7 ms·

Internet Mail 2000

69 points by pmoriarty 5y ago

lukevp 5y ago
This sounds like a nightmare, mostly because the implication is that refreshing my inbox would amount to pulling emails from thousands of 3rd party servers, any one or more of which may be down at any given time.
- spc476 5y ago
  You make that sound like a negative. I run my own email server and have implemented greylisting [1]. Greylisting easily drops my incoming email by 50%, but that 50% was being sent by non-compliant SMTP "servers" (probably, a program running on an exploited box somewhere to spam email). Legitimate email servers will always queue email and try again when they encounter a transitory error. [1] https://en.wikipedia.org/wiki/Greylisting_(email) https://en.wikipedia.org/wiki/Greylisting_(email)
  - rascul 5y ago
    Greylisting is good stuff. I have found similar results.
    - cm2187 5y ago
      Until we need mail for 2FA, then it becomes an unworkable pain in the arse.
  - tsukikage 5y ago
    * the delay makes 2FA super frustrating * a number of the larger services have pools of mailservers; when they retry the send, they retry from a different random host in the pool. Naturally this breaks greylisting completely.
    - yrro 5y ago
      You don't have to use the full IP address of the relating party when matching greylist entries. Even just ignoring it, and greylisting solely on (sender, recipient) is better than nothing... especially if you're already enforcing based on the sender's SPF record.
    - geocar 5y ago
      > * the delay makes 2FA super frustrating I think you misunderstand. If I'm expecting to log in via 2FA with my email client, I'll have my email client open (and polling for email in IM2K, or in an SMTP-world, my MX points directly at my email client) so the message won't be delayed if I'm expecting it. I think it's okay to delay unsolicited mail, after all, I have to sleep some time... > * a number of the larger services have pools of mailservers; when they retry the send, they retry from a different random host in the pool. Naturally this breaks greylisting completely. I don't think this is true; Can you explain a little why you think this is a problem? Back in the late 1990s and early 2000s I ran a large mail server (queue on NFS) and had this problem, and I solved it by hashing the authenticated sender and using that to choose the pool of addresses to try for that week. This way, a bad actor might burn 3-4 IP addresses by spamming and get me added to one of the popular blacklists, but they don't take out my entire system, and that gave me time to correct the problem. When Greylisting started becoming popular, I had some slightly longer delays than the more popular single-node mail servers out there, but I tweaked this to simply prefer the same address until seeing some headers then retry on the alternate to see if we get a different answer. Now it's 2022, and I suspect any big mail server knows these tricks and more, and any operator who doesn't know about greylisting in 2022 is going to have other problems.
    - spc476 5y ago
      2FA has never been an issue with me. If it's a one-time thing (like signing up for a website) the wait doesn't bother me, and no services have ever rejected me because I didn't respond within five minutes. If it's a recurring thing, I can always whitelist the domain, the IP, the sender, or all three. Even the senders with pools of mail servers hasn't been an issue---the email will eventually get through. As far as I can tell, in the fifteen years I've been using greylisting, that has just not been an issue. When I first started with greylisting, I set the embargo time (minimum time to reject emails) to an hour. I later dropped it down to 25 minutes, but that's just me being a bit over-cautious. Just a one-time temporary reject is enough to filter out something like 80% of what I catch with 25 minutes.
- markstos 5y ago
  Odds are more likely that you have less than 100 messages waiting and more than 80 of them are stored on major, reliable hosts like Gmail, Amazon and Microsoft.
- ttyprintk 5y ago
  Well, maybe your preference is not to leak your confirmation time. In which case, you’d set up a background process to automatically retrieve and store. This is congruent to the traffic shape today. And it wouldn’t be bad if store-and-forward catches on, because it relieves the storage pressure for big, free services, which would be the largest burden attempting free, anonymized messaging at scale.
jefftk 5y ago
This was an interesting proposal at the time, but the problems it's trying to solve (storage, bounces) are very different from the problems we ended up having (spam, spam, spam).
- quesera 5y ago
  Spam is a non-issue in 2022. Also in 2012. The available solutions all work extremely well, from rspamd to Gmail, and have for many years. We can thank Paul Graham for popularizing the solution, in fact. Thanks Paul! The only real issue for email today is deliverability. That's getting worse, according to reports from people who have not had a stable verified public IP address for decades.
  - BeetleB 5y ago
    > The available solutions all work extremely well, from rspamd to Gmail, and have for many years. When the "Unsubscribe" feature fails (about 10% of the time in my experience), then those emails are legitimately spam. None of the spam solutions work for those emails.
    - quesera 5y ago
      I see one or two messages per week, and I guarantee that my email addresses are on every spam list in the English-speaking world. (Also Chinese and Russian -- at a minimum) If spam is a problem for you in 2022, you have a crappy email provider.
