6 ms·

What?

by leoh 7y ago

What?

inetknght 7y ago
Google has a vested interest in reading your email. Google lets users think that setting up a mail server is difficult, that email is a dead end communication medium compared to walled gardens, and that phishing is difficult to combat effectively.
- shadowgovt 7y ago
  FWIW though, setting up a mail server is difficult. Setting up a mail client with reasonable spam filtering to make email usable is also difficult. Compare the list of steps on either of those tasks to the list for getting email via Gmail: "1) Sign up to a Google account, 2) visit gmail.com"; it's obvious almost all users are going to do the latter (or its equivalent at a Google competitor).
  - inetknght 7y ago
    Setting up a mail server isn't difficult. It's about as easy as installing and configuring a web server, and just about as technical. Email has been around for decades. The fact that Gmail, Yahoo, Hotmail, and many paid services have had one-click email addresses for twenty-plus years should demonstrate that it's not difficult. Businesses just don't want to make it easy for lay people to do it.
    - jefftk 7y ago
      I've run a mail server, and still help out with one, and getting consistent deliverability is hard. We've wanted to move to another hosting service for years, but the only reason we're doing ok right now is that our dedicated IP has a solid history and we just can't give that up in a migration.
    - ceejayoz 7y ago
      The services you mention all have entire large teams devoted to tackling spam, reputation, uptime, etc. That it's easy and cheap on a marginal basis for them to add one more inbox to their millions doesn't mean the overall infrastructure is easy to keep running.
      - inetknght 7y ago
        > The services you mention all have entire large teams devoted to tackling spam, reputation, uptime, etc. Can you provide specific numbers to the count of people devoted to tackling spam, reputation, uptime, etc? I suspect the number's a lot smaller than you think. I also suspect the peoples' duties are less devoted than you think. If Google, for example, truly worked to tackle spam then it wouldn't have a spam problem today. If Yahoo truly worked to tackle reputation, people wouldn't have trouble sending email using an email client instead of a browser. I'll grant you that uptime does have dedicated people. But it's not to tackle spam or reputation. It's because offline services don't make a profit.
        joshuamorton 7y ago
        I work with these teams at Google. There are teams that actively (and solely) work on spam and abuse detection. They're larger than you seem to believe, though I won't give exact numbers. There's also obviously sre teams that maintain uptime. (Note I said teams, and there's a public approximate minimum size for an are team at Google of 8-12 people) The problem is that spam can't be "solved". Reputation is easy to solve: only accept email from a known list of good senders. Gmail, Yahoo, MailChimp (or not), etc. But that makes people on HN complain. So your have to try and infer reputation of mailservers on shared hosts. And spammers are always trying to beat you, and there are thousands, maybe tens of thousands of spam outfits. Af they're sneaky. They try to use awa or gcp to send email, or even send spam from Gmail, prevent trickier things. So you're left to defend from a spam campaign from Yahoo while also trying to not block everyone at Yahoo, and detect the spammers who are using Gmail to spam Yahoo too. And the spammers are always innovating, so you have to as well. My personal belief is that Google likely considers spam detection to be an area of competitive advantage so investments are warranted.
        inetknght 7y ago
        > The problem is that spam can't be "solved". Reputation is easy to solve: only accept email from a known list of good senders. Gmail, Yahoo, MailChimp (or not), etc. But that makes people on HN complain. So your have to try and infer reputation of mailservers on shared hosts. And spammers are always trying to beat you, and there are thousands, maybe tens of thousands of spam outfits. Af they're sneaky. They try to use awa or gcp to send email, or even send spam from Gmail, prevent trickier things. So you're left to defend from a spam campaign from Yahoo while also trying to not block everyone at Yahoo, and detect the spammers who are using Gmail to spam Yahoo too. Spam absolutely can be solved. 1) enforce identity. If the sender isn't authentic, then the sender is spam. 2) enforce reportability. If the user reports the sender as spam, then don't permit the sender to send more messages to the person who complained. if a lot of people report the problem, then block the sender. 3) enforce liability. if an ISP hosts spammers, then block the ISP. If someone complains then walk them through the process. Just like people shouldn't drive vehicles without understanding that vehicles are dangerous, the same should be done with computers.
    - chipotle_coyote 7y ago
