4 ms·

> Given Fastmail is an Australian company focused on privacy, I was somewhat surprised by their servers being hosted in New Jersey and Washington and nowhere el

by yosito 3y ago

> Given Fastmail is an Australian company focused on privacy, I was somewhat surprised by their servers being hosted in New Jersey and Washington and nowhere else. I find that a bit surprising as well. Though my threat model doesn't currently account for state actors, if it did, this would be concerning.

regularjack 3y ago
Probably a big chunk of Fastmail's customers are in North America, so they probably host there for lower latency.
PrimeMcFly 3y ago
The Australian government is hostile towards privacy IMO. I wouldn't trust a privacy focused company based in Australia.
- Ekaros 3y ago
  EU seems to be only one trying at least something... And even the governments get their dirty hands on things.
  - lmm 3y ago
    South Korea has a pretty strong privacy law, although their government tends to have a lot of authority.
  - suddenclarity 3y ago
    EU is currently working hard on implementing Chat Control 2.0 with the purpose of monitoring all private communication.
- BLKNSLVR 3y ago
  I can vouch for the fact that Australian law enforcement view the usage of privacy software as suspicious internet activity.
phpisthebest 3y ago
if state actors where your threat model you should not be using email in the first place for communication, and if you do at minimum you should be using encryption inside the communication not relaying on a 3rd party to protect your messages. Further if you are a US Citizen talking with Other US Citizens, then having your data in the US is the best place for it... Putting it outside the US automatically eliminates any of the paper thin constitutional concerns the state actors would have to pretend to care about... If your email in a 5 eyes nation then it makes their job even easier.
robin_reala 3y ago
I specifically didn’t pick Fastmail because of their US-only setup. Luckily there are a bunch of other non-five-eyes providers available.
brongondwana 3y ago
We're there because it's where we've found reliable enough remote hands and network. And yes, the thread model of "the USA goes off the internet" is bad enough that we figure things are much worse than us being much use at that point. And regarding the privacy risk, we haven't seen a credible threat that would have our servers accessed directly by US law enforcement that isn't just as credible anywhere else in the world. It hasn't happened, we don't believe it will happen. So yeah, we disappear in an interesting little thought experiment like this one (despite having Australian-owned IP space, it's advertised and routed into our US locations, so fair enough it's blocked in this case) I do think the timing is ripe for us to look at having more datacenters around the world again. We have had both Iceland and Amsterdam locations in the past, and neither were reliable enough to put production traffic to, multiple hour network outages and inability to contact support and get them fixed - but maybe the landscape has changed enough that it's viable again now.
- ishanjain28 3y ago
  I hope fastmail puts some servers in Eastern Europe or South east asia. Fastmail's clients are mostly online only and dont cache much information. It takes ~5-10 seconds to go from clicking on a notification to actually being able to read anything. It's really not a good experience.
  - brongondwana 3y ago
    Yeah, that is pretty painful - how does it compare to other sites in the USA? I'd be interested in seeing a traceroute. JMAP is designed to be pretty good in that situation (we're in Australia and ~280ms away from our primary datacenter) with minimal round-trips.
    - ishanjain28 3y ago
      Hey, here is traceroute/mtr of a few addresses from India to USA. https://paste.debian.net/plain/1282885 https://paste.debian.net/plain/1282885 (Zoom out a bit to see it properly) I also created a few measurements on RIPE Atlas. Ping from all probes in India to api.fastmail.com: https://atlas.ripe.net/measurements/55469007/ https://atlas.ripe.net/measurements/55469007/ Traceroute from all probes in India to api.fastmail.com: https://atlas.ripe.net/measurements/55469042/ https://atlas.ripe.net/measurements/55469042/

by yosito 3y ago

regularjack 3y ago

Probably a big chunk of Fastmail's customers are in North America, so they probably host there for lower latency.

PrimeMcFly 3y ago

The Australian government is hostile towards privacy IMO. I wouldn't trust a privacy focused company based in Australia.

Ekaros 3y ago
EU seems to be only one trying at least something... And even the governments get their dirty hands on things.
- lmm 3y ago
  South Korea has a pretty strong privacy law, although their government tends to have a lot of authority.
- suddenclarity 3y ago
  EU is currently working hard on implementing Chat Control 2.0 with the purpose of monitoring all private communication.
BLKNSLVR 3y ago
I can vouch for the fact that Australian law enforcement view the usage of privacy software as suspicious internet activity.

phpisthebest 3y ago

if state actors where your threat model you should not be using email in the first place for communication, and if you do at minimum you should be using encryption inside the communication not relaying on a 3rd party to protect your messages. Further if you are a US Citizen talking with Other US Citizens, then having your data in the US is the best place for it... Putting it outside the US automatically eliminates any of the paper thin constitutional concerns the state actors would have to pretend to care about... If your email in a 5 eyes nation then it makes their job even easier.

robin_reala 3y ago

I specifically didn’t pick Fastmail because of their US-only setup. Luckily there are a bunch of other non-five-eyes providers available.

brongondwana 3y ago

We're there because it's where we've found reliable enough remote hands and network. And yes, the thread model of "the USA goes off the internet" is bad enough that we figure things are much worse than us being much use at that point. And regarding the privacy risk, we haven't seen a credible threat that would have our servers accessed directly by US law enforcement that isn't just as credible anywhere else in the world. It hasn't happened, we don't believe it will happen. So yeah, we disappear in an interesting little thought experiment like this one (despite having Australian-owned IP space, it's advertised and routed into our US locations, so fair enough it's blocked in this case) I do think the timing is ripe for us to look at having more datacenters around the world again. We have had both Iceland and Amsterdam locations in the past, and neither were reliable enough to put production traffic to, multiple hour network outages and inability to contact support and get them fixed - but maybe the landscape has changed enough that it's viable again now.

ishanjain28 3y ago
I hope fastmail puts some servers in Eastern Europe or South east asia. Fastmail's clients are mostly online only and dont cache much information. It takes ~5-10 seconds to go from clicking on a notification to actually being able to read anything. It's really not a good experience.
- brongondwana 3y ago
  Yeah, that is pretty painful - how does it compare to other sites in the USA? I'd be interested in seeing a traceroute. JMAP is designed to be pretty good in that situation (we're in Australia and ~280ms away from our primary datacenter) with minimal round-trips.
  - ishanjain28 3y ago
    Hey, here is traceroute/mtr of a few addresses from India to USA. https://paste.debian.net/plain/1282885 https://paste.debian.net/plain/1282885 (Zoom out a bit to see it properly) I also created a few measurements on RIPE Atlas. Ping from all probes in India to api.fastmail.com: https://atlas.ripe.net/measurements/55469007/ https://atlas.ripe.net/measurements/55469007/ Traceroute from all probes in India to api.fastmail.com: https://atlas.ripe.net/measurements/55469042/ https://atlas.ripe.net/measurements/55469042/