12 ms·

Host your own contacts and calendars and share them across devices

227 points by acidburnNSA 9y ago

sqeezy 9y ago
Check out Mailinabox. This Project does most of it for you. https://mailinabox.email/ https://mailinabox.email/
- jacquesm 9y ago
  That's nice, thank you for the link.
Nux 9y ago
People looking for easier ways, Nextcloud/Owncloud already does this and you also get with file sync/backup/share for computer/smartphone and more as a bonus; all you need is just a LAMP server.
- znpy 9y ago
  I am commenting to confirm that nextcloud works very very well. I am running the official docker image with an apache2 frontend (http/https) and it pretty much works flawlessly.
  - balladeer 9y ago
    They don't offer client side encryption yet, do they? Just checked the GH issue and it is still open: https://github.com/owncloud/client/issues/4327 https://github.com/owncloud/client/issues/4327 and https://github.com/nextcloud/server/issues/5145 https://github.com/nextcloud/server/issues/5145
    - nrtd 9y ago
      Is this relevant? The connection to the server is encrypted (hopefully) and the server is selfhosted so you can trust it. In what use case is client side encryption important?
- toadkicker 9y ago
  I use http://mailinabox.email http://mailinabox.email which totally automates running your own mail server. Highly recommend taking a look at it!
  - fiatjaf 9y ago
    What about spam?
    - acidburnNSA 9y ago
      I use a self-maintained version of the same email stack (Dovecot, Postfix, Spamassassin) and Spam is pretty much not a problem. I train the Bayes filter on my collection of 10,000 spams and a few thousand hams every 6 months and, while I do get an occasional false negative I feel that spam is pretty much fully under control. Self-hosting email is fun you guys!
      - Silhouette 9y ago
        Self-hosting email is fun you guys! I figured that it would be, but trying to set it up was the single most frustrating thing I've ever experienced running a Linux box, and I never did get anything properly working after many days of trying. The principles seemed straightforward enough and there was plenty of software available, but what I really wanted was to self-host the mail store and IMAP server but send/receive via ISPs or other services who are better at administering a full-time SMTP setup than I am, and somehow I just never could find the magic incantations in the settings files to make that go. :-(
        fencepost 9y ago
        Well, for outbound you'd presumably want an "authenticated smarthost" with setup details on your side varying by what mail server you're using locally. For inbound, you'd presumably want the server using fetchmail or getmail to then push them into your local mailboxes. Should be plenty of documentation on those projects.
- octopoc 9y ago
  I have about 1TB of data that I tried to sync with NextCloud. The Windows client crashed every night, so I finally gave up and moved to Syncthing. Has anybody else had a similar experience?
  - Tharkun 9y ago
    I don't have any experience with their Windows client, but webdav with nextcloud has been painfully slow in my experience.
  - dawnerd 9y ago
    For that much data rclone might be better.
- acidburnNSA 9y ago
  This is a reasonable recommendation, aligned with the summary of the article.
- adekok 9y ago
  I tried used Owncloud... and stopped. I tried using radicale... and stopped. The software was fragile, slow, and broke often. Maybe it's better now (a few years later). But at the time it was negatively impacting productivity. I've moved to Sogo. Zero problems after install. File sync is Resilio. Bittorrent sync was unusable, the new re-branded (and fixed) Resilio works fine. Just my $0.02
  - Nux 9y ago
    As with many things open source a couple of years is a long, long time; Nextcloud has improved a lot as far as I can tell, for me it's decently usable and surprisingly problem free. How's Sogo with regards to maintainability and upgradability?
    - adekok 9y ago
      Sogo: zero maintenance. No problem upgrades. It's really, really, nice.
      - the_common_man 9y ago
        sogo does not release stable packages anymore (it's only for paid users which is basically businesses). How are you updating sogo?
        ausjke 9y ago
        https://sogo.nu/download.html https://sogo.nu/download.html has all the new releases, where did you find that "only for paid users" info?
    - RaleyField 9y ago
      I have been researching this space recently, what turned me off was them scanning ports and then reporting to ISPs, supposedly because people were running vulnerable versions, but reporting could make problems for users because some ISPs don't allow servers on home connections. And here's the money quote: "The effort has been quite successful. Of the tens of thousands server owners who were informed, over 5% had upgraded already in the first ten days."[1] In other words 95% were left vulnerable and they were responsible for it. Does not inspire trust. [1] https://nextcloud.com/blog/nextcloud-releases-security-scanner-to-help-protect-private-clouds/ https://nextcloud.com/blog/nextcloud-releases-security-scann...
deleted 9y ago
[deleted]
dvfjsdhgfv 9y ago
> I’m trying to learn ways to minimize my reliance upon large companies for handling my day-to-day personal data. Except that the moment you "share them across devices", at least one large company will silently grab your contacts anyway. And several others will try to, too, with one excuse or another.
