5 ms·

If you don't host your own mail server, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

by rsync 14y ago

dsplittgerber 14y ago
How can I, as a somewhat proficient non-techie, accomplish that without having to dedicate a 24/7 *nix box from home? Please, if anyone knows a simple, yet elegant solution, I'm all ears.
- Xylakant 14y ago
  you can use encrypted mail, however that requires you to convince all people that you exchange mails with to use encrypted mail as well. You could use a hosted email service in another country where the american authorities don't have easy access. Europe might be an option. However, as with hosting your own email server, that's only a partial solution: If you communicate with other people, your mail is not only stored in your inbox but also in their outbox. So they'd have to use a mail provider outside the US as well - see the first paragraph. The best is probably a hybrid solution: Try to educate as many people to use encrypted mail as you can and use a mail server that's located outside the US. It doesn't provide 100% protection, but at least you're not part of the dragnet search.
  - olefoo 14y ago
    Errr... the NSA is specifically charged with monitoring communications that cross US national borders. Using a mailserver in a foreign jurisdiction makes it more open to legal interception by the US government; not less.
    - Xylakant 14y ago
      Valid point. It's a different branch and a different issue though. Mails that are already on your server and stored there would be relatively safe. Make sure communication is encrypted.
- ams6110 14y ago
  You could use a local email program and set it to download then purge your mail from the server. That way it's not in their possession for more than 180 days. But you are then responsible for your own backups etc.
  - derwiki 14y ago
    ... assuming that when you delete it, they delete it -- which I wouldn't assume.
- ghayes 14y ago
  An alternative to postfix: To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also, you would likely need to setup a POP server to download your messages from the server. [1] https://github.com/baudehlo/Haraka https://github.com/baudehlo/Haraka
  - ldh 14y ago
    I don't think that addresses the issue of needing a dedicated box to store your email; i.e. you still need that POP server.
  - kawsper 14y ago
    Wouldn't they be able to access cloud systems such as AWS, Linode or Heroku as long as it hosts e-mail systems?
    - antidoh 14y ago
      That's going to be an interesting question. If you host on linode or google apps or pair.com, is that a server under your control, or a third party. I would call it a server under your control, the same as a store in a strip mall is under your control, not the mall owner. But which way does anyone think that's going to go? Not the right way is my assumption. However, if all your data is encrypted once it rests on the box, you'll at least know you're being probed when they subpoena your keys.
- nwh 14y ago
  I've been researching doing this for a while, but there's one big caveat that I can't get past- there's no decent server solutions for push mail. For desktop computers there's IMAP IDLE, but all the push solutions Apple's software uses are based on Microsoft Exchange (expensive). I'm all ears too.
  - corford 14y ago
    Zarafa works wonderfully and is a snap to setup. Edit: Here are the docs for the latest 7.1 branch: http://doc.zarafa.com/7.1/ http://doc.zarafa.com/7.1/ And here is the link to the community (open source) section of their site: http://community.zarafa.com/ http://community.zarafa.com/
    - nwh 14y ago
      I keep hearing the name. I'm going to chuck it onto a VM and try it out.
      - corford 14y ago
        I'm running it on two small sites (< 50 users each) and it works as advertised. The nice thing is, it isn't monolithic - you choose the MTA and web software (in my case postfix and apache) and it uses mysql as the backend. The webmail interface is the best opensource one I've come across (easily beats redcube) and active sync works fine with iphone 4/5 and android.
        corford 14y ago
        lol freudian slip! Redcube should have read Roundcube :D
ams6110 14y ago
Nonsense. Setting up a properly configured and secured mail server, and keeping it that way, takes time and is not a core value proposition for most of us. It makes complete sense to want to outsorce something like that.
- Xylakant 14y ago
  And it doesn't protect any mail you wrote or received that's still in the recipients inbox or the senders "sent mail" folder. So it's a complete waste of time for that purpose.
  - uxp 14y ago
    Yep. It's exactly the same problem using any kind of privacy encryption: If both parties don't use it, it's useless.
    - rsync 14y ago
      I stand by my original assertion.
      - olefoo 14y ago
        Which contributes neither enlightening discussion nor useful solutions to the discussion at hand. You have expressed your contempt for people who don't run their own mailservers; but your contempt is only an ego assertion. Your contempt, unless based on facts, and rational arguments taking into account the reality of people who have other things to do than learn whatever esoteric skills you've chosen to base your self-worth around; is of no interest to the rest of the people reading HN. I run my own mailserver; therefore you should listen to me. if the above statement seems ridiculous (which it is), it is merely the mirror of your original assertion.
        rsync 14y ago
        Running your own mailserver is so basic of a technical skill that it is neither esoteric, nor is it something to be egotistical about. The name of the site is "hacker news" for Gods sake. Second, there's nothing I'm asking you to "listen to". My point was that a lot of the wringing of hands and gnashing of teeth has no legitimacy without having taken the simplest, most elementary, first order step towards fixing this problem. Come back and complain about your bad roast after you've actually ... you know ... turned your oven on.
raganwald 14y ago
If you don't host your own mail server, you are a clown-person Where can I get a pair of size 47 shoes, a banana-yellow suit, and a lime-green wig? I am a programmer, not an IT administrator. I know nothing about which patches are required to keep a server secure, nor should Ihave to. Being familiar with the technology for making programs has the same relationship to maintaing a publicly facing server as being familiar with the technology for making buildings has with operating a property-management, real-estate leasing, and property security firm all in one. It's great that you and many others have these skills, it's not a dichotomy, but they are loosely related.
hippich 14y ago
While this might prevent government to look into archive of yours emails, this will not completely prevent monitoring. As long as email will leave from server within USA it can be tracked since most emails are transmitted in clear text. Solution is to use GPG or similar tool to encrypt email content, but you need both parties to use it which is not so easy.
toofishes 14y ago
If you don't run your own post office, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.
- pjbrunet 14y ago
  I really LOL ;-) Yes, Google-Yahoo-MSN, they have the best spam filters because they receive more spam than anyone--that allows them to identify it faster and more accurately. I doubt SpamAssassin will ever match them. Wasn't very effective for me, false-positives are the worst. And seems to me a mail server is just another open door for hackers and spammers to walk in and use your memory and CPU 99.99% of the day. So call me a clown-person. Like someone already said, mail servers are cryptic, complex and unwieldy and I think that's been true since at least the 90s. Not to mention, webmail is really convenient and fast and reliable. Last time I used an email client was the time I had to download 200 worms from POP before I could see my real email.
cookiecaper 14y ago
Mail servers are ridiculous PITAs. If it was something simple like installing Apache, you may be right, but it seems every mail server uses its own esoteric configuration conventions and requires a lot of legwork even to get a basically functional mail system together (Postfix+Dovecot+SpamAssassin+ClamAV), that you get for free with Gmail. And unless you host the server in your residence (disallowed on most residential ISPs), you're still not going to have control over whether someone has a warrant or not when they look at your mail. The answer is "encrypt all messages". Every other day I could comment on a post to which the answer is "encrypt [thing]". PGP is so important and yet it's nearly impossible to get anyone to use it.

