure. TOS isn't the only risk factor.

I still think you're far more likely to die (or suffer some other situation where you're unable to properly maintain your homebrew house of cards) before you experience it in your lifetime.

If it's your hobby, that's great, its a productive way to stay busy, and it teaches you things! But in long-term use, if I inherited a home-built dishwasher from my dad, or my spouse, I'd probably just junk it and buy a Bosch at the first sign of trouble from it.

I agree that sticking with an unmaintained house of cards isn't a great idea, and I agree that fully self-hosted email is pretty likely to be jank in one way or another - I'm just trying to push back a little on two ideas floating around in this thread: 1) any deviation from the fully-hosted happy path is necessarily a house of cards and 2) the fully-hosted happy path doesn't have risks of its own

Specifically, I have a domain prepaid for a decade pointing at a mail host prepaid for a decade. I've had this setup for decades and it has literally never broken. In this timeframe I and many friends and family been locked out of Google accounts for one reason or another. If I had to bet money on a family member's ability to access this setup after I have an unscheduled meeting with a bus, vs. their ability to maintain access to a Google account, I'd bet on my setup, not least because that setup involves actual (pre)paid support.

So yeah - house of cards bad, but some degree of control doesn't have to mean house of cards. I think we're mostly in agreement - just wanted to try to outline where I'm coming from a little more specifically.

Receiving e-mails is easy sending them on the other hand can be a huge pain in the ass. But you can self host and use a service to send e-mails (smarthost is the keyword).

Lower likelihood of my getting banned than my dying imho. It's just a risk assessment and I've landed here.

Reply on news.ycombinator.com