- Spearchucker 9y ago
  Yes. And it's this that made me write my own zero-knowledge sync service. I encrypt my stuff on the client, sync it to a server using store-and-forward, and pull it down from other devices whenever they have an internet connection. It's essentially file share for database records, and I remain surprised that something like this isn't in wide use already. Docs haven't been updated in years, but here's a description of the thing back when I was focused on the client rather than the sync engine - https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-4117-af17-c923ff855456 https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-411...
- lorenzhs 9y ago
  Why would anyone get your contacts if you sync them via your own CarDav server? You don't need to sync them to iCloud / Siri on iOS, and you can use non-Google Android phones.
  - jeeva 9y ago
    As a few examples, there are a variety of social-network applications (LinkedIn, Facebook) that request access to your platform specific contacts application. They then do a variety of interesting things with them, such as suggesting users with numbers they have "on file" as potential new "Friends", etc. This is seemingly server-side. Whatever you're using to sync contacts, without syncing them to this contact app, it seems (to me) as useful as keeping a textfile full of phone numbers in Dropbox. You won't have any useful prompts telling you that it's Dave phoning you, John texting you, or Alice's number to phone/text. This is, admittedly, neatly worked around by keeping your permission requests under control, but... stuff like this[1], from before the granular permission system on Android was available, are annoying. 1: http://bgr.com/2011/08/12/facebook-stole-every-contact-and-phone-number-in-your-phone-heres-how-to-undo-the-damage/ http://bgr.com/2011/08/12/facebook-stole-every-contact-and-p...
philtar 9y ago
You lack critical reading skills. His concern is not that they companies would grab a copy, his concern is that he used to rely on them for syncing. He no longer has to rely on them. Google can shut down calendar and contacts and he would still be fine.
- lorenzhs 9y ago
  Please don't use such stark language on HN. There's a much friendlier way of saying that, something along the lines of "I think you misunderstood the author's concerns".
  - lwhalen 9y ago
    You are left-coast/euro sensitive. Nothing that he said was incorrect, non factual, or otherwise out of line.
    - lorenzhs 9y ago
      It's against the guidelines. They are very explicit about such things: Be civil. Don't say things you wouldn't say in a face-to-face conversation. Avoid gratuitous negativity. When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3." Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html It's not called "left-coast/euro sensitive", it's called manners.
    - victorhooi 9y ago
      I have no idea what you mean by "left-coast/euro-sensitive". However, I will put what lorenzhs said a bit more bluntly. Please don't go out of your way to be a dick - there is no need for it, and it benefits nobody.
- sctb 9y ago
  We detached this subthread from https://news.ycombinator.com/item?id=14837015 https://news.ycombinator.com/item?id=14837015 and marked it off-topic.
opinsky 9y ago
How would it work for email invitations automatically being added as calendar entries?
- Rjevski 9y ago
  No open-source calendar server that I know of supports this - they all rely on your email client managing this client-side (when you accept an invitation it adds it to your calendar).
- synchrone 9y ago
  There is a message-based interoperability protocol for iCalendar: https://datatracker.ietf.org/doc/rfc5546/ https://datatracker.ietf.org/doc/rfc5546/ and https://datatracker.ietf.org/doc/rfc6047/ https://datatracker.ietf.org/doc/rfc6047/. This is what Google Mail + Calendar are using, including features like RSVP, etc. It's all there, just passing iCal objects around.
willhackett 9y ago
I've done this before. It becomes tedious to maintain, but I can imagine myself doing it again in the future to allow me to do what cannot be done in the common clouds (iCloud, G Suite, O365). I would love a whitelist-only inbox. I'm sick of spam, marketing mail, etc. I'd like one public email address that catches all the garbage. Then, I'd like a private email address that accepts emails from my contacts, and bounces the rest.
- a3n 9y ago
  > Then, I'd like a private email address that accepts emails from my contacts, and bounces the rest. You're doomed. Because at least one of your correspondents is going to upload their contacts to some service, and that service is now aware of you.
  - jazoom 9y ago
    I think OP intends that mailbox to be the one that only accepts mail from a whitelist of addresses.
- acidburnNSA 9y ago
  This is really easy to set up using Dovecot Sieve [1]. I set it up the other day to bounce reject messages that had too many swear words as a proof-of-concept for an idea a Facebook friend had about making sure people stay nice in email. The syntax of the server-side filters is a bit strange but there's even a Thunderbird plugin that allows you to edit them from the client. [1] https://wiki2.dovecot.org/Pigeonhole/Sieve https://wiki2.dovecot.org/Pigeonhole/Sieve
