Hacker News Reader

Comment by rsync | Hacker News Reader

If you don't host your own mail server, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

If you don't host your own mail server, you are a clown-person

Where can I get a pair of size 47 shoes, a banana-yellow suit, and a lime-green wig? I am a programmer, not an IT administrator. I know nothing about which patches are required to keep a server secure, nor should Ihave to.

Being familiar with the technology for making programs has the same relationship to maintaing a publicly facing server as being familiar with the technology for making buildings has with operating a property-management, real-estate leasing, and property security firm all in one.

It's great that you and many others have these skills, it's not a dichotomy, but they are loosely related.

Nonsense. Setting up a properly configured and secured mail server, and keeping it that way, takes time and is not a core value proposition for most of us. It makes complete sense to want to outsorce something like that.

And it doesn't protect any mail you wrote or received that's still in the recipients inbox or the senders "sent mail" folder. So it's a complete waste of time for that purpose.

Yep. It's exactly the same problem using any kind of privacy encryption: If both parties don't use it, it's useless.

I stand by my original assertion.

Which contributes neither enlightening discussion nor useful solutions to the discussion at hand.

You have expressed your contempt for people who don't run their own mailservers; but your contempt is only an ego assertion. Your contempt, unless based on facts, and rational arguments taking into account the reality of people who have other things to do than learn whatever esoteric skills you've chosen to base your self-worth around; is of no interest to the rest of the people reading HN.

I run my own mailserver; therefore you should listen to me.

if the above statement seems ridiculous (which it is), it is merely the mirror of your original assertion.

Running your own mailserver is so basic of a technical skill that it is neither esoteric, nor is it something to be egotistical about. The name of the site is "hacker news" for Gods sake.

Second, there's nothing I'm asking you to "listen to". My point was that a lot of the wringing of hands and gnashing of teeth has no legitimacy without having taken the simplest, most elementary, first order step towards fixing this problem.

Come back and complain about your bad roast after you've actually ... you know ... turned your oven on.

I know how to run my own mail server - I have set up a couple. L still don't because my setups tend to be inferior security and feature wise to those of people that do nothing but run mailservers every day of the week. I could argue that building mailservers is such a basic skill that everybody should be capable of doing it. Or building a house. Or growing your own food. Neither you nor I do that even though growing your own food is the simplest, most basic step to solving a ton of problems in the food industry.

As I and others pointed out your most basic step does not solve the problem and you can just move to a different provider that is not subject to American laws to have the hsame effect.

You're also not required to have any technical skills at all to gnash your teeth about a government that tries to expand surveillance in every possible place. For some places you might have a technical solution such as running your own mail server at home, but what are you going to do once hacking of mail servers without a warrant is permitted and common place? Counter-Hack? As hackers we try to find technical solutions to social problems, but that's not going to work out in every place.

Well, again, my point was not that you're a clown for not growing your own food, my point was that you're a clown for regularly attending (and participating in) the farmers forum, having a shed full of farming implements, etc., and then complaining about the bad cucumbers at the store.

As I said, Joe 6 pack has an excuse (just like Joe Startup has an excuse not to be cultivating his own heirloom seeds).

And yes, I'm aware that email as a whole is just a mess, and that running my own mail server does nothing to combat a global observer that can just intercept all traffic anyway... but the big, big win is that my entire existing email history cannot be extracted by any LEA in the country (and possibly foreign) without my even knowing about it. The local sheriff cannot subpoena my entire email history. They have to come to me.

Another huge win is that you can communicate with others that share your mailserver without the email leaving the system - which thwarts even a global observer. It may interest you to know that no piece of rsync.net intra-company email has ever traversed any network.

How can I, as a somewhat proficient non-techie, accomplish that without having to dedicate a 24/7 *nix box from home?

Please, if anyone knows a simple, yet elegant solution, I'm all ears.

you can use encrypted mail, however that requires you to convince all people that you exchange mails with to use encrypted mail as well.

