Hacker News Reader

> Not only is it trivially easy to host your own email

Perhaps for you, but average Joe does not know, nor care how to do this. I've worked with "technical people" who couldn't figure out how to use PGP to encrypt emails, imagine trying to explain to random people what a VPN is.

As long as signing up with gmail stays easier than hosting your own email, nobody will ever bother - and this is the danger schneier is talking about.

Maybe it's trivially easy to host your own e-mail, but isn't it pretty hard to convince other servers to accept e-mail originating from your host? I haven't been following things closely, but I remember reading about stuff like DKIM and SPF and I seem to recall that you need a static IP for some of the stuff involved. All in all, sounds like a non-trivial hassle and non-trivial cost.

On that note, is there a down-to-earth guide to setting up your own e-mail host?

You need a static IP, yes, but any VPS will get you one, so that can hardly be an issue. In seven years of hosting my own email I never had issues with delivering mail to other providers.

Setting up an SMTP daemon and IMAP/POP3 server is rather easy, the most difficult decision being which SMTPd to choose (I like Postfix, but Exim is Debian’s default and hence supposedly good as well, others like Courier) and then reading the relevant manpages :)

If you search for, e.g., "Postfix tutorial", you'll find plenty of reasonably good guides.

I don't understand why email hosting has to be so difficult. You say it is easy, which it is if you know what you are doing, but it is not really that simple, is it? There is no out of the box solution that just works, even the microsoft effort called exchange is not that. You should be able to configure a mail server with the ease that you can configure a mail client.

Spam is the reason. Mail servers are easy to set up, it's all the crap you need to do to actually get your mail accepted that's hard.

In 16 years of running my own mail server(s) I have never done anything to "get my mail accepted", other than make sure relaying is turned off, which I think it is by default in just about every implementation since 1998.

Consider yourself lucky. I made the mistake of not setting up my email with OpenDKIM and virtually all of my mail went to spam for a few months.

> You need a static IP, yes, but any VPS will get you one, so that can hardly be an issue.

At which point all your data is up for grabs by your VPS provider?

I host my own mail (for values of "my own" where mail server is hosted on a vps on a foreign server), but I think it's a stretch to say it's trivial to do so.

I think one of the most serious problems the Internet is facing is the growing split between "servers and hosts" and "consumers and clients" -- and the asymmetric bandwidth (both adsl and cable). It favours designs that are centralized, not because of sound architectural reasons -- but because of inferior infrastructure.

Setting up an email server, which at least comes close to the gmail's quality is definitely not to be qualified as "easy" process. Going through this several times, I can assure you spending good several days and nights to investigate, choose, configure, debug, and enable useful features like greylisting.

Then again, you have to worry about redudancy. How would you feel missing an important email, due to your VPS/Dedicated server being currently ddos'ed or unreachable for other reasons.

In addition, do not forget about backing up.

So, that again is in no way "easy 1 hour" task, especially for those who are doing it first time.

> That's not a given.

I think it's safe to say he was referring to the 99.99% of internet users for which his statement is true. Sure, he's generalizing a tiny bit, but it's basically true.

The biggest reason for having Gmail is that it is backed up and accessible anywhere. But this is easily replicated in local caches:

You can make it accessible anywhere with a smart phone. You can back up by encrypting the data with a public key and sending to a drop box type service; with the private key stored offline. Most web apps could be easily replicated by storing the data in an append only structure with timestamps. The internet then just becomes a messaging system.

I think the VPN tunnel approach should be pushed by everyone. Lots of companies could secure most of their communication by creating a few tunnels to key clients. Email would be immediately secure without any PKI.

> In 2013 the Internet traffic I actually do generate is much more secure than the Internet traffic I generated 20 years ago.

For someone to be successful in 1993 to use the Internet, you had to be knowledgable enough to do the things you're talking about. I'd wager roughly 97%+ of the population is not smart enough, which is why Bruce's statements are in effect true.

It may be trivially easy to host your own email, but in my experience it is nowhere as easy to do your own spam filtering.

A few years ago when I ran my own mail server, having only one false negative was a good day. Google can throw teams of people at the problem.

Serious question: is there any point until everyone encrypts their email?

Yes, I think so - especially for intercompany email and your family.

It may interest you to know that not one piece of intercompany email at rsync.net has ever traversed any network. It's all just a local copy operation.[1] So, no encryption, but ... that's not relevant in this case.

The same could be true for your family, or small social circles that share an email server. If you use a secure mail client to connect to the server, and all mail on that domain doesn't traverse a network ... that's a win, even without "email encryption".