  - JulienSchmidt 9y ago
    Bouncing is a bad idea as it can be abused for spam: 1. Fake the origin to actual destination of choice 2. Your server bounces the original message wrapped by the SMTP error report. 3. Actual destination receives error report containing spam content from YOUR server A proper solution would be to REJECT the message before it is accepted. However, Dovecot Pigenhole doesn't support that (yet).
dijit 9y ago
I've been using radicale[0] for this for some time, it's a bit quirky with thunderbird but I've had tremendous success with Apple Calendar for iOS and the Contacts application. And it's using standards (Carddav, Calddav) so you can be somewhat secure in the knowledge that other programs can implement the protocol (or should). :) [0]: http://radicale.org/ http://radicale.org/ EDIT: I guess I should have read the post, but eitherway I'm going to keep this comment up as a review of the software.
gravypod 9y ago
Something I've been looking for is a web service and android app that I can self-host that will allow me to read and send SMSs from my desktop. The important thing here is self hosted. I think something like this would be really useful. I've seen services that provide this via a 3rd party hosted service but I don't trust someone at some random company not to read my messages.
- pestaa 9y ago
  Nextcloud (and therefore probably Owncloud) has a 3rd party app, though only for reading at the moment.
- Rjevski 9y ago
  This should really be handled by the carrier. Look for a carrier that allows you to use your number from anywhere via SIP or WebRTC.
  - gravypod 9y ago
    I'd rather have a self hosted service, that I can modify if need be, than be tied to a carrier.
    - Rjevski 9y ago
      In that case you'd need an app on your Android phone to relay SMSes between the phone network and your web app. The advantage of doing it via the carrier is that the phone is taken out of the loop and you're directly sending to the carrier via the internet.
      - gravypod 9y ago
        > In that case you'd need an app on your Android phone to relay SMSes between the phone network and your web app. I'm fine with that. > The advantage of doing it via the carrier is that the phone is taken out of the loop and you're directly sending to the carrier via the internet. The disadvantage of doing that is you than need to stay with that carrier. I'd rather be able to change if my carrier starts doing things that are shifty without needing to change the way I interact with my phone.
miguelrochefort 9y ago
What about my contacts on Facebook, Google, Microsoft, Apple, Instagram, Twitter, LinkedIn, Skype, Snapchat, WhatsApp, WeChat, etc.
- OJFord 9y ago
  At least some of those services will export vCards, which I assume Radicale can import, though I haven't used it.
  - acidburnNSA 9y ago
    Radicale is really just the server and doesn't have its own import functionality. Instead, the clients support importing vCards. In the article, the CardBook Thunderbird plugin was used for this purpose.
upofadown 9y ago
After spending way too much time messing around with stuff like DAV and syncing using same, my current scheduling and reminder system is based on this: * https://www.roaringpenguin.com/products/remind/ https://www.roaringpenguin.com/products/remind/ Every day at 6am my server runs a cron job. If there are appointments I get an email and an SMS. The server also makes a unique noise over the house PA system (I live alone) but that is mostly because I can.
- Rjevski 9y ago
  What exactly was wrong with a DAV server? I can't imagine it being more complicated than what you've settled with.
  - peterwwillis 9y ago
    DAV was always incredibly unreliable when you tried to host it yourself. Remember the original web servers + browsers, as one would support some new feature and another would break it? It was like that. SyncML was pretty rock solid and interoperable when you could find support for it, but the damn thing was such a nightmare to implement that the only open source implementations were buried inside groupware solutions.
cs702 9y ago
Hosting calendar and contacts on a personal server accessible over the web smells like a potential security nightmare to me. For example, how do you make sure that whatever third party tool you use to sync your phone with the web server has been well designed to protect against a large attack surface?
- dsr_ 9y ago
  You'll need to be more specific. Is it worse or better than running your own mail server? Your own git repo? Your own VPN server? In what ways, and why?
- acidburnNSA 9y ago
  I'm sure it's a bit dangerous, but when you run it as done in the article, behind an Apache Reverse Proxy with Apache authentication, you're relying hugely on Apache for the sync security, and that has been well designed to protect against a very large attack surface. Another advantage is that you're just different. So if someone (or some State) attacks a commonly-used service, this will be protected simply by being different.
tasn 9y ago
While this is nice, and much better than using e.g Google, it is even better to use an end-to-end encrypted solution. Messaging has underwent the same transition in the last few years. Trusting the server, even if yours, is just not enough. I created https://www.etesync.com https://www.etesync.com for that purpose exactly, it does end-to-end encrypted sync for Android and desktop for your contacts and calendar.
