8 ms·

Rule Zero: Never rely on a URL that you don't control. Use your own domain name for your e-mail addresses. Use your own domain name for canonical links to conte

Rule Zero: Never rely on a URL that you don't control. Use your own domain name for your e-mail addresses. Use your own domain name for canonical links to content. If you control the URLs, you do not depend on any one provider. Rule One: If you only have one copy, you have no copies. It is an act of faith to assume that a Youtube video or a file in Google Drive will remain available, just as it's an act of faith to assume that a hard drive will never fail. Anything from a hacker to a natural disaster could destroy your data. The "cloud" is made of servers, not magic. If you follow these two rules, you have nothing to fear. Google could suspend my account tomorrow and it would be nothing more than an inconvenience. I change a couple of DNS records, restore some data from nearline and I'm back in business like nothing happened.

indiv0 10y ago
While I'm in complete agreement with you (everyone should be responsible for protecting and ensuring the integrity of their data), it seems a little unreasonable to expect the average gmail user to purchase a domain name, link it to an email provider, (optionally) migrate their emails, etc. Same goes for YouTube videos. Content creators typically maintain copies of their work, but casual youtubers don't.
- jdietrich 10y ago
  I don't think it is unreasonable. I think we've fallen into a culture of low expectations regarding the ability of "normal users". Many people will (perfectly legitimately) choose convenience over quality or reliability, but I think we should be pushing users to engage more seriously with the tools that they use. We can certainly do more as developers to make things easier, but I think we have a tendency to pander to an imaginary "AOL granny". We often present oversimplified advice, because we expect too little of users. To pick a random example, I think we're too eager to say "use Dropbox" rather than "use Dropbox, but buy yourself a NAS too because X, Y and Z". I think that there's a substantial latent desire among ordinary users to have more control over their technological lives. People are increasingly worried about the power of big tech companies, but they don't know what to do. We aren't doing a good enough job of informing users; those big companies have an obvious incentive to keep users uninformed. We're not communicating the risks and benefits well enough, we're not providing clear explanations of the alternatives to the Big Five. In the process of writing this comment, I've had several startup ideas. I hope that the people reading this are having ideas of their own. I think that there are substantial opportunities to start returning control to users.
  - xyzzy123 10y ago
    For a whole variety of reasons, you need know what you're doing to properly host your own email now. From the risk of domain name takeover, to hosting provider takeover, to modern spam requirements (ip reputation, dkim, spf, dmarc), to just plain sysadmin ability and ideally run an HA system. Agree that there are probably some startup opportunities, but the the reality is that you'll just be transferring the user's trust from AmaGooFaceSoft to you. You might be more trustworthy... or you might go out of business. EDIT: To be fair, I'm probably missing a whole bunch of creative solutions that give the user control without requiring them to run a service.
    - jdietrich 10y ago
      There are a whole spectrum of options between "running a mail server in your basement" and "having to reprint your business cards if your Google account is suspended". We can make big steps towards trustworthiness and control in SaaS, it's just often orthogonal to profitability. Lock-in is the obvious example. Lots of vendors expend huge efforts to simplify data ingress, but create arbitrary obstacles to data egress. We worry about SaaS providers going bust because we're inured to the idea that getting your data back is really difficult. The interests of the user do not align with the interests of the vendor. Predatory practices are so normal that we've half-forgotten that they're predatory.
    - kuschku 10y ago
      Quite a few you're missing indeed. Many ISPs give out a domain name and email service for free with internet contracts — you can set it to redirect to gmail until you need it, then just switch it over. Tada, problem solved.
      - ucaetano 10y ago
        Until your ISP closes your account for whatever reason.
        kuschku 10y ago
- elcct 10y ago
  I think someone who figures out an easy way to do it will get some nice money coming in :) Technology is already there, just need an easy way to order a domain and a server configured to use that domain. You control 100% of the data.
hellofunk 10y ago
This is the opposite advice I've heard after reading about scenarios like this: https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532
- jdietrich 10y ago
  The fault in that case lies entirely with GoDaddy's poor security. Use a competent registrar, preferably one that supports 2FA with a hardware token. https://konklone.com/post/protect-your-domain-name-with-two-factor-authentication https://konklone.com/post/protect-your-domain-name-with-two-...
ucaetano 10y ago
And do you ever control an URL? No, you don't. So the only way to satisfy Rule Zero is by never engaging in any URL-related activity.
- jdietrich 10y ago
  >And do you ever control an URL? No, you don't. Well, yes. If I own a domain name, I can point that domain at any resource I choose. I might be technically "renting" the name from a registry via a registrar, but for all practical purposes I'm in control of it.
  - ucaetano 10y ago
    Until a government, registry or large ISP decides to take that control from you, which can happen nearly instantly. Or someone uses social engineering to take the domain from you: https://en.wikipedia.org/wiki/Sex.com https://en.wikipedia.org/wiki/Sex.com
ap22213 10y ago
Does anyone provide a service to set this scheme up easily? I'd pay $$$ if all of my 'cloud' content and accounts could be migrated to something like this. I just don't have the time to set it up or manage it.
fest 10y ago
Can you access Nearline (Google Cloud product) when your google account is suspended?
- jdietrich 10y ago
  I was referring to nearline in the generic sense; I was unaware that Google had a product with that (rather confusing) name.
nilved 10y ago
> Rule Zero: Never rely on a URL that you don't control. Use your own domain name for your e-mail addresses. Use your own domain name for canonical links to content. If you control the URLs, you do not depend on any one provider. You do not own your domain name. It's better than using google.com, but your domain name can be stolen or seized just as well.
- jdietrich 10y ago
  Domains can be stolen or seized, but somehow the internet still manages to function. If you're not doing anything silly or shady, domain names are extremely durable. They're certainly more durable than an e-mail address or a subdomain on someone else's domain, more durable than a phone number or a street address. If you can choose only one identifier by which people can contact you, there is no better choice than a domain name under your own control.
  - nilved 10y ago
    Your definition of "silly" or "shady" might not be congruent with every other person's. com domains have been seized for a variety of reasons. However, them being stolen is much more likely. As a security-inclined person, the domain registrar is the first thing I would target as an adversary. Very often they don't have 2FA; and once you have access, e-mail follows. It goes without saying that this is only a small part of a bigger picture; using your own domain name is a good idea, but not a perfect solution.
    - oridecon 10y ago
      Not to mention they are stealing not only your e-mail data but your entire digital identity. Now they can reset the password of all your accounts, send e-mails in your behalf, buy things in your name. I just don't trust DNS, domain registrars and all the things I would need to secure to have a custom domain e-mail.

