5 ms·

smtp sucks hard though. Pretty much the only major protocol that never got upgraded (along DNS until DNS over https). Dysfunctional encryption (as in optional,

by cm2187 4y ago

smtp sucks hard though. Pretty much the only major protocol that never got upgraded (along DNS until DNS over https). Dysfunctional encryption (as in optional, easily downgradable), no assurance on the identity of the sender, bad interoperability (the likes of gmail sending directly to spam folder half of the domains).

geocrasher 4y ago
This. SMTP was built upon FTP originally, and it's a protocol designed for ARPAnet, not Internet. SMTP is inherently the wrong protocol for the job. But it keeps working and is the gold standard for email communication and is dead simple to implement, so it keeps being used.
ink_13 4y ago
Oh boy, never learn about BGP and you'll be much happier.
- Karrot_Kream 4y ago
  Well at least BGP is basically an old boy's club so adherence to group rules, not any technical controls, keep the system in check.
Beltalowda 4y ago
It's not quite that bad; you can use SMTP over TLS (without the downgradable STARTTLS, plus there's REQUIRETLS now), and there's been plenty of extensions over the years (like SMTPUTF8). Identity verification has been handled in another layer (the message itself); you could argue that's not the best place, but it is there. And gmail's problems are gmail's problems. The entire world still runs on DNS; as an end-user you can now use DNS-over-HTTPS and that's nice, but that's mostly a frontend for DNS, which as a whole hasn't really been "upgraded". Upgrading SMTP to something new would require upgrading all the world's email servers, otherwise mail.server1.com can't communicate with mail.server2.com. This will probably happen at the same speed as IPv6.
- Karrot_Kream 4y ago
  Assuming you mean identity verification is handled with GPG keys, nobody actually uses that in practice. Even the people that use Usenet today mostly don't. Email identity is handled de facto by a web of trust anchored by the big domains with no possibility of creating a new trust anchor. You're either managed by Google, Microsoft, or Apple and inherit their trust or you play endless games to not get your mails blocked by default. It's a sad world and didn't need to be this way, but there's no real urge to fix things because the only people who are clamoring to fix email are people who want to encourage folks to use niche experiences like mutt and PRs by mail while the incumbents like Google have no incentive to adopt decentralized trust.
  - Beltalowda 4y ago
    Mostly meant SPF/DKIM to verify the sender is authorized to send emails for a particular domain. Verifying that "it is actually the person Karrot_Kream who wrote that email" is harder; but I don't think you can blame that on the SMTP protocol.
- cm2187 4y ago
  If you create a smtpv2 that can guarantee encryption (ok, who cares) but mostly that guarantees the origin of the email, then the gmails of this world should go softer on classifying those emails as spam, and it won’t take long before only spammers and some forgotten box in a closet are using the old smtp, then its death would be imminent.
  - Beltalowda 4y ago
    What do you mean "guarantees the origin of the email" though? That it was you who sent it? That you're allowed to send emails from mymail@example.com? The latter has been solved for some time; the first one is harder, but solvable through GPG or S/MIME, but few seems to have any interest in implementing it. That won't stop anyone from creating a new email address (or mail server) that sends out spam though.
- notabee 4y ago
account42 4y ago
> Dysfunctional encryption (as in optional, easily downgradable) Better than the HTTP mess where all URLs had to change until people realized that that didn't solve it anyway and had to bolt on HSTS and HSTS preload lists - we just need to add those for SMTP and optional encryption is no longer an issue.

by cm2187 4y ago

geocrasher 4y ago

This. SMTP was built upon FTP originally, and it's a protocol designed for ARPAnet, not Internet. SMTP is inherently the wrong protocol for the job. But it keeps working and is the gold standard for email communication and is dead simple to implement, so it keeps being used.

ink_13 4y ago

Oh boy, never learn about BGP and you'll be much happier.

Karrot_Kream 4y ago
Well at least BGP is basically an old boy's club so adherence to group rules, not any technical controls, keep the system in check.

Beltalowda 4y ago

It's not quite that bad; you can use SMTP over TLS (without the downgradable STARTTLS, plus there's REQUIRETLS now), and there's been plenty of extensions over the years (like SMTPUTF8). Identity verification has been handled in another layer (the message itself); you could argue that's not the best place, but it is there. And gmail's problems are gmail's problems. The entire world still runs on DNS; as an end-user you can now use DNS-over-HTTPS and that's nice, but that's mostly a frontend for DNS, which as a whole hasn't really been "upgraded". Upgrading SMTP to something new would require upgrading all the world's email servers, otherwise mail.server1.com can't communicate with mail.server2.com. This will probably happen at the same speed as IPv6.

Karrot_Kream 4y ago
Assuming you mean identity verification is handled with GPG keys, nobody actually uses that in practice. Even the people that use Usenet today mostly don't. Email identity is handled de facto by a web of trust anchored by the big domains with no possibility of creating a new trust anchor. You're either managed by Google, Microsoft, or Apple and inherit their trust or you play endless games to not get your mails blocked by default. It's a sad world and didn't need to be this way, but there's no real urge to fix things because the only people who are clamoring to fix email are people who want to encourage folks to use niche experiences like mutt and PRs by mail while the incumbents like Google have no incentive to adopt decentralized trust.
- Beltalowda 4y ago
  Mostly meant SPF/DKIM to verify the sender is authorized to send emails for a particular domain. Verifying that "it is actually the person Karrot_Kream who wrote that email" is harder; but I don't think you can blame that on the SMTP protocol.
cm2187 4y ago
If you create a smtpv2 that can guarantee encryption (ok, who cares) but mostly that guarantees the origin of the email, then the gmails of this world should go softer on classifying those emails as spam, and it won’t take long before only spammers and some forgotten box in a closet are using the old smtp, then its death would be imminent.
- Beltalowda 4y ago
  What do you mean "guarantees the origin of the email" though? That it was you who sent it? That you're allowed to send emails from mymail@example.com? The latter has been solved for some time; the first one is harder, but solvable through GPG or S/MIME, but few seems to have any interest in implementing it. That won't stop anyone from creating a new email address (or mail server) that sends out spam though.
notabee 4y ago

account42 4y ago

> Dysfunctional encryption (as in optional, easily downgradable) Better than the HTTP mess where all URLs had to change until people realized that that didn't solve it anyway and had to bolt on HSTS and HSTS preload lists - we just need to add those for SMTP and optional encryption is no longer an issue.