      - BeetleB 5y ago
        You didn't understand the point of my comment. If you sign up for something (e.g. by purchasing goods from a legitimate store), those will virtually never be classified as spam. The reality is that it is hard to get off those lists - a lot of them have an "Unsubscribe" link that purports to get you off their list, but do not actually do so. If you have a provider that is classifying them as spam, then you have a crappy provider.
recuter 5y ago
Somebody copy pasta the "so you think you can fix email, this is why your idea won't work" thing. Meanwhile every time this subject comes up (and cascades into side topic posts about how it is hard to self host and mutt vs thunderbird) I'm left wondering why we even need internet mail anymore when there are so many other overlapping communication channels already. You message your normal friends on WhatsApp. You message your nerdy friends on Signal. You message your drug dealer on Telegram. Nobody writes email sized messages anymore just like nobody writes letters anymore. You message your in-laws from an incognito Facebook tab a couple times a year. Sometimes when you want to message no one in particular you shout into the void on Twitter. You communicate with your team by hooking up GPT-3/perl-script to your corporate slack for your first gig and Microsoft Teams for the secret second gig. Just be sure to not send the emojis after work hours. That open source project you like is now increasingly sequestered on some discord instead of a traditional mailing list. What is left for internet mail to do? Seems like it mirrors the real life postal service and has been reduced to mostly junk mail and newsletters you aren't going to get around to reading because you're busy slogging through your RSS feeds (what is dead may never die). Maybe we've been so obsessed with figuring out how to operate our own postal service like in the frontier days we forgot to ask ourselves whether we should want to in the first place. Neither snow nor rain nor heat nor gloom of night stays these couriers from the swift delivery of plain text messages over an open protocol via the public net. For What?
- noduerme 5y ago
  I write (and receive) a lot of email-sized messages, and email / phone are pretty much the only ways I communicate with clients. Most client emails involve lists of features and questions which we reply to with line-by-line comments (think red/blue, quotes within quotes). To me it's more efficient and less distracting to have all my work comms in a single email thread per project than scattered across different services. I've tried doing this with shared documents and spreadsheets, but found it's a mess, because no one checks and notices when you change them, or scrolls around to find the thing you added or commented on. The issues are complicated and technical enough that chat format, especially thumb-typing, is not helpful. With email, clients usually see and respond quickly so I can get on with work. And there's a consistent paper trail to refer to. If the issue needs a discussion that's too complex for the email chain, or if they don't fully understand the options or limitations I'm describing, I call the client and hash it out, then put the result we agreed on into an email and send it to them.
readingnews 5y ago
You know, I used to love reading DJBs bitch slaps in his replies to people. He was legendary in the way Linus is legendary... "...But I do know that she likes my in your face attitude" -- Bender relaying Leelas remarks on him in Futurama, S1E7. On a non-related note, I used the hell out of Qmail and DJBDNS for years. I sometimes look out into the darkness before I drift off into unconsciousness and wonder why I do not use them today.
- dsr_ 5y ago
  The architecture of both qmail and djbdns are excellent. However, the lack of a clear maintenance team means that they fracture whenever a new must-have feature comes along. If you need dynamic DNS support, djbdns needs something else to handle it. If you need TLS for your mailserver, qmail needs something to handle it. Greylisting? Something else. If qmail and djbdns had communities the same size as Postfix and Knot, they would be excellent general-purpose choices.
transfire 5y ago
I like it. It would make it much easier to control incoming messages… such as retrieving only the most recent of ads from a retail company. The only other solution I have thought of is to charge for email. Say a few cents per message would go from sender to receiver. That would definitely reduce spam.
- rattlesnakedave 5y ago
  This was the origin of proof of work.
- aidenn0 5y ago
  > The only other solution I have thought of is to charge for email. Say a few cents per message would go from sender to receiver. That would definitely reduce spam. Spam would still come from hacked boxes, being charged to the owner of the hacked box.
Jenda_ 5y ago
I don't understand this one: > In IM2000, mailing lists are a purely local matter for the receiver's software. We still need to manage list of users we want to send notifications to, right? ("The message isn't copied to the receiver's ISP. All the receiver needs is a brief notification that a message is available.") Or is it expected there will be no "push" notifications for mailing lists, but I will actively ask about new messages in the list on every inbox refresh? That seems a bit wasteful, especially when this protocol seems to be concerned about efficiency.

