3 ms·

> FastMail is a cheap and easy option to email. So is spinning up a docker container with this all already configured... I just don't see the argument I guess,

> FastMail is a cheap and easy option to email. So is spinning up a docker container with this all already configured... I just don't see the argument I guess, it's just too easy to do yourself. Instead you're getting ripped off and losing privacy. There's no reason to believe fastmail is any more private than GMail, staff can just as easily read and deliver your mail to whomever they please. A medical degree takes years to get, this takes 10 minutes for a basic setup, an hour or two for a more advanced one, assuming you're in the industry already and know your way around.

JohnTHaller 10y ago
And ensuring it stays running and updated and secure and backed up. Docker isn't magic. A server instance and the associated apps still need to be maintained. And you're either trusting the creator of that Docker image or digging into every security setting anyway.
- ultramancool 10y ago
  Updated is usually barely a problem, there hasn't been a serious postfix vulnerability since 2011 or a dovecot one since 2013 (and even the 2013 one wouldn't necessarily affect you as an individual user). One update every 3-5 years is not exactly something I'd call a problem. I don't update unless there's a major vulnerability and it's one I'm affected by. Rebuilding your docker when you hear about that is not exactly something I'd consider a big deal, but I guess if 2 minutes work every 3 years is worth giving away your privacy, then you do that. Backup is a set and forget cron job (tarsnap mail dir), so I don't see how that's an issue.
  - toyg 10y ago
    You still have to update the OS or whatever you're running the mailserver on. You have to make sure it's not compromised nor DDosed, it doesn't run out of space, it doesn't crash or get stuck for whatever reason, etc etc. Again, Docker isn't magic.
    - ultramancool 10y ago
      Updating the OS... usually a fairly rare occurence again, kernel vulnerabilities that affect you with minimal services exposed are quite rare, most vulnerabilities are local escalations and such which wouldn't affect just a mail server. When was the last remote root exploit in the linux kernel? Maybe SSH which would be the only other thing you might run... Neither is within my memory. I suspect these would be ever less frequent than mail service updates, if ever. As for the rest those aren't really issues you need to actively watch, you'll just know when something goes wrong to take a look. I can't see running out of disk with just a mail service, crashes are... never and compromise/DDoS isn't really a risk if you secure it properly to begin with and update it that once every few years. It's really very hands off if you're not running any other services and just review the vulnerabilities. I'm guessing this is even less of a problem for most of us though because I and probably many others around here already run a personal dev server which is kept up to date regularly, so I was speaking simply to adding mail functionality to an existing system previously.
      - toyg 10y ago
        > I and probably many others around here already run a personal dev server Oh yeah, me too, and tbh it's enough of a pain already without having to deal with mail, spam and the likes. There is a reason that companies like Heroku exist and prosper; it's the same reason personal mail servers never saw mass-adoption, despite being one of the first things you could do on the internet. The anecdote that you find it easier than most doesn't change the reality of the matter.
        ultramancool 10y ago
        I just don't understand where the difficulty some people have in mind comes from so I'm trying to understand it better. You don't have to be bleeding edge to be secure against remote attacks, most of the configuration is trivial, I think more people would do it if it wasn't made out to be such a difficult thing for no real reason. Maybe if someone made an integrated mail server it'd be more common.
whorleater 10y ago
Native two factor auth (like U2F integration) alongside mobile apps would be the big ones.

JohnTHaller 10y ago

And ensuring it stays running and updated and secure and backed up. Docker isn't magic. A server instance and the associated apps still need to be maintained. And you're either trusting the creator of that Docker image or digging into every security setting anyway.

ultramancool 10y ago
Updated is usually barely a problem, there hasn't been a serious postfix vulnerability since 2011 or a dovecot one since 2013 (and even the 2013 one wouldn't necessarily affect you as an individual user). One update every 3-5 years is not exactly something I'd call a problem. I don't update unless there's a major vulnerability and it's one I'm affected by. Rebuilding your docker when you hear about that is not exactly something I'd consider a big deal, but I guess if 2 minutes work every 3 years is worth giving away your privacy, then you do that. Backup is a set and forget cron job (tarsnap mail dir), so I don't see how that's an issue.
- toyg 10y ago
  You still have to update the OS or whatever you're running the mailserver on. You have to make sure it's not compromised nor DDosed, it doesn't run out of space, it doesn't crash or get stuck for whatever reason, etc etc. Again, Docker isn't magic.
  - ultramancool 10y ago
    Updating the OS... usually a fairly rare occurence again, kernel vulnerabilities that affect you with minimal services exposed are quite rare, most vulnerabilities are local escalations and such which wouldn't affect just a mail server. When was the last remote root exploit in the linux kernel? Maybe SSH which would be the only other thing you might run... Neither is within my memory. I suspect these would be ever less frequent than mail service updates, if ever. As for the rest those aren't really issues you need to actively watch, you'll just know when something goes wrong to take a look. I can't see running out of disk with just a mail service, crashes are... never and compromise/DDoS isn't really a risk if you secure it properly to begin with and update it that once every few years. It's really very hands off if you're not running any other services and just review the vulnerabilities. I'm guessing this is even less of a problem for most of us though because I and probably many others around here already run a personal dev server which is kept up to date regularly, so I was speaking simply to adding mail functionality to an existing system previously.
    - toyg 10y ago
      > I and probably many others around here already run a personal dev server Oh yeah, me too, and tbh it's enough of a pain already without having to deal with mail, spam and the likes. There is a reason that companies like Heroku exist and prosper; it's the same reason personal mail servers never saw mass-adoption, despite being one of the first things you could do on the internet. The anecdote that you find it easier than most doesn't change the reality of the matter.
      - ultramancool 10y ago
        I just don't understand where the difficulty some people have in mind comes from so I'm trying to understand it better. You don't have to be bleeding edge to be secure against remote attacks, most of the configuration is trivial, I think more people would do it if it wasn't made out to be such a difficult thing for no real reason. Maybe if someone made an integrated mail server it'd be more common.

whorleater 10y ago

Native two factor auth (like U2F integration) alongside mobile apps would be the big ones.