4 ms·

Well now you're moving goalposts, qualifying connections by port and authentication. I'm sure what you write is true of most ISPs and major email service provid

by extra88 10y ago

Well now you're moving goalposts, qualifying connections by port and authentication. I'm sure what you write is true of most ISPs and major email service providers but there are still SMTP servers in the world that don't require all MUAs to make authenticated connections; there's at least one at my university.

loup-vaillant 10y ago
They don't require authentication because they only accept relay requests from within the university network. Otherwise they'd be an open relay, and those tend to relay spam as soon as spammer spot them, then they get blacklisted by most spam filters. In any case, this doesn't affect my main point: by using those, you still don't send your email yourself. In my book, "sending your own email" means you operate your own mail server, without using any third party relay (not Gmail's, not your ISP's). I'm personally halfway there: I have root access to a virtual machine on the cloud (gandi.net), and configured it to relay my email for me. Next step would be to have physical control, but I kinda abandoned that idea when I learned that residential IPs are blacklisted (Hotmail even made it an explicit policy, it won't even appear in the recipient's spam folder).
- extra88 10y ago
  > In my book, "sending your own email" means you operate your own mail server Virtually no one else reads that book. To everyone else, the user operating the MUA is sending their own email.
  - sedachv 10y ago
    If you use Gmail via webmail at https://mail.google.com https://mail.google.com or have a MUA like smtpmail.el in Emacs connect to smtp.gmail.com, Gmail is still sending your mail.
    - cwyers 10y ago
      This is like saying that unless you own your own post office, you're not sending your mail, the US Postal Service is. Nobody talks like that.
      - loup-vaillant 10y ago
        We trust the postal office to act as a reliable dumb pipe. Most email services are far from that: they filter inbound email in a way you have little control of. They spy inbound and outbound mail, and use that information to send you ads. Also, they control your right to send and receive email: if your account is terminated for some reason (they reserve the right to, blah, blah), you cannot move to a new provider, or redirect inbound mail or nothing: they own your email address. Still think your send your own email? Fool.
        cwyers 10y ago
        I mean, if you want to make the point that e-mail is not secure, you can say "e-mail is not secure." That's a statement that actually makes sense. Your false pedantry isn't convincing anyone to agree with you, it just makes you sound like a crackpot.
        loup-vaillant 10y ago
        Oh, it's much worse than "email is insecure". It's more like "somebody else controls your email, and they don't have your best interest in mind". What did you think Alphabet was, a charity? Besides, there's more to it than (in)security. For instance, what happens to your various accounts tied to your email if your account gets terminated? You will not be able to redirect your incoming emails, and notifying your friends will be difficult if you relied on the web interface's address book. Also, it's a hole ecosystem: if you use a big webmail, then you allow your provider to spy on everyone you exchange emails with. If you have the means to avoid those, it is your responsibility to do so. Surely you don't like inflicting this kind of spying on your friends, do you? So far, the only reliable way to have proper control over our own email is to control our own domain name, and operate our own mail server. Or at least use small, trustworthy providers. In other words, "send our own email". It's intellectual property/monopoly all over again. One will chose the terms that suits one's side of the debate. I side for privacy, security, and reliability; and argue that webmail providers do not provide any of them. This thread is the first time my "sending one's own email" wording hasn't been an unmitigated success.
  - loup-vaillant 10y ago
    Virtually everyone is clueless. I mean it, most people don't know the first thing about computers, or networks, or how data flows when they send an email or even read a web page. Many others underestimate the actual price they pay for their supposedly free web mail. The issue here is one of control: relays can basically read every mail they relay, and the likes of Gmail do. Spying on you is how they make money. No targeted ad would be possible otherwise. And the automation only makes it worse (because it scales, and can be repurposed). And the user can do nothing about it. That total lack of control is why I maintain they do not, in fact, send their own email. Now there's PGP, but that would look conspicuous. If everyone had their own mail server, TLS alone would provide pretty good security. What angers me the most is, even I don't have a choice: most of my friends use a big webmail provider, which invades my privacy whenever I communicate with them. This would never happen if we all had our own mail servers.
    - chakalakasp 10y ago
      I remember when everyone could have their very own mail servers. Never since have I been offered such a vast and varied selection of ways to increase the size of my penis.
      - loup-vaillant 10y ago
        Markov chain filtering didn't exist at that time.
    - u801e 10y ago
      > Now there's PGP, but that would look conspicuous. Also, it doesn't hide the authenticated user, envelope mail from or envelope rcpt to values used in the message, unless, like you said, the sender and recipient(s) are using their own SMTP servers.