- Tepix 9y ago
  When communicating with your own server using https, it is already end-to-end encrypted.
  - tasn 9y ago
    While this may feel true, there are a few reasons why it's not. 1. This assumes https can be trusted, that is, MITM is not a possibility. This is a fair assumption for many people, but not for people whore are scared of state actors, which is common for journalists in and citizens of some countries. - This can be mitigated to an extent with certificate pinning, but I don't think all software support it (correctly?) and it's another thing to get wrong. 2. This assumes your server is trusted. It is not. If it's hosted in a remote location (e.g. VPS or even metal in a server farm), it can't be trusted. If it's at your home, based on how much of a target you are, it can't be trusted. Even if your server is physically secure, this assumes it won't be hacked, and you should never assume a public facing server won't be. Of course this all depends on your threat models, and this may not apply to you, but https to your own server is definitely not the same, and given that adding end-to-end is almost "free" for most users, it's a good idea to error on the side of safety and just do it.
    - Tepix 9y ago
      Re: 1. You can deploy additional security measures such as certificate pinning or a VPN tunnel to your CalDAV server if you have a high security requirement. Re: 2. If your server is untrusted (because it's a remote virtual server) or hacked, e2e will not protect you.
garrickvanburen 9y ago
I started with Radicale a few years back (5+?). I found it too brittle, and switched to Baikal - http://baikal-server.com/ http://baikal-server.com/ . I've been very pleased with Baikal for since the switch (again, 5+)
- acidburnNSA 9y ago
  Baikal was going to be my second choice but I never got there because Radicale went pretty well.
CaptSpify 9y ago
I've been trying to do this with inf-cloud, and baikal https://www.inf-it.com/open-source/clients/infcloud/ https://www.inf-it.com/open-source/clients/infcloud/ https://github.com/fruux/Baikal https://github.com/fruux/Baikal It mostly works so far, but I'm definitely looking for a simpler, easier to implement solution. I looked at Radicale before, but I forget why I passed it over. I'll have to look into this.
the_common_man 9y ago
Cloudron and yunohost have radicale, email and nextcloud. Sandtsorm lacks all of them, last I checked.
- orblivion 9y ago
  Radicale for Sandstorm: https://apps.sandstorm.io/app/8kr4rvyrggvzfvc160htzdt4u5rfvjc2dgdn27n5pt66mxa40m1h https://apps.sandstorm.io/app/8kr4rvyrggvzfvc160htzdt4u5rfvj...
Sir_Cmpwn 9y ago
Don't redact information with a blur filter! It can be reversed! Use solid color boxes.
- acidburnNSA 9y ago
  Gaussian blur can be reversed? I assumed it was destructive. Thanks for the tip.
  - Sir_Cmpwn 9y ago
    http://yuzhikov.com/articles/BlurredImagesRestoration1.htm http://yuzhikov.com/articles/BlurredImagesRestoration1.htm
rebootthesystem 9y ago
I've been looking a Zimbra [https://www.zimbra.com/ https://www.zimbra.com/] for a while. I like the general idea of the product. Even the free version is feature-filled. My only problem with it is that it seems to be a resource hog. You'd have to get a fairly fat Linode to run it. I've used garden variety email hosting auto-magically setup on VPS's from such luminaries as GoDaddy without problems for many years. I have never worried about how to setup an email server, just get a cheap VPS, setup email addresses and you are good to go. Given this experience I have to admit to not understanding why Zimbra is so fat.
- jeremye77 9y ago
  I'm a fan of Zimbra. In reality...a Linode 4096 handles 5 "normal" users just fine, and a few here and there users, possibly more...that was all I needed. Tack on Z-push and you have a nice Activesync implementation as well. Then it is just like gmail just plugin the server and password and calendar, contacts, email, and whatnot all sync as you would expect. http://z-push.org/ http://z-push.org/
  - rebootthesystem 9y ago
    I probably have a dozen email addresses across five companies that I need to manage. I thought Zimbra would be the answer but server requirements sky-rocket quickly.
epcim 9y ago
honestly win-win in 2017 would be to securely orchestrate pesonal cal,dns,mail,notes,drive on one of the container hosting platform for reasonable cost. while doable. cost is still far more common shared hosting or accepting a mail on google.
bedros 9y ago
anyone has experience with this https://roundcube.net/about/#features https://roundcube.net/about/#features I'm looking into a similar solution, and found roundcube.net features to be exactly what I need
loa_in_ 9y ago
The only thing I miss in Google's thing is ability to allow people w/o tech savviness and w/o google account to sporadically add things to my calendar and have them marked as unconfirmed (like semi-transparent). I don't care if they'll recieve any further info, I want people to add their things to my life. The subject of "who the hell isn't tech savvy enough and doesn't have an account already" is quickly answered with: I'm an uncle, my niece knows her way around the computer and knows the calendar, but has no idea why'd she need an e-mail account, and wouldn't bother to even try at this point.

