9 ms·

these articles push me more and more to drop using gmail in favor of "self hosted email". i really do not understand why we do not think and give it all up for

these articles push me more and more to drop using gmail in favor of "self hosted email". i really do not understand why we do not think and give it all up for free to google (and compromise our personal security in the mean time).

Navarr 10y ago
I think Google fought very hard for it's case. "Self Hosted" is certainly not going to fare much easier in this same situation. I do not think that the same result would be had if Google was refusing to deliver data on a non-US server for a non-US citizen.
- solotronics 10y ago
  I think that in this specific case Google was able to push back much harder than a typical individual would. Who can afford a team of world class lawyers to go up against the fed?
  - SEJeff 10y ago
    And they can still appeal potentially up to SCOTUS.
- Spivak 10y ago
  Self-hosted would absolutely fare better in this situation. It's not perfect, but at least you would know you're being investigated. This whole mess is predicated on the fact the government is allowed to request your data from Google without much fanfare because they are technically in possession of it. The DOJ was able to successfully argue that user emails are actually business documents owned by the email provider. This breaks down when the person they are investigating is also the email provider.
  - Navarr 10y ago
    You'd have to own the server too, at that point. If you were a VPS or even a dedicated lease, or shared - I think the fed would be able to pull the same thing.
    - donald123 10y ago
      Doesn't matter if you encrypt your emails, since you have control of your server. Let the fed have the encrypted data.
      - deleted 10y ago
        [deleted]
      - fixermark 10y ago
        ... at which point you might get to rot in jail for contempt until you fork over the decryption key. I don't have a convenient link to the xkcd comic right now that talks about the difference between theoretical and practical security. ;)
        Roujo 10y ago
        To quote Spivak higher up in the comment chain: > It's not perfect, but at least you would know you're being investigated.
        donald123 10y ago
        Am I gonna be jailed for refusing to decrypt my files?
        fixermark 10y ago
        IANAL, but my understanding of current American law is that if the material is deemed by a judge to be evidence, and you can decrypt it, and you won't decrypt it, you can be held in contempt of court.
        10y ago
  - sfifs 10y ago
    > It's not perfect, but at least you would know you're being investigated. And this basically is the reason multi national companies self host email servers
stuckagain 10y ago
If the feds want your "self hosted" emails they will break down your door, shoot your dog, and take every computer-resembling object on the premises.
- wyager 10y ago
  It's a lot more effort than just asking google. The goal behind practical security is to make things expensive, not impossible.
- derefr 10y ago
  You could "self-host" on a cloud server in, say, China, or Russia, or Iran (if they have any hosting services.) I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care. And they have no treaties with the US to force their hand to turn anything over. Think of your server as Edward Snowden. What country should it hide in, so the US can't legally get to it?
  - confounded 10y ago
    Iceland.
  - st3v3r 10y ago
    "I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care." Can't you say the exact same thing about the US government?
  - usernametbd 10y ago
    > they have no treaties with the US to force their hand to turn anything over Sure, but that doesn't mean they won't happily exchange that info as part of a deal with the US, assuming your data is valuable enough.
  - sfifs 10y ago
    You're forgetting the possibility of rubber hose cryptanalysis applied on you. In fact just by hosting in such places, you're probably inviting more attention.
derefr 10y ago
* Gmail's search and spam-filtering are both very good, trained and tuned on datasets no self-hosted product could ever match (and harnessing parallel algorithms across large clusters that'd be quite costly on one machine) * Google doesn't lose my email; I probably will lose my email, because an email server is backed by a database and doing database backups right is hard if that is not your day-job. * You can get a good email-receiving experience, but email-sending is very difficult these days if you're a nobody, because a lot of first-stage network-level spam filtering has come down to reputation, and your server IP won't have any (or, if it's a cloud provider IP, will have very likely been used at least once to send spam in the past.) And residential ranges get dinged, too, from the heuristic (stereotype) that the most likely reason to get an SMTP connection from a residential IP is that it's a member of a botnet.
- SomeCallMeTim 10y ago
  > Google doesn't lose my email; I probably will lose my email, because an email server is backed by a database and doing database backups right is hard if that is not your day-job. I use IMAP email. My email is simultaneously stored on my server and on every client. If the server is nuked, I can set up a new IMAP server elsewhere and sync my email client to it; I'd want to do this from work where I have gigabit internet, or this would take a while, but it can re-upload all the data to the server. That said, I'm using a managed account. I'm not communicating about anything that I care if the government subpoenas, and I have no plans to. Unless we end up in a totalitarian state where constructive criticism of the government becomes an offense. But in that case my public posts would be more than enough to convict me without looking at my emails.
- djsumdog 10y ago
  > Gmail's search and spam-filtering are both very good Google/Microsoft's spam filtering makes it impossible to send e-mail from a self-hosted solution. http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/ http://penguindreams.org/blog/how-google-and-microsoft-made-... Unless you're sending out thousands of e-mails per day and build your reputation with their magic-goo trust filter algorithm, you cannot run your own e-mail server and run with the big players. They have made self-hosted e-mail totally unreliable. I think what you meant by "very good" is "piss fucking terrible."
uladzislau 10y ago
Especially when Gmail is not as reliable as we used to think. Gmail DOES loose emails. http://uladzislau.com/gmail-emails-missing/ http://uladzislau.com/gmail-emails-missing/
- pklausler 10y ago
  > Gmail DOES loose emails. Sounds like a tagline for an erotic movie, that does. I think you meant "lose".
  - frogpelt 10y ago
    To be fair, English is difficult. Lose could rhyme with rose or close. But it doesn't. Instead it rhymes with cruise, clues, two's, moos, and choose (almost).
- stuckagain 10y ago
  Lunatic conspiracy theories about what Google does with email abound. There are several likely and reasonable explanations for why you can't find the mails you expect. Two of the most likely being 1) the messages were never acknowledged with a 220 response from gmail's smtp protocol translators to begin with; 2) the messages were accepted but are still in flight for some reason. Gmail does not accept and then silently drop messages. If they are accepted, they will be delivered.
wyager 10y ago
I recently switched from gmail to ProtonMail. Not self-hosted, but (theoretically) encrypted while at rest using a GPG key derived from my password. Definitely an improvement. If you really want SMTP, as I understand it they have an "SMTP bridge" software that you host yourself that uses ProtonMail as a backend. Seems like a good compromise. You don't have to worry about constant uptime or disk failure, but your data is still fairly well protected.
- megous 10y ago
  You probably don't need constant uptime. Sending server will try to deliver for a day or two, usually. Legitimate servers use sending queues.
deleted 10y ago
[deleted]

Navarr 10y ago

I think Google fought very hard for it's case. "Self Hosted" is certainly not going to fare much easier in this same situation. I do not think that the same result would be had if Google was refusing to deliver data on a non-US server for a non-US citizen.

solotronics 10y ago
I think that in this specific case Google was able to push back much harder than a typical individual would. Who can afford a team of world class lawyers to go up against the fed?
- SEJeff 10y ago
  And they can still appeal potentially up to SCOTUS.
Spivak 10y ago
Self-hosted would absolutely fare better in this situation. It's not perfect, but at least you would know you're being investigated. This whole mess is predicated on the fact the government is allowed to request your data from Google without much fanfare because they are technically in possession of it. The DOJ was able to successfully argue that user emails are actually business documents owned by the email provider. This breaks down when the person they are investigating is also the email provider.
- Navarr 10y ago
  You'd have to own the server too, at that point. If you were a VPS or even a dedicated lease, or shared - I think the fed would be able to pull the same thing.
  - donald123 10y ago
    Doesn't matter if you encrypt your emails, since you have control of your server. Let the fed have the encrypted data.
    - deleted 10y ago
      [deleted]
    - fixermark 10y ago
      ... at which point you might get to rot in jail for contempt until you fork over the decryption key. I don't have a convenient link to the xkcd comic right now that talks about the difference between theoretical and practical security. ;)
      - Roujo 10y ago
        To quote Spivak higher up in the comment chain: > It's not perfect, but at least you would know you're being investigated.
      - donald123 10y ago
        Am I gonna be jailed for refusing to decrypt my files?
        fixermark 10y ago
        IANAL, but my understanding of current American law is that if the material is deemed by a judge to be evidence, and you can decrypt it, and you won't decrypt it, you can be held in contempt of court.
        10y ago
- sfifs 10y ago
  > It's not perfect, but at least you would know you're being investigated. And this basically is the reason multi national companies self host email servers

stuckagain 10y ago

If the feds want your "self hosted" emails they will break down your door, shoot your dog, and take every computer-resembling object on the premises.