      Unless email servers have gotten a lot more turnkey in the last few years, I'm gonna disagree with this, sorry. :) I can get nginx running on most systems with literally a couple commands ("package-manager-thing install nginx" and "service-manager-thing start nginx"). Getting a mail server running -- at least in any form that qualifies as "Gmail replacement" -- seems to involve "install postfix, immediately edit the configuration because it has no out-of-the-box defaults, create multiple configuration files beyond that because that's how postfix rolls, install dovecot, immediately edit its configuration because it has no out-of-the-box defaults either, create some directories and user accounts and more configuration files because that's how dovecot rolls, then test that everything's working." And I'm leaving out the "install MySQL" part that many guides you'll find online will also have you do. Also, I haven't talked about running a spam filter and YOUR HARD DRIVE IS ALREADY FULL OF NIGERIAN PRINCES TRYING TO SELL YOU PENIS-ENLARGING BITCOIN I'M SO SORRY. I would love it if "package-manager-thing install mail-server-thing" and "service-manager-thing start mail-server-thing" could get things going with sensible defaults like they do with nginx, even if you'd probably need to tweak things after they were going just like you're almost certainly going to do with a web server. But AFAIK, that just ain't the case.
      - inetknght 7y ago
        https://github.com/mailcow/mailcow-dockerized https://github.com/mailcow/mailcow-dockerized
        chipotle_coyote 7y ago
        While I don't have to set up a mail server any time soon, I am absolutely bookmarking this. :)
    - shadowgovt 7y ago
      The simplest web server I'm aware of is `python http.server 8080` ... and even for that, I had to disable / re-enable the firewall and fish around in the docs just last night to get the dang thing to accept connections from a source other than localhost (PROTIP: when running on a pretty-out-of-the-box Windows 10 config, the default options bind listeners to IPv6, not IPv4). And I definitely wouldn't recommend that configuration for production; you'll open yourself up to a universe of pain. But as an analogy for setting up an email server vs. just subscribing to Google or whoever, I accept it. ;)
- AnIdiotOnTheNet 7y ago
  Phishing is difficult to combat effectively. Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble. Ironically, it is the technical problem of verification that makes it difficult to run (not setup) a mailserver: no one wants to trust it.
  - inetknght 7y ago
    > Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble. Tell me more about how DKIM and SPF and TLS with client certificates don't verify senders.
    - AnIdiotOnTheNet 7y ago
      I didn't say they didn't, I said we haven't adopted a way of verifying senders. If DKIM, SPF, and TLS were universal, it would be a solved issue, but they aren't for a whole lot of reasons. P.S.: However, come to think of it, they don't. You can receive a perfectly legit and verified email from scammer@consrus.ru with the name displayed as "Mr. Your CEO".
  - kedean 7y ago
    I don't think verification of sender is the problem (see PGP), it's that email was built such that anyone can contact anyone without setup ahead of time. I can give my address to some guy I meet at a conference and he can email me later with no issues, we don't need to agree ahead of time that we know who each other are. If he uses PGP, I need to accept the first communication is him, which means anyone can send me anything claiming to be anyone. Unfortunately, as soon as you solve this part of the issue with technology, I think you've just reinvented social media.
    - jimmydorry 7y ago
      He said "adopted". Not "invented". PGP is not main-stream and probably never will be. Such technologies have to be done behind the scenes and presented seamlessly, or they will probably never take off.
- toast0 7y ago
  > Google lets users think that [...] phishing is difficult to combat effectively. It sure is when they don't even bother to show the From address, there's no way to make links unclickable as an email administrator. At this point, between Microsoft and Google ruining it in different ways, email has very little hope as a medium.
horsawlarway 7y ago
Eh, I agree with him. I've been with gmail since middle school (going on... a LOT of years now, back when it was invite only). Somewhere in the last 10 years or so it feels like the gmail team switched from "Make a good email client" to "Shove all the enterprisey things into gmail!". It's gotten SO slow to load and is incredibly bloated. I was a happy inbox user until... drumroll... they shut that down too. I still use Gmail because old habits die hard, but I won't ever suggest a google tool at work. Fool me once, shame on you...
- benhurmarcel 7y ago
  Actually for work Gmail has gotten (and is getting) better. My workplace switched from Outlook to Gmail recently and I felt like it was a net improvement.

What?

by leoh 7y ago

What?