Internet Mail 2000

69 points by pmoriarty 5y ago

This sounds like a nightmare, mostly because the implication is that refreshing my inbox would amount to pulling emails from thousands of 3rd party servers, any one or more of which may be down at any given time.

spc476 5y ago
You make that sound like a negative. I run my own email server and have implemented greylisting [1]. Greylisting easily drops my incoming email by 50%, but that 50% was being sent by non-compliant SMTP "servers" (probably, a program running on an exploited box somewhere to spam email). Legitimate email servers will always queue email and try again when they encounter a transitory error. [1] https://en.wikipedia.org/wiki/Greylisting_(email) https://en.wikipedia.org/wiki/Greylisting_(email)
- rascul 5y ago
  Greylisting is good stuff. I have found similar results.
  - cm2187 5y ago
    Until we need mail for 2FA, then it becomes an unworkable pain in the arse.
- tsukikage 5y ago
  * the delay makes 2FA super frustrating * a number of the larger services have pools of mailservers; when they retry the send, they retry from a different random host in the pool. Naturally this breaks greylisting completely.
  - yrro 5y ago
    You don't have to use the full IP address of the relating party when matching greylist entries. Even just ignoring it, and greylisting solely on (sender, recipient) is better than nothing... especially if you're already enforcing based on the sender's SPF record.
  - geocar 5y ago
    > * the delay makes 2FA super frustrating I think you misunderstand. If I'm expecting to log in via 2FA with my email client, I'll have my email client open (and polling for email in IM2K, or in an SMTP-world, my MX points directly at my email client) so the message won't be delayed if I'm expecting it. I think it's okay to delay unsolicited mail, after all, I have to sleep some time... > * a number of the larger services have pools of mailservers; when they retry the send, they retry from a different random host in the pool. Naturally this breaks greylisting completely. I don't think this is true; Can you explain a little why you think this is a problem? Back in the late 1990s and early 2000s I ran a large mail server (queue on NFS) and had this problem, and I solved it by hashing the authenticated sender and using that to choose the pool of addresses to try for that week. This way, a bad actor might burn 3-4 IP addresses by spamming and get me added to one of the popular blacklists, but they don't take out my entire system, and that gave me time to correct the problem. When Greylisting started becoming popular, I had some slightly longer delays than the more popular single-node mail servers out there, but I tweaked this to simply prefer the same address until seeing some headers then retry on the alternate to see if we get a different answer. Now it's 2022, and I suspect any big mail server knows these tricks and more, and any operator who doesn't know about greylisting in 2022 is going to have other problems.
  - spc476 5y ago
    2FA has never been an issue with me. If it's a one-time thing (like signing up for a website) the wait doesn't bother me, and no services have ever rejected me because I didn't respond within five minutes. If it's a recurring thing, I can always whitelist the domain, the IP, the sender, or all three. Even the senders with pools of mail servers hasn't been an issue---the email will eventually get through. As far as I can tell, in the fifteen years I've been using greylisting, that has just not been an issue. When I first started with greylisting, I set the embargo time (minimum time to reject emails) to an hour. I later dropped it down to 25 minutes, but that's just me being a bit over-cautious. Just a one-time temporary reject is enough to filter out something like 80% of what I catch with 25 minutes.
markstos 5y ago
Odds are more likely that you have less than 100 messages waiting and more than 80 of them are stored on major, reliable hosts like Gmail, Amazon and Microsoft.
ttyprintk 5y ago
Well, maybe your preference is not to leak your confirmation time. In which case, you’d set up a background process to automatically retrieve and store. This is congruent to the traffic shape today. And it wouldn’t be bad if store-and-forward catches on, because it relieves the storage pressure for big, free services, which would be the largest burden attempting free, anonymized messaging at scale.

jefftk 5y ago

This was an interesting proposal at the time, but the problems it's trying to solve (storage, bounces) are very different from the problems we ended up having (spam, spam, spam).

quesera 5y ago
Spam is a non-issue in 2022. Also in 2012. The available solutions all work extremely well, from rspamd to Gmail, and have for many years. We can thank Paul Graham for popularizing the solution, in fact. Thanks Paul! The only real issue for email today is deliverability. That's getting worse, according to reports from people who have not had a stable verified public IP address for decades.
- BeetleB 5y ago
  > The available solutions all work extremely well, from rspamd to Gmail, and have for many years. When the "Unsubscribe" feature fails (about 10% of the time in my experience), then those emails are legitimately spam. None of the spam solutions work for those emails.
  - quesera 5y ago
    I see one or two messages per week, and I guarantee that my email addresses are on every spam list in the English-speaking world. (Also Chinese and Russian -- at a minimum) If spam is a problem for you in 2022, you have a crappy email provider.
    - BeetleB 5y ago
      You didn't understand the point of my comment. If you sign up for something (e.g. by purchasing goods from a legitimate store), those will virtually never be classified as spam. The reality is that it is hard to get off those lists - a lot of them have an "Unsubscribe" link that purports to get you off their list, but do not actually do so. If you have a provider that is classifying them as spam, then you have a crappy provider.