wyager 10y ago
It's a lot more effort than just asking google. The goal behind practical security is to make things expensive, not impossible.
derefr 10y ago
You could "self-host" on a cloud server in, say, China, or Russia, or Iran (if they have any hosting services.) I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care. And they have no treaties with the US to force their hand to turn anything over. Think of your server as Edward Snowden. What country should it hide in, so the US can't legally get to it?
- confounded 10y ago
  Iceland.
- st3v3r 10y ago
  "I mean, the governments of those places will probably snoop your emails, but if their contents have nothing to do with them, they won't care." Can't you say the exact same thing about the US government?
- usernametbd 10y ago
  > they have no treaties with the US to force their hand to turn anything over Sure, but that doesn't mean they won't happily exchange that info as part of a deal with the US, assuming your data is valuable enough.
- sfifs 10y ago
  You're forgetting the possibility of rubber hose cryptanalysis applied on you. In fact just by hosting in such places, you're probably inviting more attention.

derefr 10y ago

* Gmail's search and spam-filtering are both very good, trained and tuned on datasets no self-hosted product could ever match (and harnessing parallel algorithms across large clusters that'd be quite costly on one machine) * Google doesn't lose my email; I probably will lose my email, because an email server is backed by a database and doing database backups right is hard if that is not your day-job. * You can get a good email-receiving experience, but email-sending is very difficult these days if you're a nobody, because a lot of first-stage network-level spam filtering has come down to reputation, and your server IP won't have any (or, if it's a cloud provider IP, will have very likely been used at least once to send spam in the past.) And residential ranges get dinged, too, from the heuristic (stereotype) that the most likely reason to get an SMTP connection from a residential IP is that it's a member of a botnet.

SomeCallMeTim 10y ago
> Google doesn't lose my email; I probably will lose my email, because an email server is backed by a database and doing database backups right is hard if that is not your day-job. I use IMAP email. My email is simultaneously stored on my server and on every client. If the server is nuked, I can set up a new IMAP server elsewhere and sync my email client to it; I'd want to do this from work where I have gigabit internet, or this would take a while, but it can re-upload all the data to the server. That said, I'm using a managed account. I'm not communicating about anything that I care if the government subpoenas, and I have no plans to. Unless we end up in a totalitarian state where constructive criticism of the government becomes an offense. But in that case my public posts would be more than enough to convict me without looking at my emails.
djsumdog 10y ago
> Gmail's search and spam-filtering are both very good Google/Microsoft's spam filtering makes it impossible to send e-mail from a self-hosted solution. http://penguindreams.org/blog/how-google-and-microsoft-made-email-unreliable/ http://penguindreams.org/blog/how-google-and-microsoft-made-... Unless you're sending out thousands of e-mails per day and build your reputation with their magic-goo trust filter algorithm, you cannot run your own e-mail server and run with the big players. They have made self-hosted e-mail totally unreliable. I think what you meant by "very good" is "piss fucking terrible."

uladzislau 10y ago

Especially when Gmail is not as reliable as we used to think. Gmail DOES loose emails. http://uladzislau.com/gmail-emails-missing/ http://uladzislau.com/gmail-emails-missing/

pklausler 10y ago
> Gmail DOES loose emails. Sounds like a tagline for an erotic movie, that does. I think you meant "lose".
- frogpelt 10y ago
  To be fair, English is difficult. Lose could rhyme with rose or close. But it doesn't. Instead it rhymes with cruise, clues, two's, moos, and choose (almost).
stuckagain 10y ago
Lunatic conspiracy theories about what Google does with email abound. There are several likely and reasonable explanations for why you can't find the mails you expect. Two of the most likely being 1) the messages were never acknowledged with a 220 response from gmail's smtp protocol translators to begin with; 2) the messages were accepted but are still in flight for some reason. Gmail does not accept and then silently drop messages. If they are accepted, they will be delivered.

wyager 10y ago

I recently switched from gmail to ProtonMail. Not self-hosted, but (theoretically) encrypted while at rest using a GPG key derived from my password. Definitely an improvement. If you really want SMTP, as I understand it they have an "SMTP bridge" software that you host yourself that uses ProtonMail as a backend. Seems like a good compromise. You don't have to worry about constant uptime or disk failure, but your data is still fairly well protected.

megous 10y ago
You probably don't need constant uptime. Sending server will try to deliver for a day or two, usually. Legitimate servers use sending queues.

deleted 10y ago

[deleted]