If you don't host your own mail server, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

by rsync 14y ago

If you don't host your own mail server, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

How can I, as a somewhat proficient non-techie, accomplish that without having to dedicate a 24/7 *nix box from home? Please, if anyone knows a simple, yet elegant solution, I'm all ears.

Xylakant 14y ago
you can use encrypted mail, however that requires you to convince all people that you exchange mails with to use encrypted mail as well. You could use a hosted email service in another country where the american authorities don't have easy access. Europe might be an option. However, as with hosting your own email server, that's only a partial solution: If you communicate with other people, your mail is not only stored in your inbox but also in their outbox. So they'd have to use a mail provider outside the US as well - see the first paragraph. The best is probably a hybrid solution: Try to educate as many people to use encrypted mail as you can and use a mail server that's located outside the US. It doesn't provide 100% protection, but at least you're not part of the dragnet search.
- olefoo 14y ago
  Errr... the NSA is specifically charged with monitoring communications that cross US national borders. Using a mailserver in a foreign jurisdiction makes it more open to legal interception by the US government; not less.
  - Xylakant 14y ago
    Valid point. It's a different branch and a different issue though. Mails that are already on your server and stored there would be relatively safe. Make sure communication is encrypted.
ams6110 14y ago
You could use a local email program and set it to download then purge your mail from the server. That way it's not in their possession for more than 180 days. But you are then responsible for your own backups etc.
- derwiki 14y ago
  ... assuming that when you delete it, they delete it -- which I wouldn't assume.
ghayes 14y ago
An alternative to postfix: To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also, you would likely need to setup a POP server to download your messages from the server. [1] https://github.com/baudehlo/Haraka https://github.com/baudehlo/Haraka
- ldh 14y ago
  I don't think that addresses the issue of needing a dedicated box to store your email; i.e. you still need that POP server.
- kawsper 14y ago
  Wouldn't they be able to access cloud systems such as AWS, Linode or Heroku as long as it hosts e-mail systems?
  - antidoh 14y ago
    That's going to be an interesting question. If you host on linode or google apps or pair.com, is that a server under your control, or a third party. I would call it a server under your control, the same as a store in a strip mall is under your control, not the mall owner. But which way does anyone think that's going to go? Not the right way is my assumption. However, if all your data is encrypted once it rests on the box, you'll at least know you're being probed when they subpoena your keys.
nwh 14y ago
I've been researching doing this for a while, but there's one big caveat that I can't get past- there's no decent server solutions for push mail. For desktop computers there's IMAP IDLE, but all the push solutions Apple's software uses are based on Microsoft Exchange (expensive). I'm all ears too.
- corford 14y ago
  Zarafa works wonderfully and is a snap to setup. Edit: Here are the docs for the latest 7.1 branch: http://doc.zarafa.com/7.1/ http://doc.zarafa.com/7.1/ And here is the link to the community (open source) section of their site: http://community.zarafa.com/ http://community.zarafa.com/
  - nwh 14y ago
    I keep hearing the name. I'm going to chuck it onto a VM and try it out.
    - corford 14y ago
      I'm running it on two small sites (< 50 users each) and it works as advertised. The nice thing is, it isn't monolithic - you choose the MTA and web software (in my case postfix and apache) and it uses mysql as the backend. The webmail interface is the best opensource one I've come across (easily beats redcube) and active sync works fine with iphone 4/5 and android.
      - corford 14y ago
        lol freudian slip! Redcube should have read Roundcube :D

