3 ms·

SMTP needs to die too. Is there even a competing protocol in the pipeline that would mandate encryption and prevent the spoofing of the sender? Every piece of d

by cm2187 6y ago

SMTP needs to die too. Is there even a competing protocol in the pipeline that would mandate encryption and prevent the spoofing of the sender? Every piece of duck tape on top of smtp (startrls, spf, dkim) are optional, cannot be relied on, and often isn’t relied on.

user5994461 6y ago
Agreed on everything but SPF. SPF is very simple and works really well.
- cm2187 6y ago
  But it is so often misconfigured or not configured that it is not that useful. Something like a strict spf should be part the mandatory protocol so you can safely reject incoming mails who fail the rules.
corty 6y ago
Just use any modern IM protocol for that, like matrix, xmpp or maybe even one of the proprietary ones. They all do what SMTP does and more, you would just need to skin the client to look like a mail client to fool your users.
- cm2187 6y ago
  I meant rather with the aim of progressively replacing smtp. We complain about these protocols that are too widespread to ever be retired but the reality is that TLS and http are managing the pace, ftp, pop and imap are almost gone, and smtp is probably the last of the 1990s protocols that is frozen in time while being a backbone of communications (and attack vectors) on the internet.
  - corty 6y ago
    Maybe, but progressive replacement also got us dkim, spf and all that. So I'm not sure that there is a possible way to do this for SMTP in any "good" way...
peterwwillis 6y ago
Not aware of an SMTP replacement, that will be a real doozy. Maybe one day FastMail or Google will write a new overcomplicated poorly-documented API-driven cant-do-anything-without-15-layers-of-abstraction replacement and we can spend a couple trillion dollars on replacement gear and new features. I still like SMTP. Just last year I was able to find the owner of a random smtp box that nobody knew where it was or who it belonged to, by telnet-ing to port 25 and typing out an e-mail to 'root'. Got a response from an admin an hour later. You gotta respect a protocol that you can use directly with nothing but a network socket and a terminal, using the same protocol syntax you learned two decades before.

by cm2187 6y ago

user5994461 6y ago

Agreed on everything but SPF. SPF is very simple and works really well.

cm2187 6y ago
But it is so often misconfigured or not configured that it is not that useful. Something like a strict spf should be part the mandatory protocol so you can safely reject incoming mails who fail the rules.

corty 6y ago

Just use any modern IM protocol for that, like matrix, xmpp or maybe even one of the proprietary ones. They all do what SMTP does and more, you would just need to skin the client to look like a mail client to fool your users.

cm2187 6y ago
I meant rather with the aim of progressively replacing smtp. We complain about these protocols that are too widespread to ever be retired but the reality is that TLS and http are managing the pace, ftp, pop and imap are almost gone, and smtp is probably the last of the 1990s protocols that is frozen in time while being a backbone of communications (and attack vectors) on the internet.
- corty 6y ago
  Maybe, but progressive replacement also got us dkim, spf and all that. So I'm not sure that there is a possible way to do this for SMTP in any "good" way...

peterwwillis 6y ago

Not aware of an SMTP replacement, that will be a real doozy. Maybe one day FastMail or Google will write a new overcomplicated poorly-documented API-driven cant-do-anything-without-15-layers-of-abstraction replacement and we can spend a couple trillion dollars on replacement gear and new features. I still like SMTP. Just last year I was able to find the owner of a random smtp box that nobody knew where it was or who it belonged to, by telnet-ing to port 25 and typing out an e-mail to 'root'. Got a response from an admin an hour later. You gotta respect a protocol that you can use directly with nothing but a network socket and a terminal, using the same protocol syntax you learned two decades before.