indiv0 10y ago

While I'm in complete agreement with you (everyone should be responsible for protecting and ensuring the integrity of their data), it seems a little unreasonable to expect the average gmail user to purchase a domain name, link it to an email provider, (optionally) migrate their emails, etc. Same goes for YouTube videos. Content creators typically maintain copies of their work, but casual youtubers don't.

jdietrich 10y ago
I don't think it is unreasonable. I think we've fallen into a culture of low expectations regarding the ability of "normal users". Many people will (perfectly legitimately) choose convenience over quality or reliability, but I think we should be pushing users to engage more seriously with the tools that they use. We can certainly do more as developers to make things easier, but I think we have a tendency to pander to an imaginary "AOL granny". We often present oversimplified advice, because we expect too little of users. To pick a random example, I think we're too eager to say "use Dropbox" rather than "use Dropbox, but buy yourself a NAS too because X, Y and Z". I think that there's a substantial latent desire among ordinary users to have more control over their technological lives. People are increasingly worried about the power of big tech companies, but they don't know what to do. We aren't doing a good enough job of informing users; those big companies have an obvious incentive to keep users uninformed. We're not communicating the risks and benefits well enough, we're not providing clear explanations of the alternatives to the Big Five. In the process of writing this comment, I've had several startup ideas. I hope that the people reading this are having ideas of their own. I think that there are substantial opportunities to start returning control to users.
- xyzzy123 10y ago
  For a whole variety of reasons, you need know what you're doing to properly host your own email now. From the risk of domain name takeover, to hosting provider takeover, to modern spam requirements (ip reputation, dkim, spf, dmarc), to just plain sysadmin ability and ideally run an HA system. Agree that there are probably some startup opportunities, but the the reality is that you'll just be transferring the user's trust from AmaGooFaceSoft to you. You might be more trustworthy... or you might go out of business. EDIT: To be fair, I'm probably missing a whole bunch of creative solutions that give the user control without requiring them to run a service.
  - jdietrich 10y ago
    There are a whole spectrum of options between "running a mail server in your basement" and "having to reprint your business cards if your Google account is suspended". We can make big steps towards trustworthiness and control in SaaS, it's just often orthogonal to profitability. Lock-in is the obvious example. Lots of vendors expend huge efforts to simplify data ingress, but create arbitrary obstacles to data egress. We worry about SaaS providers going bust because we're inured to the idea that getting your data back is really difficult. The interests of the user do not align with the interests of the vendor. Predatory practices are so normal that we've half-forgotten that they're predatory.
  - kuschku 10y ago
    Quite a few you're missing indeed. Many ISPs give out a domain name and email service for free with internet contracts — you can set it to redirect to gmail until you need it, then just switch it over. Tada, problem solved.
    - ucaetano 10y ago
      Until your ISP closes your account for whatever reason.
      - kuschku 10y ago
elcct 10y ago
I think someone who figures out an easy way to do it will get some nice money coming in :) Technology is already there, just need an easy way to order a domain and a server configured to use that domain. You control 100% of the data.

