Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Your IMAP access might be as good as theirs, but things like your webmail, your spam filtering, and almost certainly your general security will not be as good as they have.[...] > Especially, open source can't compete on features like webmail and performance in things like spam filtering.

If anything roundcube is a better webmail client than many of the mail-provider ones. And that's ignoring all the ads and tracking that these come embedded with, even if you pay for them.

I haven't used gmail-for-organizations but if it's anything like the normal gmail interface then ... I guess some power users will prefer it? But in my experience many people prefer roundcube, because it's simple and usable. Not that it's perfect or better in all the ways, it's just from my experience and the users I talk to, it is just as good and fills a need that gmail doesn't.

Same goes for spam-filtering. It's not that spamassassin/amavisd/rspamd/postscreen/RBLs/whatever is 100% perfect, it just get's you pretty far, and from my experience also gmail, as the main contender, has varying success on how close they achieve 100%.

And even security is not magic. A large mail provider doesn't have access to magically different security tooling than everyone else. They have a threat model that is slightly different and their scale allows them to do some things that not everyone can. But wrt to one's userbase it's perfectly possible to be "just as secure".

Running your own org-mailinfrastructure is certainly not "artisanal" - for some reason this comes off slighly dismissive in the article - it's just that, as anything, it's work that you have to want to invest in. A trade-off where it often does make sense to outsource. But then email is not so different from any other service you want to provide.

... but then I see that the article seems to partially be writing off of the experience of using the U of Toronto mail system, which seems to be using squirrelmail and procmail. I didn't even know squirrelmail was still developed - this impression kind supported by there being no news between 2013 and October 21, 2021 on the frontpage https://squirrelmail.org/ while procmail is unsupported since approximately forever (it feels like pre-9/11 but I am not sure).

If you compare that experience with outlook.com - then I can certainly see why one could come to the conclusion in this article.

EDIT: Heh: my guess of procmail being pre-9/11. Wikipedia says: "Final release 3.22 / September 10, 2001"



> A large mail provider doesn't have access to magically different security tooling than everyone else.

Actually various big FAANG companies have very privileged access to vulnerability disclosures.

However, the threat model can make small mailservers way more secure. Breaking into gmail is worth billions.

Breaking into your personal mailserver is not worth the time of any skilled attacker unless you have very valuable secrets.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: