3 ms·

2. It's not hard to do. apt-get install postfix and dovecot, invest a couple of hours munging config files, and you're done Bullshit. There's troubleshooting

2. It's not hard to do. apt-get install postfix and dovecot, invest a couple of hours munging config files, and you're done Bullshit. There's troubleshooting when things go wrong, patching, maintenance, etc. edit: don't forget adding additional storage, managing spam and malware filtering, user admin, backups, and other tasks. 5. Stealth. It's much less likely that someone will try to break into my server than into Google's servers. You wish. Your single server is much easier to target and break into than Google's.

seiji 16y ago
With Google email hosting you just have to worry about a few hundred people who can read all your email, their data retention policies, and who can subpoena your private communications. (conspiracy theory: Google gives the public one text box on a webpage to search the Internet. Do you think they don't have a text box on an internal webpage to search all of Gmail? Do you think facebook doesn't have one internal webpage capable of searching all private communications? Facebook used to advertise "spy on your friends!" as an employment perk.)
- davidw 16y ago
  > Do you think they don't have a text box on an internal webpage to search all of Gmail? That kind of thing would leak out sooner or later.
  - jacquesm 16y ago
    Google had a rogue sysadmin that was apparently able to access user data with ease a short time ago. It might not be as easy as a textbox to search all of Gmail but your gmail data store appears to be wide open to a fairly large number of google employees.
- maukdaddy 16y ago
  and who can subpoena your private communications. Hate to break it to you, but that same subpoena can just as easily allow your house, office, or datacenter to be raided. Your data is just as susceptible to lawful intercept at Google as it is your private premises.
  - mike-cardwell 16y ago
    When self hosting, you can make sure that deleted email has actually been deleted. You have control over how long logs are kept. You have control over whether or not to use encrypted filesystems.
  - lambda 16y ago
    It is much easier for one over-broad subpoena or search warrant to reveal your private data if it's hosted on Google than if it's hosted on your own server. If everyone keeps their own data on their own machines, then they would need to subpoena or get a search warrant for each individual person, rather than a broad one attempting to fish for information. Furthermore, you can fight a subpoena. Do you trust Google to fight a subpoena on your behalf? How would they even know whether or not they should; how would they be able to tell if the subpoena is reasonable or not?
modoc 16y ago
If you're new to running a mail server or linux server, then yes, lots of troubleshooting, etc... If you have someone who knows what they're doing, it's really not a big deal. I don't think I've had to spend any time on any of my mail servers in ages. Not sure what you mean by additional storage? Local corporate e-mail might take up ~10GB per person after a few years? Most of my servers have 1+ TB of local storage + SAN. Takes a lot of e-mail to fill that up. Spam and malware filtering are both pretty easy. yum/apt-get install clam and/or spamassissin/razor/pyzor/whatever. If you're running your own server(s) anyhow then backups, user admin, etc... are a sunk cost you've already spent. If you're running your own servers anyhow, it's really not a big deal. I have a normal GMail account and a enterprise google apps account and both of them have pretty frequent IMAP outages (usually just for 5-15 minutes, nothing serious) whereas my mail servers haven't been down in years (minus planned server migrations). Also, if something does break, I like being able to go in and fix it, without waiting for other people.
davidw 16y ago
It really isn't that difficult. Except for spam; that one's really a kicker, and is the reason I finally switched to utilizing Google.
lisper 16y ago
> Bullshit. There's troubleshooting when things go wrong, patching, maintenance, etc. In over 10 years of hosting my own email I've never had a problem that needed troubleshooting after getting the initial installation sorted out. And patching on Debian is trivial. > Your single server is much easier to target and break into than Google's. "Stealth" does not mean "harder to break into", it means "less likely to attract the attention of someone with the means and motivation to break in." Google may be harder to break into, but it's a much bigger target. My house is easier to break into than, say, Bagram air force base. That doesn't mean that I'm safer in Bagram.
- moe 16y ago
  And patching on Debian is trivial. Patching is never trivial. The process itself may be trivial, but you have to actually do it. That latter part requires ongoing attention, which makes it non-trivial. less likely to attract the attention of someone with the means and motivation to break in That depends. Most attackers go for low hanging fruit. And the fruit hardly hangs low at google with their dedicated security team. The most juicy targets are actually those little homebrew servers that someone once setup and then mostly forgot about. The spammers can often use these servers for months before anyone (usually the ISP, not the owner) takes notice. If your server is listening on Port 25 then it's not stealth. It's very likely being scanned while I write this comment - perhaps to see if it's an exim vulnerable to the recent remote-shell exploit (http://www.debian.org/security/2010/dsa-2131 http://www.debian.org/security/2010/dsa-2131). So, to wrap this up. I also run mailservers for various companies. I also run debian. I even also run dovecot and postfix. But I'm doing this for a living, am subscribed to the relevant security mailing lists, harden the hosts before deploying them, and I monitor them. If you don't have a dedicated or hired admin to do all that then hosted e-mail usually has the better value proposition.

