35 ms·

goal: "Not make a totally unhackable, NSA-proof server." who in their right mind would say something like this?

tetrisgm 3y ago
Someone who understands they can't make a small email server project that can resist a state-scale adversary,and won't bother with people arguing for that level of privacy.
NBJack 3y ago
Somebody being honest? Would you prefer they lie and say the opposite? Or just let the target audience assume otherwise? Most folks I've seen do this put such a statement (in the postive) under "non-goals".
- llamaInSouth 3y ago
  everyone already knows this though.... Ive never seen any software with zero bugs... maybe he is trying to bring awareness to the fact that programmers suck
  - mcosta 3y ago
    I guess this kind of projects attracts some paranoid "nsa is spying me" kind.
    - llamaInSouth 3y ago
      so whats your point? are you talking about me? I know the us gov. is spying on me, but I also know that they dont care because there is nothing interesting once in a while I send them dick pics
ajosh 3y ago
If my memory serves the project started around the time of a popular blog post called NSA-Proof Your E-mail[1]. It may have been Josh's inspiration for the project, I'm not sure. In any event, the techniques described are pretty standard mail hosting and so MAIB's techniques are pretty much the same. I think it's just saying that while it does improve some things, it's not going to be what that blog post promised. [1] https://medium.com/@cyberpunk_networks/nsa-proof-your-email-2017-edition-f11a89697722 https://medium.com/@cyberpunk_networks/nsa-proof-your-email-...
johnklos 3y ago
Any reasonable person might. It's more secure, generally, than Google, or Microsoft, or Yahoo, if you know what you're doing, for all of not having the possibility of getting locked out of your own email for no discernible reason and with no real recourse, for not allowing intrusion through other mechanisms of their massive infrastructure, or for not allowing access to your email at rest. Also, many large cloud providers still have issues where one customer can masquerade as another. They don't learn. Since there's no way to ever know with any certainty whether employees at any large provider is looking at your email (we already know they're scanning it), then you can never have any certainty at all about how private it is. If you set up an email server that uses SSL / TLS for SMTP delivery and reception, then you'll have logs showing whether email you sent or received communicated with the sender's / recipient's email server directly, using encryption, without anyone in the middle being able to intercept. We can't control the fact that if the NSA really wanted, they could likely make a certificate for any domain that appears legitimate to our servers and do a MITM. Therefore, while I'd assert that my servers are much, much more secure than Google's, I'd never be so naive to say it's "NSA-proof" because of limitations of the Internet that don't necessarily apply to the NSA.

Someone who understands they can't make a small email server project that can resist a state-scale adversary,and won't bother with people arguing for that level of privacy.

NBJack 3y ago

Somebody being honest? Would you prefer they lie and say the opposite? Or just let the target audience assume otherwise? Most folks I've seen do this put such a statement (in the postive) under "non-goals".

llamaInSouth 3y ago
everyone already knows this though.... Ive never seen any software with zero bugs... maybe he is trying to bring awareness to the fact that programmers suck
- mcosta 3y ago
  I guess this kind of projects attracts some paranoid "nsa is spying me" kind.
  - llamaInSouth 3y ago
    so whats your point? are you talking about me? I know the us gov. is spying on me, but I also know that they dont care because there is nothing interesting once in a while I send them dick pics

ajosh 3y ago

If my memory serves the project started around the time of a popular blog post called NSA-Proof Your E-mail[1]. It may have been Josh's inspiration for the project, I'm not sure. In any event, the techniques described are pretty standard mail hosting and so MAIB's techniques are pretty much the same. I think it's just saying that while it does improve some things, it's not going to be what that blog post promised. [1] https://medium.com/@cyberpunk_networks/nsa-proof-your-email-2017-edition-f11a89697722 https://medium.com/@cyberpunk_networks/nsa-proof-your-email-...

johnklos 3y ago

Any reasonable person might. It's more secure, generally, than Google, or Microsoft, or Yahoo, if you know what you're doing, for all of not having the possibility of getting locked out of your own email for no discernible reason and with no real recourse, for not allowing intrusion through other mechanisms of their massive infrastructure, or for not allowing access to your email at rest. Also, many large cloud providers still have issues where one customer can masquerade as another. They don't learn. Since there's no way to ever know with any certainty whether employees at any large provider is looking at your email (we already know they're scanning it), then you can never have any certainty at all about how private it is. If you set up an email server that uses SSL / TLS for SMTP delivery and reception, then you'll have logs showing whether email you sent or received communicated with the sender's / recipient's email server directly, using encryption, without anyone in the middle being able to intercept. We can't control the fact that if the NSA really wanted, they could likely make a certificate for any domain that appears legitimate to our servers and do a MITM. Therefore, while I'd assert that my servers are much, much more secure than Google's, I'd never be so naive to say it's "NSA-proof" because of limitations of the Internet that don't necessarily apply to the NSA.