Discussion
I was just noting how much I love it, and that I really need to polish up and publish my mail system.
Test mail from myself is literally 12 (11+envelope) headers.
(Envelope) From, Return-Path, a single Received, Date, From, To, Subject, Message-ID, MIME-Version, Content-Type, Content-Disposition, and User-Agent.
Only the first 3 actually come from the transport, and half of the rest are optional stuff the MUA put there.
And the whole thing was end-to-end encrypted.
@alwayscurious @ska Yeah, I'm not particularly interested in the NSA's latest backdoored replacements for crypto so 🤷
@alwayscurious @ska "For something to be a backdoor, you need some way to ensure that nobody else can exploit it, otherwise it is not a backdoor, but a broken algorithm"
This is semantic pedantry. The NSA DGAF about "NOBUS". They are happy just making everyone insecure as long as they can be one of the parties intercepting.
Any attempt to induce churn into crypto algorithms and implementations and displace ones that have stood the test of time protecting trillions of dollars of supposed value with things that have only been used seriously for a short while or not at all is *sabotaging* our security. Whether you want to call it a "backdoor" isn't really important. It's bad.
@lispi314 @lanodan @TheOneDoc No, you're not the owner of the zone unless they delegate it to you. The problem is most ISPs won't delegate or publish records for you in their zones.
@dalias Needs a DKIM signature, if you want to get it delivered properly by the worst mail providers in the world.
(MS, Google, Yahoo, GMX, etc.)
@grumpybozo Nope, I deliver fine to them all. I refuse to use DKIM because email is not supposed to have non-repudiation (verified leaks).
@lanodan @dalias It’s something that only makes sense for volume senders whose reputation is valuable and hence a forgery target. For everyone else it is just the easiest way to avoid a subset of the problems caused by others mis-applying it.
I get why some folks want all of their email authenticated, but aside from that being in conflict with the design of Internet email as Rich noted, DKIM is a shabby tool for authentication.
Mail, and running your own mail, is not hard at all when you're doing it on an individual personal mail scale and not sending spam (or any other kind of bulk/automated mailings you want to pretend aren't spam).
@dalias so is it a myth that you get placed on spam lists immediately if you're not a big player?
I never have. I've been running various mail installations for thirty years, including one I just set up in December. Works fine.
CC: @dalias@hachyderm.io
@dalias I'd like to see it! how you receive mail, and how you send it. This is probably very different from what I consider an MTA should do, and your data point would be valuable.
@ska How I send is with mxclient, but I have a wrapper that backgrounds and retries according to schedule. No crossing of privilege domains; it runs as user. I do want to enhance mxclient to support SOCKS and ssh -W transport.
How I receive is with a tiny program that parses SMTP (including BearSSL for STARTTLS, which is mandatory per DANE) to determine the user to deliver to and pipes the mail contents to the user's configured acceptance program, which can dynamically produce temp or permanent failure (which the sender sees at SMTP time) via exit codes.
There is 100% backpressure everywhere in the system, no queues, no backup MX's, no MITMs. During down time it's the sender's responsibility to keep the mail and retry later.
Your setup is good and not something I can reuse. Bleh.
@dalias biggest proplem is that a bunch of ISPs block ports 25, 465 & 587 TCP so people are forced to get a VPS 😞