ams6110 14y ago

Nonsense. Setting up a properly configured and secured mail server, and keeping it that way, takes time and is not a core value proposition for most of us. It makes complete sense to want to outsorce something like that.

Xylakant 14y ago
And it doesn't protect any mail you wrote or received that's still in the recipients inbox or the senders "sent mail" folder. So it's a complete waste of time for that purpose.
- uxp 14y ago
  Yep. It's exactly the same problem using any kind of privacy encryption: If both parties don't use it, it's useless.
  - rsync 14y ago
    I stand by my original assertion.
    - olefoo 14y ago
      Which contributes neither enlightening discussion nor useful solutions to the discussion at hand. You have expressed your contempt for people who don't run their own mailservers; but your contempt is only an ego assertion. Your contempt, unless based on facts, and rational arguments taking into account the reality of people who have other things to do than learn whatever esoteric skills you've chosen to base your self-worth around; is of no interest to the rest of the people reading HN. I run my own mailserver; therefore you should listen to me. if the above statement seems ridiculous (which it is), it is merely the mirror of your original assertion.
      - rsync 14y ago
        Running your own mailserver is so basic of a technical skill that it is neither esoteric, nor is it something to be egotistical about. The name of the site is "hacker news" for Gods sake. Second, there's nothing I'm asking you to "listen to". My point was that a lot of the wringing of hands and gnashing of teeth has no legitimacy without having taken the simplest, most elementary, first order step towards fixing this problem. Come back and complain about your bad roast after you've actually ... you know ... turned your oven on.

raganwald 14y ago

If you don't host your own mail server, you are a clown-person Where can I get a pair of size 47 shoes, a banana-yellow suit, and a lime-green wig? I am a programmer, not an IT administrator. I know nothing about which patches are required to keep a server secure, nor should Ihave to. Being familiar with the technology for making programs has the same relationship to maintaing a publicly facing server as being familiar with the technology for making buildings has with operating a property-management, real-estate leasing, and property security firm all in one. It's great that you and many others have these skills, it's not a dichotomy, but they are loosely related.

hippich 14y ago

While this might prevent government to look into archive of yours emails, this will not completely prevent monitoring. As long as email will leave from server within USA it can be tracked since most emails are transmitted in clear text. Solution is to use GPG or similar tool to encrypt email content, but you need both parties to use it which is not so easy.

toofishes 14y ago

If you don't run your own post office, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

pjbrunet 14y ago
I really LOL ;-) Yes, Google-Yahoo-MSN, they have the best spam filters because they receive more spam than anyone--that allows them to identify it faster and more accurately. I doubt SpamAssassin will ever match them. Wasn't very effective for me, false-positives are the worst. And seems to me a mail server is just another open door for hackers and spammers to walk in and use your memory and CPU 99.99% of the day. So call me a clown-person. Like someone already said, mail servers are cryptic, complex and unwieldy and I think that's been true since at least the 90s. Not to mention, webmail is really convenient and fast and reliable. Last time I used an email client was the time I had to download 200 worms from POP before I could see my real email.

cookiecaper 14y ago

Mail servers are ridiculous PITAs. If it was something simple like installing Apache, you may be right, but it seems every mail server uses its own esoteric configuration conventions and requires a lot of legwork even to get a basically functional mail system together (Postfix+Dovecot+SpamAssassin+ClamAV), that you get for free with Gmail. And unless you host the server in your residence (disallowed on most residential ISPs), you're still not going to have control over whether someone has a warrant or not when they look at your mail. The answer is "encrypt all messages". Every other day I could comment on a post to which the answer is "encrypt [thing]". PGP is so important and yet it's nearly impossible to get anyone to use it.