227 points by acidburnNSA 9y ago

sqeezy 9y ago

Check out Mailinabox. This Project does most of it for you. https://mailinabox.email/ https://mailinabox.email/

jacquesm 9y ago
That's nice, thank you for the link.

Nux 9y ago

People looking for easier ways, Nextcloud/Owncloud already does this and you also get with file sync/backup/share for computer/smartphone and more as a bonus; all you need is just a LAMP server.

znpy 9y ago
I am commenting to confirm that nextcloud works very very well. I am running the official docker image with an apache2 frontend (http/https) and it pretty much works flawlessly.
- balladeer 9y ago
  They don't offer client side encryption yet, do they? Just checked the GH issue and it is still open: https://github.com/owncloud/client/issues/4327 https://github.com/owncloud/client/issues/4327 and https://github.com/nextcloud/server/issues/5145 https://github.com/nextcloud/server/issues/5145
  - nrtd 9y ago
    Is this relevant? The connection to the server is encrypted (hopefully) and the server is selfhosted so you can trust it. In what use case is client side encryption important?
toadkicker 9y ago
I use http://mailinabox.email http://mailinabox.email which totally automates running your own mail server. Highly recommend taking a look at it!
- fiatjaf 9y ago
  What about spam?
  - acidburnNSA 9y ago
    I use a self-maintained version of the same email stack (Dovecot, Postfix, Spamassassin) and Spam is pretty much not a problem. I train the Bayes filter on my collection of 10,000 spams and a few thousand hams every 6 months and, while I do get an occasional false negative I feel that spam is pretty much fully under control. Self-hosting email is fun you guys!
    - Silhouette 9y ago
      Self-hosting email is fun you guys! I figured that it would be, but trying to set it up was the single most frustrating thing I've ever experienced running a Linux box, and I never did get anything properly working after many days of trying. The principles seemed straightforward enough and there was plenty of software available, but what I really wanted was to self-host the mail store and IMAP server but send/receive via ISPs or other services who are better at administering a full-time SMTP setup than I am, and somehow I just never could find the magic incantations in the settings files to make that go. :-(
      - fencepost 9y ago
        Well, for outbound you'd presumably want an "authenticated smarthost" with setup details on your side varying by what mail server you're using locally. For inbound, you'd presumably want the server using fetchmail or getmail to then push them into your local mailboxes. Should be plenty of documentation on those projects.
octopoc 9y ago
I have about 1TB of data that I tried to sync with NextCloud. The Windows client crashed every night, so I finally gave up and moved to Syncthing. Has anybody else had a similar experience?
- Tharkun 9y ago
  I don't have any experience with their Windows client, but webdav with nextcloud has been painfully slow in my experience.
- dawnerd 9y ago
  For that much data rclone might be better.
acidburnNSA 9y ago
This is a reasonable recommendation, aligned with the summary of the article.
adekok 9y ago
I tried used Owncloud... and stopped. I tried using radicale... and stopped. The software was fragile, slow, and broke often. Maybe it's better now (a few years later). But at the time it was negatively impacting productivity. I've moved to Sogo. Zero problems after install. File sync is Resilio. Bittorrent sync was unusable, the new re-branded (and fixed) Resilio works fine. Just my $0.02
- Nux 9y ago
  As with many things open source a couple of years is a long, long time; Nextcloud has improved a lot as far as I can tell, for me it's decently usable and surprisingly problem free. How's Sogo with regards to maintainability and upgradability?
  - adekok 9y ago
    Sogo: zero maintenance. No problem upgrades. It's really, really, nice.
    - the_common_man 9y ago
      sogo does not release stable packages anymore (it's only for paid users which is basically businesses). How are you updating sogo?
      - ausjke 9y ago
        https://sogo.nu/download.html https://sogo.nu/download.html has all the new releases, where did you find that "only for paid users" info?
  - RaleyField 9y ago
    I have been researching this space recently, what turned me off was them scanning ports and then reporting to ISPs, supposedly because people were running vulnerable versions, but reporting could make problems for users because some ISPs don't allow servers on home connections. And here's the money quote: "The effort has been quite successful. Of the tens of thousands server owners who were informed, over 5% had upgraded already in the first ten days."[1] In other words 95% were left vulnerable and they were responsible for it. Does not inspire trust. [1] https://nextcloud.com/blog/nextcloud-releases-security-scanner-to-help-protect-private-clouds/ https://nextcloud.com/blog/nextcloud-releases-security-scann...

deleted 9y ago

[deleted]

dvfjsdhgfv 9y ago

> I’m trying to learn ways to minimize my reliance upon large companies for handling my day-to-day personal data. Except that the moment you "share them across devices", at least one large company will silently grab your contacts anyway. And several others will try to, too, with one excuse or another.

