3 ms·

Pretty cool. This shows part of the downside of consolidating email into a handful of massive providers.

abound 3y ago
> This shows part of the downside of consolidating email into a handful of massive providers. Kinda yes, kinda no. It seems the more relevant quantity is the software that is running (e.g. Cisco, Postfix, etc), rather than who hosts it. Even in a world where email was far more decentralized, this would still be a problem, perhaps even more so as there'd be a much longer tail for mail systems to be updated.
- donmcronald 3y ago
  There’d be less domains to spoof per server with SPF spread across more IPs. However you’re right about the long tail and since the best value is likely internal spoofing (ie: ceo scam), there’s upside to the huge providers just dealing with it for everyone.
  - stuartjohnson12 3y ago
    Yeah, if you're worried about standards consistency and exploiting differences in implementation, you're best off in a high-consolidation environment.
    - denton-scratch 3y ago
      And if you're worried about a single implementation defect impacting large numbers of users, you're best in a low-consolidation environment.
LeonM 3y ago
> This shows part of the downside of consolidating email into a handful of massive providers. I don't agree. The great thing about consolidating email services is that a fix for a vulnerability will typically be rolled out quickly, thus protecting the vast majority of email users from this particular attack. Whereas with self-hosted/on-premise SMTP services we'd be chasing this for years and years. There are so many ancient, unmanaged and otherwise badly configured SMTP servers out there... The difference here is that for the engineers that work for the large email service providers, it is their full-time responsibility to deliver email service. Whereas for the self-hosted solution, it is often a burden to the IT admin who doesn't get time/budget or have the knowledge to tend to the SMTP service. SMTP is often viewed as a set-and-forget type of thing, that can be set up in less than an hour, but it definitely is not. I'm all for open-source, self-hosting and keeping control over your own resources, but for email (other than your private email address maybe) just outsource that to one of the well-known providers and focus on your actual job.

> This shows part of the downside of consolidating email into a handful of massive providers. Kinda yes, kinda no. It seems the more relevant quantity is the software that is running (e.g. Cisco, Postfix, etc), rather than who hosts it. Even in a world where email was far more decentralized, this would still be a problem, perhaps even more so as there'd be a much longer tail for mail systems to be updated.

donmcronald 3y ago
There’d be less domains to spoof per server with SPF spread across more IPs. However you’re right about the long tail and since the best value is likely internal spoofing (ie: ceo scam), there’s upside to the huge providers just dealing with it for everyone.
- stuartjohnson12 3y ago
  Yeah, if you're worried about standards consistency and exploiting differences in implementation, you're best off in a high-consolidation environment.
  - denton-scratch 3y ago
    And if you're worried about a single implementation defect impacting large numbers of users, you're best in a low-consolidation environment.

LeonM 3y ago

> This shows part of the downside of consolidating email into a handful of massive providers. I don't agree. The great thing about consolidating email services is that a fix for a vulnerability will typically be rolled out quickly, thus protecting the vast majority of email users from this particular attack. Whereas with self-hosted/on-premise SMTP services we'd be chasing this for years and years. There are so many ancient, unmanaged and otherwise badly configured SMTP servers out there... The difference here is that for the engineers that work for the large email service providers, it is their full-time responsibility to deliver email service. Whereas for the self-hosted solution, it is often a burden to the IT admin who doesn't get time/budget or have the knowledge to tend to the SMTP service. SMTP is often viewed as a set-and-forget type of thing, that can be set up in less than an hour, but it definitely is not. I'm all for open-source, self-hosting and keeping control over your own resources, but for email (other than your private email address maybe) just outsource that to one of the well-known providers and focus on your actual job.