You could use a hosted email service in another country where the american authorities don't have easy access. Europe might be an option. However, as with hosting your own email server, that's only a partial solution: If you communicate with other people, your mail is not only stored in your inbox but also in their outbox. So they'd have to use a mail provider outside the US as well - see the first paragraph.

The best is probably a hybrid solution: Try to educate as many people to use encrypted mail as you can and use a mail server that's located outside the US. It doesn't provide 100% protection, but at least you're not part of the dragnet search.

Errr... the NSA is specifically charged with monitoring communications that cross US national borders.

Using a mailserver in a foreign jurisdiction makes it more open to legal interception by the US government; not less.

Valid point. It's a different branch and a different issue though. Mails that are already on your server and stored there would be relatively safe. Make sure communication is encrypted.

You could use a local email program and set it to download then purge your mail from the server. That way it's not in their possession for more than 180 days. But you are then responsible for your own backups etc.

... assuming that when you delete it, they delete it -- which I wouldn't assume.

An alternative to postfix:

To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also, you would likely need to setup a POP server to download your messages from the server.

[1] https://github.com/baudehlo/Haraka

I don't think that addresses the issue of needing a dedicated box to store your email; i.e. you still need that POP server.

Wouldn't they be able to access cloud systems such as AWS, Linode or Heroku as long as it hosts e-mail systems?

That's going to be an interesting question. If you host on linode or google apps or pair.com, is that a server under your control, or a third party.

I would call it a server under your control, the same as a store in a strip mall is under your control, not the mall owner.

But which way does anyone think that's going to go? Not the right way is my assumption.

However, if all your data is encrypted once it rests on the box, you'll at least know you're being probed when they subpoena your keys.

I've been researching doing this for a while, but there's one big caveat that I can't get past- there's no decent server solutions for push mail. For desktop computers there's IMAP IDLE, but all the push solutions Apple's software uses are based on Microsoft Exchange (expensive).

I'm all ears too.

Zarafa works wonderfully and is a snap to setup.

Edit:

Here are the docs for the latest 7.1 branch: http://doc.zarafa.com/7.1/

And here is the link to the community (open source) section of their site: http://community.zarafa.com/

I keep hearing the name. I'm going to chuck it onto a VM and try it out.

I'm running it on two small sites (< 50 users each) and it works as advertised. The nice thing is, it isn't monolithic - you choose the MTA and web software (in my case postfix and apache) and it uses mysql as the backend.

The webmail interface is the best opensource one I've come across (easily beats redcube) and active sync works fine with iphone 4/5 and android.

lol freudian slip! Redcube should have read Roundcube :D

Mail servers are ridiculous PITAs. If it was something simple like installing Apache, you may be right, but it seems every mail server uses its own esoteric configuration conventions and requires a lot of legwork even to get a basically functional mail system together (Postfix+Dovecot+SpamAssassin+ClamAV), that you get for free with Gmail.

And unless you host the server in your residence (disallowed on most residential ISPs), you're still not going to have control over whether someone has a warrant or not when they look at your mail.

The answer is "encrypt all messages". Every other day I could comment on a post to which the answer is "encrypt [thing]". PGP is so important and yet it's nearly impossible to get anyone to use it.

While this might prevent government to look into archive of yours emails, this will not completely prevent monitoring. As long as email will leave from server within USA it can be tracked since most emails are transmitted in clear text. Solution is to use GPG or similar tool to encrypt email content, but you need both parties to use it which is not so easy.

If you don't run your own post office, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

I really LOL ;-)

Yes, Google-Yahoo-MSN, they have the best spam filters because they receive more spam than anyone--that allows them to identify it faster and more accurately. I doubt SpamAssassin will ever match them. Wasn't very effective for me, false-positives are the worst. And seems to me a mail server is just another open door for hackers and spammers to walk in and use your memory and CPU 99.99% of the day. So call me a clown-person. Like someone already said, mail servers are cryptic, complex and unwieldy and I think that's been true since at least the 90s. Not to mention, webmail is really convenient and fast and reliable. Last time I used an email client was the time I had to download 200 worms from POP before I could see my real email.

Reply on news.ycombinator.com