Spearchucker 9y ago
Yes. And it's this that made me write my own zero-knowledge sync service. I encrypt my stuff on the client, sync it to a server using store-and-forward, and pull it down from other devices whenever they have an internet connection. It's essentially file share for database records, and I remain surprised that something like this isn't in wide use already. Docs haven't been updated in years, but here's a description of the thing back when I was focused on the client rather than the sync engine - https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-4117-af17-c923ff855456 https://www.wittenburg.co.uk/Entry.aspx?id=a7aae391-9ac8-411...
lorenzhs 9y ago
Why would anyone get your contacts if you sync them via your own CarDav server? You don't need to sync them to iCloud / Siri on iOS, and you can use non-Google Android phones.
- jeeva 9y ago
  As a few examples, there are a variety of social-network applications (LinkedIn, Facebook) that request access to your platform specific contacts application. They then do a variety of interesting things with them, such as suggesting users with numbers they have "on file" as potential new "Friends", etc. This is seemingly server-side. Whatever you're using to sync contacts, without syncing them to this contact app, it seems (to me) as useful as keeping a textfile full of phone numbers in Dropbox. You won't have any useful prompts telling you that it's Dave phoning you, John texting you, or Alice's number to phone/text. This is, admittedly, neatly worked around by keeping your permission requests under control, but... stuff like this[1], from before the granular permission system on Android was available, are annoying. 1: http://bgr.com/2011/08/12/facebook-stole-every-contact-and-phone-number-in-your-phone-heres-how-to-undo-the-damage/ http://bgr.com/2011/08/12/facebook-stole-every-contact-and-p...

philtar 9y ago

You lack critical reading skills. His concern is not that they companies would grab a copy, his concern is that he used to rely on them for syncing. He no longer has to rely on them. Google can shut down calendar and contacts and he would still be fine.

lorenzhs 9y ago
Please don't use such stark language on HN. There's a much friendlier way of saying that, something along the lines of "I think you misunderstood the author's concerns".
- lwhalen 9y ago
  You are left-coast/euro sensitive. Nothing that he said was incorrect, non factual, or otherwise out of line.
  - lorenzhs 9y ago
    It's against the guidelines. They are very explicit about such things: Be civil. Don't say things you wouldn't say in a face-to-face conversation. Avoid gratuitous negativity. When disagreeing, please reply to the argument instead of calling names. E.g. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3." Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html It's not called "left-coast/euro sensitive", it's called manners.
  - victorhooi 9y ago
    I have no idea what you mean by "left-coast/euro-sensitive". However, I will put what lorenzhs said a bit more bluntly. Please don't go out of your way to be a dick - there is no need for it, and it benefits nobody.
sctb 9y ago
We detached this subthread from https://news.ycombinator.com/item?id=14837015 https://news.ycombinator.com/item?id=14837015 and marked it off-topic.

opinsky 9y ago

How would it work for email invitations automatically being added as calendar entries?

Rjevski 9y ago
No open-source calendar server that I know of supports this - they all rely on your email client managing this client-side (when you accept an invitation it adds it to your calendar).
synchrone 9y ago
There is a message-based interoperability protocol for iCalendar: https://datatracker.ietf.org/doc/rfc5546/ https://datatracker.ietf.org/doc/rfc5546/ and https://datatracker.ietf.org/doc/rfc6047/ https://datatracker.ietf.org/doc/rfc6047/. This is what Google Mail + Calendar are using, including features like RSVP, etc. It's all there, just passing iCal objects around.

willhackett 9y ago

I've done this before. It becomes tedious to maintain, but I can imagine myself doing it again in the future to allow me to do what cannot be done in the common clouds (iCloud, G Suite, O365). I would love a whitelist-only inbox. I'm sick of spam, marketing mail, etc. I'd like one public email address that catches all the garbage. Then, I'd like a private email address that accepts emails from my contacts, and bounces the rest.

a3n 9y ago
> Then, I'd like a private email address that accepts emails from my contacts, and bounces the rest. You're doomed. Because at least one of your correspondents is going to upload their contacts to some service, and that service is now aware of you.
- jazoom 9y ago
  I think OP intends that mailbox to be the one that only accepts mail from a whitelist of addresses.
acidburnNSA 9y ago
This is really easy to set up using Dovecot Sieve [1]. I set it up the other day to bounce reject messages that had too many swear words as a proof-of-concept for an idea a Facebook friend had about making sure people stay nice in email. The syntax of the server-side filters is a bit strange but there's even a Thunderbird plugin that allows you to edit them from the client. [1] https://wiki2.dovecot.org/Pigeonhole/Sieve https://wiki2.dovecot.org/Pigeonhole/Sieve
- JulienSchmidt 9y ago
  Bouncing is a bad idea as it can be abused for spam: 1. Fake the origin to actual destination of choice 2. Your server bounces the original message wrapped by the SMTP error report. 3. Actual destination receives error report containing spam content from YOUR server A proper solution would be to REJECT the message before it is accepted. However, Dovecot Pigenhole doesn't support that (yet).

