Hacker News Reader

Comment by SteveNuts | Hacker News Reader

I recently had the pleasure of migrating a legacy server 2008 app to a brand new server 2022 box. One of the requirements is a local smtp server for sending mail so I looked up how to do this in windows.

To my shock and horror, smtp service has been deprecated since server 2012, you can still install it but it comes with an extremely old version of IIS as a dependency and it’s broken out of the box.

To get it working you have to dig into some xml files and add parameters.

I really wonder how anyone can take a server OS seriously that doesn’t have out of the box first class functionality for smtp, one of the most ubiquitous protocols on the internet.

View on HN

why the hell do you think that Microsoft would want you to use your basic SMTP server when they want you to use an exchange server? Of course they deprecated that. If you’re using windows then use their ecosystem.

why do you need a smtp server developed by microsoft? isn't windows compatible with a multitude of open source smtp servers?

You don’t, but why ship broken features at all?

If I can install something from the OS it shouldn’t come broken and insecure.

It just feels like such a strange platform to build a server on to me.

I’m as disappointed with Windows as anyone, but didn’t you just write it was deprecated?

Email use itself is waning and has never had privacy as a guaranteed feature.

They shipped it marked as deprecated to support people already using it, but to discourage new use. You can't really complain after ignoring that warning.

There's no indication it's deprecated, it'll let you install it in its broken state with no warning.

> There's no indication it's deprecated

The "Features Removed or Deprecated in Windows Server 2012" page has mentioned SMTP since the OS was still called "Windows 8 server": https://web.archive.org/web/20120517025232/http://technet.mi...

I suppose you could've missed this if you moved directly from WS2008 to WS2022, but I don't know any OS that publishes "things we have removed or deprecated in the last three versions", it's usually just "what changed from the previous version to the current one".

hmailserver is the replacement you want for this.

This is the way I ended up going and it worked great.

It is no longer under development.

That happens when you finish your roadmap and call it done. It’s frustrating that the modern sense of it became automatically negative.

This is an actual claim if someone is interested: https://www.hmailserver.com/state

On SHA-1: https://en.wikipedia.org/wiki/SHA-1

As of 2020, chosen-prefix attacks against SHA-1 are practical.[6][8] As such, it is recommended to remove SHA-1 from products as soon as possible and instead use SHA-2 or SHA-3. Replacing SHA-1 is urgent where it is used for digital signatures.

Digging further: https://www.hmailserver.com/forum/viewtopic.php?t=40568

Tl;dr: it uses sha256 by default and only has sha1 for backwards compatibility, which is considered insecure today. Critical updates are still there.

hmailserver needs openssl version bumps from time to time.

Reply on news.ycombinator.com