seiji 16y ago

With Google email hosting you just have to worry about a few hundred people who can read all your email, their data retention policies, and who can subpoena your private communications. (conspiracy theory: Google gives the public one text box on a webpage to search the Internet. Do you think they don't have a text box on an internal webpage to search all of Gmail? Do you think facebook doesn't have one internal webpage capable of searching all private communications? Facebook used to advertise "spy on your friends!" as an employment perk.)

davidw 16y ago
> Do you think they don't have a text box on an internal webpage to search all of Gmail? That kind of thing would leak out sooner or later.
- jacquesm 16y ago
  Google had a rogue sysadmin that was apparently able to access user data with ease a short time ago. It might not be as easy as a textbox to search all of Gmail but your gmail data store appears to be wide open to a fairly large number of google employees.
maukdaddy 16y ago
and who can subpoena your private communications. Hate to break it to you, but that same subpoena can just as easily allow your house, office, or datacenter to be raided. Your data is just as susceptible to lawful intercept at Google as it is your private premises.
- mike-cardwell 16y ago
  When self hosting, you can make sure that deleted email has actually been deleted. You have control over how long logs are kept. You have control over whether or not to use encrypted filesystems.
- lambda 16y ago
  It is much easier for one over-broad subpoena or search warrant to reveal your private data if it's hosted on Google than if it's hosted on your own server. If everyone keeps their own data on their own machines, then they would need to subpoena or get a search warrant for each individual person, rather than a broad one attempting to fish for information. Furthermore, you can fight a subpoena. Do you trust Google to fight a subpoena on your behalf? How would they even know whether or not they should; how would they be able to tell if the subpoena is reasonable or not?

modoc 16y ago

If you're new to running a mail server or linux server, then yes, lots of troubleshooting, etc... If you have someone who knows what they're doing, it's really not a big deal. I don't think I've had to spend any time on any of my mail servers in ages. Not sure what you mean by additional storage? Local corporate e-mail might take up ~10GB per person after a few years? Most of my servers have 1+ TB of local storage + SAN. Takes a lot of e-mail to fill that up. Spam and malware filtering are both pretty easy. yum/apt-get install clam and/or spamassissin/razor/pyzor/whatever. If you're running your own server(s) anyhow then backups, user admin, etc... are a sunk cost you've already spent. If you're running your own servers anyhow, it's really not a big deal. I have a normal GMail account and a enterprise google apps account and both of them have pretty frequent IMAP outages (usually just for 5-15 minutes, nothing serious) whereas my mail servers haven't been down in years (minus planned server migrations). Also, if something does break, I like being able to go in and fix it, without waiting for other people.

davidw 16y ago

It really isn't that difficult. Except for spam; that one's really a kicker, and is the reason I finally switched to utilizing Google.

lisper 16y ago

> Bullshit. There's troubleshooting when things go wrong, patching, maintenance, etc. In over 10 years of hosting my own email I've never had a problem that needed troubleshooting after getting the initial installation sorted out. And patching on Debian is trivial. > Your single server is much easier to target and break into than Google's. "Stealth" does not mean "harder to break into", it means "less likely to attract the attention of someone with the means and motivation to break in." Google may be harder to break into, but it's a much bigger target. My house is easier to break into than, say, Bagram air force base. That doesn't mean that I'm safer in Bagram.

moe 16y ago
And patching on Debian is trivial. Patching is never trivial. The process itself may be trivial, but you have to actually do it. That latter part requires ongoing attention, which makes it non-trivial. less likely to attract the attention of someone with the means and motivation to break in That depends. Most attackers go for low hanging fruit. And the fruit hardly hangs low at google with their dedicated security team. The most juicy targets are actually those little homebrew servers that someone once setup and then mostly forgot about. The spammers can often use these servers for months before anyone (usually the ISP, not the owner) takes notice. If your server is listening on Port 25 then it's not stealth. It's very likely being scanned while I write this comment - perhaps to see if it's an exim vulnerable to the recent remote-shell exploit (http://www.debian.org/security/2010/dsa-2131 http://www.debian.org/security/2010/dsa-2131). So, to wrap this up. I also run mailservers for various companies. I also run debian. I even also run dovecot and postfix. But I'm doing this for a living, am subscribed to the relevant security mailing lists, harden the hosts before deploying them, and I monitor them. If you don't have a dedicated or hired admin to do all that then hosted e-mail usually has the better value proposition.