by extra88 10y ago

loup-vaillant 10y ago

They don't require authentication because they only accept relay requests from within the university network. Otherwise they'd be an open relay, and those tend to relay spam as soon as spammer spot them, then they get blacklisted by most spam filters. In any case, this doesn't affect my main point: by using those, you still don't send your email yourself. In my book, "sending your own email" means you operate your own mail server, without using any third party relay (not Gmail's, not your ISP's). I'm personally halfway there: I have root access to a virtual machine on the cloud (gandi.net), and configured it to relay my email for me. Next step would be to have physical control, but I kinda abandoned that idea when I learned that residential IPs are blacklisted (Hotmail even made it an explicit policy, it won't even appear in the recipient's spam folder).

extra88 10y ago
> In my book, "sending your own email" means you operate your own mail server Virtually no one else reads that book. To everyone else, the user operating the MUA is sending their own email.
- sedachv 10y ago
  If you use Gmail via webmail at https://mail.google.com https://mail.google.com or have a MUA like smtpmail.el in Emacs connect to smtp.gmail.com, Gmail is still sending your mail.
  - cwyers 10y ago
    This is like saying that unless you own your own post office, you're not sending your mail, the US Postal Service is. Nobody talks like that.
    - loup-vaillant 10y ago
      We trust the postal office to act as a reliable dumb pipe. Most email services are far from that: they filter inbound email in a way you have little control of. They spy inbound and outbound mail, and use that information to send you ads. Also, they control your right to send and receive email: if your account is terminated for some reason (they reserve the right to, blah, blah), you cannot move to a new provider, or redirect inbound mail or nothing: they own your email address. Still think your send your own email? Fool.
      - cwyers 10y ago
        I mean, if you want to make the point that e-mail is not secure, you can say "e-mail is not secure." That's a statement that actually makes sense. Your false pedantry isn't convincing anyone to agree with you, it just makes you sound like a crackpot.
        loup-vaillant 10y ago
        Oh, it's much worse than "email is insecure". It's more like "somebody else controls your email, and they don't have your best interest in mind". What did you think Alphabet was, a charity? Besides, there's more to it than (in)security. For instance, what happens to your various accounts tied to your email if your account gets terminated? You will not be able to redirect your incoming emails, and notifying your friends will be difficult if you relied on the web interface's address book. Also, it's a hole ecosystem: if you use a big webmail, then you allow your provider to spy on everyone you exchange emails with. If you have the means to avoid those, it is your responsibility to do so. Surely you don't like inflicting this kind of spying on your friends, do you? So far, the only reliable way to have proper control over our own email is to control our own domain name, and operate our own mail server. Or at least use small, trustworthy providers. In other words, "send our own email". It's intellectual property/monopoly all over again. One will chose the terms that suits one's side of the debate. I side for privacy, security, and reliability; and argue that webmail providers do not provide any of them. This thread is the first time my "sending one's own email" wording hasn't been an unmitigated success.
- loup-vaillant 10y ago
  Virtually everyone is clueless. I mean it, most people don't know the first thing about computers, or networks, or how data flows when they send an email or even read a web page. Many others underestimate the actual price they pay for their supposedly free web mail. The issue here is one of control: relays can basically read every mail they relay, and the likes of Gmail do. Spying on you is how they make money. No targeted ad would be possible otherwise. And the automation only makes it worse (because it scales, and can be repurposed). And the user can do nothing about it. That total lack of control is why I maintain they do not, in fact, send their own email. Now there's PGP, but that would look conspicuous. If everyone had their own mail server, TLS alone would provide pretty good security. What angers me the most is, even I don't have a choice: most of my friends use a big webmail provider, which invades my privacy whenever I communicate with them. This would never happen if we all had our own mail servers.
  - chakalakasp 10y ago
    I remember when everyone could have their very own mail servers. Never since have I been offered such a vast and varied selection of ways to increase the size of my penis.
    - loup-vaillant 10y ago
      Markov chain filtering didn't exist at that time.
  - u801e 10y ago
    > Now there's PGP, but that would look conspicuous. Also, it doesn't hide the authenticated user, envelope mail from or envelope rcpt to values used in the message, unless, like you said, the sender and recipient(s) are using their own SMTP servers.