Google has a vested interest in reading your email. Google lets users think that setting up a mail server is difficult, that email is a dead end communication medium compared to walled gardens, and that phishing is difficult to combat effectively.

shadowgovt 7y ago
FWIW though, setting up a mail server is difficult. Setting up a mail client with reasonable spam filtering to make email usable is also difficult. Compare the list of steps on either of those tasks to the list for getting email via Gmail: "1) Sign up to a Google account, 2) visit gmail.com"; it's obvious almost all users are going to do the latter (or its equivalent at a Google competitor).
- inetknght 7y ago
  Setting up a mail server isn't difficult. It's about as easy as installing and configuring a web server, and just about as technical. Email has been around for decades. The fact that Gmail, Yahoo, Hotmail, and many paid services have had one-click email addresses for twenty-plus years should demonstrate that it's not difficult. Businesses just don't want to make it easy for lay people to do it.
  - jefftk 7y ago
    I've run a mail server, and still help out with one, and getting consistent deliverability is hard. We've wanted to move to another hosting service for years, but the only reason we're doing ok right now is that our dedicated IP has a solid history and we just can't give that up in a migration.
  - ceejayoz 7y ago
    The services you mention all have entire large teams devoted to tackling spam, reputation, uptime, etc. That it's easy and cheap on a marginal basis for them to add one more inbox to their millions doesn't mean the overall infrastructure is easy to keep running.
    - inetknght 7y ago
      > The services you mention all have entire large teams devoted to tackling spam, reputation, uptime, etc. Can you provide specific numbers to the count of people devoted to tackling spam, reputation, uptime, etc? I suspect the number's a lot smaller than you think. I also suspect the peoples' duties are less devoted than you think. If Google, for example, truly worked to tackle spam then it wouldn't have a spam problem today. If Yahoo truly worked to tackle reputation, people wouldn't have trouble sending email using an email client instead of a browser. I'll grant you that uptime does have dedicated people. But it's not to tackle spam or reputation. It's because offline services don't make a profit.
      - joshuamorton 7y ago
        I work with these teams at Google. There are teams that actively (and solely) work on spam and abuse detection. They're larger than you seem to believe, though I won't give exact numbers. There's also obviously sre teams that maintain uptime. (Note I said teams, and there's a public approximate minimum size for an are team at Google of 8-12 people) The problem is that spam can't be "solved". Reputation is easy to solve: only accept email from a known list of good senders. Gmail, Yahoo, MailChimp (or not), etc. But that makes people on HN complain. So your have to try and infer reputation of mailservers on shared hosts. And spammers are always trying to beat you, and there are thousands, maybe tens of thousands of spam outfits. Af they're sneaky. They try to use awa or gcp to send email, or even send spam from Gmail, prevent trickier things. So you're left to defend from a spam campaign from Yahoo while also trying to not block everyone at Yahoo, and detect the spammers who are using Gmail to spam Yahoo too. And the spammers are always innovating, so you have to as well. My personal belief is that Google likely considers spam detection to be an area of competitive advantage so investments are warranted.
        inetknght 7y ago
        > The problem is that spam can't be "solved". Reputation is easy to solve: only accept email from a known list of good senders. Gmail, Yahoo, MailChimp (or not), etc. But that makes people on HN complain. So your have to try and infer reputation of mailservers on shared hosts. And spammers are always trying to beat you, and there are thousands, maybe tens of thousands of spam outfits. Af they're sneaky. They try to use awa or gcp to send email, or even send spam from Gmail, prevent trickier things. So you're left to defend from a spam campaign from Yahoo while also trying to not block everyone at Yahoo, and detect the spammers who are using Gmail to spam Yahoo too. Spam absolutely can be solved. 1) enforce identity. If the sender isn't authentic, then the sender is spam. 2) enforce reportability. If the user reports the sender as spam, then don't permit the sender to send more messages to the person who complained. if a lot of people report the problem, then block the sender. 3) enforce liability. if an ISP hosts spammers, then block the ISP. If someone complains then walk them through the process. Just like people shouldn't drive vehicles without understanding that vehicles are dangerous, the same should be done with computers.
  - chipotle_coyote 7y ago