hellofunk 10y ago

This is the opposite advice I've heard after reading about scenarios like this: https://news.ycombinator.com/item?id=7141532 https://news.ycombinator.com/item?id=7141532

jdietrich 10y ago
The fault in that case lies entirely with GoDaddy's poor security. Use a competent registrar, preferably one that supports 2FA with a hardware token. https://konklone.com/post/protect-your-domain-name-with-two-factor-authentication https://konklone.com/post/protect-your-domain-name-with-two-...

ucaetano 10y ago

And do you ever control an URL? No, you don't. So the only way to satisfy Rule Zero is by never engaging in any URL-related activity.

jdietrich 10y ago
>And do you ever control an URL? No, you don't. Well, yes. If I own a domain name, I can point that domain at any resource I choose. I might be technically "renting" the name from a registry via a registrar, but for all practical purposes I'm in control of it.
- ucaetano 10y ago
  Until a government, registry or large ISP decides to take that control from you, which can happen nearly instantly. Or someone uses social engineering to take the domain from you: https://en.wikipedia.org/wiki/Sex.com https://en.wikipedia.org/wiki/Sex.com

ap22213 10y ago

Does anyone provide a service to set this scheme up easily? I'd pay $$$ if all of my 'cloud' content and accounts could be migrated to something like this. I just don't have the time to set it up or manage it.

fest 10y ago

Can you access Nearline (Google Cloud product) when your google account is suspended?

jdietrich 10y ago
I was referring to nearline in the generic sense; I was unaware that Google had a product with that (rather confusing) name.

nilved 10y ago

> Rule Zero: Never rely on a URL that you don't control. Use your own domain name for your e-mail addresses. Use your own domain name for canonical links to content. If you control the URLs, you do not depend on any one provider. You do not own your domain name. It's better than using google.com, but your domain name can be stolen or seized just as well.

jdietrich 10y ago
Domains can be stolen or seized, but somehow the internet still manages to function. If you're not doing anything silly or shady, domain names are extremely durable. They're certainly more durable than an e-mail address or a subdomain on someone else's domain, more durable than a phone number or a street address. If you can choose only one identifier by which people can contact you, there is no better choice than a domain name under your own control.
- nilved 10y ago
  Your definition of "silly" or "shady" might not be congruent with every other person's. com domains have been seized for a variety of reasons. However, them being stolen is much more likely. As a security-inclined person, the domain registrar is the first thing I would target as an adversary. Very often they don't have 2FA; and once you have access, e-mail follows. It goes without saying that this is only a small part of a bigger picture; using your own domain name is a good idea, but not a perfect solution.
  - oridecon 10y ago
    Not to mention they are stealing not only your e-mail data but your entire digital identity. Now they can reset the password of all your accounts, send e-mails in your behalf, buy things in your name. I just don't trust DNS, domain registrars and all the things I would need to secure to have a custom domain e-mail.