dijit 9y ago

I've been using radicale[0] for this for some time, it's a bit quirky with thunderbird but I've had tremendous success with Apple Calendar for iOS and the Contacts application. And it's using standards (Carddav, Calddav) so you can be somewhat secure in the knowledge that other programs can implement the protocol (or should). :) [0]: http://radicale.org/ http://radicale.org/ EDIT: I guess I should have read the post, but eitherway I'm going to keep this comment up as a review of the software.

gravypod 9y ago

Something I've been looking for is a web service and android app that I can self-host that will allow me to read and send SMSs from my desktop. The important thing here is self hosted. I think something like this would be really useful. I've seen services that provide this via a 3rd party hosted service but I don't trust someone at some random company not to read my messages.

pestaa 9y ago
Nextcloud (and therefore probably Owncloud) has a 3rd party app, though only for reading at the moment.
Rjevski 9y ago
This should really be handled by the carrier. Look for a carrier that allows you to use your number from anywhere via SIP or WebRTC.
- gravypod 9y ago
  I'd rather have a self hosted service, that I can modify if need be, than be tied to a carrier.
  - Rjevski 9y ago
    In that case you'd need an app on your Android phone to relay SMSes between the phone network and your web app. The advantage of doing it via the carrier is that the phone is taken out of the loop and you're directly sending to the carrier via the internet.
    - gravypod 9y ago
      > In that case you'd need an app on your Android phone to relay SMSes between the phone network and your web app. I'm fine with that. > The advantage of doing it via the carrier is that the phone is taken out of the loop and you're directly sending to the carrier via the internet. The disadvantage of doing that is you than need to stay with that carrier. I'd rather be able to change if my carrier starts doing things that are shifty without needing to change the way I interact with my phone.

miguelrochefort 9y ago

What about my contacts on Facebook, Google, Microsoft, Apple, Instagram, Twitter, LinkedIn, Skype, Snapchat, WhatsApp, WeChat, etc.

OJFord 9y ago
At least some of those services will export vCards, which I assume Radicale can import, though I haven't used it.
- acidburnNSA 9y ago
  Radicale is really just the server and doesn't have its own import functionality. Instead, the clients support importing vCards. In the article, the CardBook Thunderbird plugin was used for this purpose.

upofadown 9y ago

After spending way too much time messing around with stuff like DAV and syncing using same, my current scheduling and reminder system is based on this: * https://www.roaringpenguin.com/products/remind/ https://www.roaringpenguin.com/products/remind/ Every day at 6am my server runs a cron job. If there are appointments I get an email and an SMS. The server also makes a unique noise over the house PA system (I live alone) but that is mostly because I can.

Rjevski 9y ago
What exactly was wrong with a DAV server? I can't imagine it being more complicated than what you've settled with.
- peterwwillis 9y ago
  DAV was always incredibly unreliable when you tried to host it yourself. Remember the original web servers + browsers, as one would support some new feature and another would break it? It was like that. SyncML was pretty rock solid and interoperable when you could find support for it, but the damn thing was such a nightmare to implement that the only open source implementations were buried inside groupware solutions.

cs702 9y ago

Hosting calendar and contacts on a personal server accessible over the web smells like a potential security nightmare to me. For example, how do you make sure that whatever third party tool you use to sync your phone with the web server has been well designed to protect against a large attack surface?

dsr_ 9y ago
You'll need to be more specific. Is it worse or better than running your own mail server? Your own git repo? Your own VPN server? In what ways, and why?
acidburnNSA 9y ago
I'm sure it's a bit dangerous, but when you run it as done in the article, behind an Apache Reverse Proxy with Apache authentication, you're relying hugely on Apache for the sync security, and that has been well designed to protect against a very large attack surface. Another advantage is that you're just different. So if someone (or some State) attacks a commonly-used service, this will be protected simply by being different.

tasn 9y ago

While this is nice, and much better than using e.g Google, it is even better to use an end-to-end encrypted solution. Messaging has underwent the same transition in the last few years. Trusting the server, even if yours, is just not enough. I created https://www.etesync.com https://www.etesync.com for that purpose exactly, it does end-to-end encrypted sync for Android and desktop for your contacts and calendar.