    Unless email servers have gotten a lot more turnkey in the last few years, I'm gonna disagree with this, sorry. :) I can get nginx running on most systems with literally a couple commands ("package-manager-thing install nginx" and "service-manager-thing start nginx"). Getting a mail server running -- at least in any form that qualifies as "Gmail replacement" -- seems to involve "install postfix, immediately edit the configuration because it has no out-of-the-box defaults, create multiple configuration files beyond that because that's how postfix rolls, install dovecot, immediately edit its configuration because it has no out-of-the-box defaults either, create some directories and user accounts and more configuration files because that's how dovecot rolls, then test that everything's working." And I'm leaving out the "install MySQL" part that many guides you'll find online will also have you do. Also, I haven't talked about running a spam filter and YOUR HARD DRIVE IS ALREADY FULL OF NIGERIAN PRINCES TRYING TO SELL YOU PENIS-ENLARGING BITCOIN I'M SO SORRY. I would love it if "package-manager-thing install mail-server-thing" and "service-manager-thing start mail-server-thing" could get things going with sensible defaults like they do with nginx, even if you'd probably need to tweak things after they were going just like you're almost certainly going to do with a web server. But AFAIK, that just ain't the case.
    - inetknght 7y ago
      https://github.com/mailcow/mailcow-dockerized https://github.com/mailcow/mailcow-dockerized
      - chipotle_coyote 7y ago
        While I don't have to set up a mail server any time soon, I am absolutely bookmarking this. :)
  - shadowgovt 7y ago
    The simplest web server I'm aware of is `python http.server 8080` ... and even for that, I had to disable / re-enable the firewall and fish around in the docs just last night to get the dang thing to accept connections from a source other than localhost (PROTIP: when running on a pretty-out-of-the-box Windows 10 config, the default options bind listeners to IPv6, not IPv4). And I definitely wouldn't recommend that configuration for production; you'll open yourself up to a universe of pain. But as an analogy for setting up an email server vs. just subscribing to Google or whoever, I accept it. ;)
AnIdiotOnTheNet 7y ago
Phishing is difficult to combat effectively. Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble. Ironically, it is the technical problem of verification that makes it difficult to run (not setup) a mailserver: no one wants to trust it.
- inetknght 7y ago
  > Part of the problem is technological in that we never adopted a way of verifying senders are who they claim to be, but a large part of it is that humans are really good at fooling other humans, at least enough of the time to cause trouble. Tell me more about how DKIM and SPF and TLS with client certificates don't verify senders.
  - AnIdiotOnTheNet 7y ago
    I didn't say they didn't, I said we haven't adopted a way of verifying senders. If DKIM, SPF, and TLS were universal, it would be a solved issue, but they aren't for a whole lot of reasons. P.S.: However, come to think of it, they don't. You can receive a perfectly legit and verified email from scammer@consrus.ru with the name displayed as "Mr. Your CEO".
- kedean 7y ago
  I don't think verification of sender is the problem (see PGP), it's that email was built such that anyone can contact anyone without setup ahead of time. I can give my address to some guy I meet at a conference and he can email me later with no issues, we don't need to agree ahead of time that we know who each other are. If he uses PGP, I need to accept the first communication is him, which means anyone can send me anything claiming to be anyone. Unfortunately, as soon as you solve this part of the issue with technology, I think you've just reinvented social media.
  - jimmydorry 7y ago
    He said "adopted". Not "invented". PGP is not main-stream and probably never will be. Such technologies have to be done behind the scenes and presented seamlessly, or they will probably never take off.
toast0 7y ago
> Google lets users think that [...] phishing is difficult to combat effectively. It sure is when they don't even bother to show the From address, there's no way to make links unclickable as an email administrator. At this point, between Microsoft and Google ruining it in different ways, email has very little hope as a medium.

horsawlarway 7y ago

Eh, I agree with him. I've been with gmail since middle school (going on... a LOT of years now, back when it was invite only). Somewhere in the last 10 years or so it feels like the gmail team switched from "Make a good email client" to "Shove all the enterprisey things into gmail!". It's gotten SO slow to load and is incredibly bloated. I was a happy inbox user until... drumroll... they shut that down too. I still use Gmail because old habits die hard, but I won't ever suggest a google tool at work. Fool me once, shame on you...

benhurmarcel 7y ago
Actually for work Gmail has gotten (and is getting) better. My workplace switched from Outlook to Gmail recently and I felt like it was a net improvement.