recuter 5y ago

Somebody copy pasta the "so you think you can fix email, this is why your idea won't work" thing. Meanwhile every time this subject comes up (and cascades into side topic posts about how it is hard to self host and mutt vs thunderbird) I'm left wondering why we even need internet mail anymore when there are so many other overlapping communication channels already. You message your normal friends on WhatsApp. You message your nerdy friends on Signal. You message your drug dealer on Telegram. Nobody writes email sized messages anymore just like nobody writes letters anymore. You message your in-laws from an incognito Facebook tab a couple times a year. Sometimes when you want to message no one in particular you shout into the void on Twitter. You communicate with your team by hooking up GPT-3/perl-script to your corporate slack for your first gig and Microsoft Teams for the secret second gig. Just be sure to not send the emojis after work hours. That open source project you like is now increasingly sequestered on some discord instead of a traditional mailing list. What is left for internet mail to do? Seems like it mirrors the real life postal service and has been reduced to mostly junk mail and newsletters you aren't going to get around to reading because you're busy slogging through your RSS feeds (what is dead may never die). Maybe we've been so obsessed with figuring out how to operate our own postal service like in the frontier days we forgot to ask ourselves whether we should want to in the first place. Neither snow nor rain nor heat nor gloom of night stays these couriers from the swift delivery of plain text messages over an open protocol via the public net. For What?

noduerme 5y ago
I write (and receive) a lot of email-sized messages, and email / phone are pretty much the only ways I communicate with clients. Most client emails involve lists of features and questions which we reply to with line-by-line comments (think red/blue, quotes within quotes). To me it's more efficient and less distracting to have all my work comms in a single email thread per project than scattered across different services. I've tried doing this with shared documents and spreadsheets, but found it's a mess, because no one checks and notices when you change them, or scrolls around to find the thing you added or commented on. The issues are complicated and technical enough that chat format, especially thumb-typing, is not helpful. With email, clients usually see and respond quickly so I can get on with work. And there's a consistent paper trail to refer to. If the issue needs a discussion that's too complex for the email chain, or if they don't fully understand the options or limitations I'm describing, I call the client and hash it out, then put the result we agreed on into an email and send it to them.

readingnews 5y ago

You know, I used to love reading DJBs bitch slaps in his replies to people. He was legendary in the way Linus is legendary... "...But I do know that she likes my in your face attitude" -- Bender relaying Leelas remarks on him in Futurama, S1E7. On a non-related note, I used the hell out of Qmail and DJBDNS for years. I sometimes look out into the darkness before I drift off into unconsciousness and wonder why I do not use them today.

dsr_ 5y ago
The architecture of both qmail and djbdns are excellent. However, the lack of a clear maintenance team means that they fracture whenever a new must-have feature comes along. If you need dynamic DNS support, djbdns needs something else to handle it. If you need TLS for your mailserver, qmail needs something to handle it. Greylisting? Something else. If qmail and djbdns had communities the same size as Postfix and Knot, they would be excellent general-purpose choices.

transfire 5y ago

I like it. It would make it much easier to control incoming messages… such as retrieving only the most recent of ads from a retail company. The only other solution I have thought of is to charge for email. Say a few cents per message would go from sender to receiver. That would definitely reduce spam.

rattlesnakedave 5y ago
This was the origin of proof of work.
aidenn0 5y ago
> The only other solution I have thought of is to charge for email. Say a few cents per message would go from sender to receiver. That would definitely reduce spam. Spam would still come from hacked boxes, being charged to the owner of the hacked box.

Jenda_ 5y ago

I don't understand this one: > In IM2000, mailing lists are a purely local matter for the receiver's software. We still need to manage list of users we want to send notifications to, right? ("The message isn't copied to the receiver's ISP. All the receiver needs is a brief notification that a message is available.") Or is it expected there will be no "push" notifications for mailing lists, but I will actively ask about new messages in the list on every inbox refresh? That seems a bit wasteful, especially when this protocol seems to be concerned about efficiency.