Tepix 9y ago
When communicating with your own server using https, it is already end-to-end encrypted.
- tasn 9y ago
  While this may feel true, there are a few reasons why it's not. 1. This assumes https can be trusted, that is, MITM is not a possibility. This is a fair assumption for many people, but not for people whore are scared of state actors, which is common for journalists in and citizens of some countries. - This can be mitigated to an extent with certificate pinning, but I don't think all software support it (correctly?) and it's another thing to get wrong. 2. This assumes your server is trusted. It is not. If it's hosted in a remote location (e.g. VPS or even metal in a server farm), it can't be trusted. If it's at your home, based on how much of a target you are, it can't be trusted. Even if your server is physically secure, this assumes it won't be hacked, and you should never assume a public facing server won't be. Of course this all depends on your threat models, and this may not apply to you, but https to your own server is definitely not the same, and given that adding end-to-end is almost "free" for most users, it's a good idea to error on the side of safety and just do it.
  - Tepix 9y ago
    Re: 1. You can deploy additional security measures such as certificate pinning or a VPN tunnel to your CalDAV server if you have a high security requirement. Re: 2. If your server is untrusted (because it's a remote virtual server) or hacked, e2e will not protect you.

garrickvanburen 9y ago

I started with Radicale a few years back (5+?). I found it too brittle, and switched to Baikal - http://baikal-server.com/ http://baikal-server.com/ . I've been very pleased with Baikal for since the switch (again, 5+)

acidburnNSA 9y ago
Baikal was going to be my second choice but I never got there because Radicale went pretty well.

CaptSpify 9y ago

I've been trying to do this with inf-cloud, and baikal https://www.inf-it.com/open-source/clients/infcloud/ https://www.inf-it.com/open-source/clients/infcloud/ https://github.com/fruux/Baikal https://github.com/fruux/Baikal It mostly works so far, but I'm definitely looking for a simpler, easier to implement solution. I looked at Radicale before, but I forget why I passed it over. I'll have to look into this.

the_common_man 9y ago

Cloudron and yunohost have radicale, email and nextcloud. Sandtsorm lacks all of them, last I checked.

orblivion 9y ago
Radicale for Sandstorm: https://apps.sandstorm.io/app/8kr4rvyrggvzfvc160htzdt4u5rfvjc2dgdn27n5pt66mxa40m1h https://apps.sandstorm.io/app/8kr4rvyrggvzfvc160htzdt4u5rfvj...

Sir_Cmpwn 9y ago

Don't redact information with a blur filter! It can be reversed! Use solid color boxes.

acidburnNSA 9y ago
Gaussian blur can be reversed? I assumed it was destructive. Thanks for the tip.
- Sir_Cmpwn 9y ago
  http://yuzhikov.com/articles/BlurredImagesRestoration1.htm http://yuzhikov.com/articles/BlurredImagesRestoration1.htm

rebootthesystem 9y ago

I've been looking a Zimbra [https://www.zimbra.com/ https://www.zimbra.com/] for a while. I like the general idea of the product. Even the free version is feature-filled. My only problem with it is that it seems to be a resource hog. You'd have to get a fairly fat Linode to run it. I've used garden variety email hosting auto-magically setup on VPS's from such luminaries as GoDaddy without problems for many years. I have never worried about how to setup an email server, just get a cheap VPS, setup email addresses and you are good to go. Given this experience I have to admit to not understanding why Zimbra is so fat.

jeremye77 9y ago
I'm a fan of Zimbra. In reality...a Linode 4096 handles 5 "normal" users just fine, and a few here and there users, possibly more...that was all I needed. Tack on Z-push and you have a nice Activesync implementation as well. Then it is just like gmail just plugin the server and password and calendar, contacts, email, and whatnot all sync as you would expect. http://z-push.org/ http://z-push.org/
- rebootthesystem 9y ago
  I probably have a dozen email addresses across five companies that I need to manage. I thought Zimbra would be the answer but server requirements sky-rocket quickly.

epcim 9y ago

honestly win-win in 2017 would be to securely orchestrate pesonal cal,dns,mail,notes,drive on one of the container hosting platform for reasonable cost. while doable. cost is still far more common shared hosting or accepting a mail on google.

bedros 9y ago

anyone has experience with this https://roundcube.net/about/#features https://roundcube.net/about/#features I'm looking into a similar solution, and found roundcube.net features to be exactly what I need

loa_in_ 9y ago

The only thing I miss in Google's thing is ability to allow people w/o tech savviness and w/o google account to sporadically add things to my calendar and have them marked as unconfirmed (like semi-transparent). I don't care if they'll recieve any further info, I want people to add their things to my life. The subject of "who the hell isn't tech savvy enough and doesn't have an account already" is quickly answered with: I'm an uncle, my niece knows her way around the computer and knows the calendar, but has no idea why'd she need an e-mail account, and wouldn't bother to even try at this point.