News for hackers. Stuff that matters.
Re:Internet Archive: Security breach alert by buildsjets on Wednesday October 09, 2024 @11:18PM (#41795151)
Not the author but yes, I do. It’s trivially easy so why not?
Re:Internet Archive: Security breach alert by phantomathkg on Thursday October 10, 2024 @12:32AM (#41795531)
Curious, how trivially easy is that?
Re:Internet Archive: Security breach alert by TheDong on Thursday October 10, 2024 @12:44AM (#41795593)
It's quite trivial.

1. Buy a domain. About $10/year for a .com

2. Buy a /24 ipv4 block with good reputation (maybe like $10k)

3. Get a rack in a nearby datacenter, rack up a BGP-capable router and your servers for redundancy to run email. Takes about $30k initial setup costs if you buy all new, and about $5k initial setup costs if you cut corners and buy used. It'll be $2k/mo after that, so less than the cost of 1 $100 avocado toast per day, quite affordable.

4. Setup your mailserver of choice, such as dovecot + postfix. Enable either a catch-all address, or use recipient_delimiters. The former means "[email protected]" works, and the latter means "[email protected]" works (assuming your recipiient_delimiters are '-'). I recommend using a real catchall.

5. Setup your spam setup, this is the hardest part. I have no guidance here.

6. Point your DNS over, setup SPF and DKIM records, test, and off you go! This should all take about 1 to 3 days if you know what you're doing.

7. Find out that some email will go to spam anyway because you're not using one of the big 4 email providers, but it can't be helped, and anyway no one uses email anymore.

And after that, for less than $30k/year, you have email with catchall or subadressing support. Nice and easy.

You can also pay Fastmail for email and use their "catchall" feature https://www.fastmail.help/hc/en-us/articles/1500000277942-Ca...

Or Google Apps also has a catchall feature.

Then, after you do this, you can simply give internet archive the email address "[email protected]", or generate a random string. If you forget the email you used, you can search your email history for the first email they sent you, and check the To field.

Re:Internet Archive: Security breach alert by 2Gkashmiri on Thursday October 10, 2024 @12:54AM (#41795636)
Hold on.

Why do you need a dc rackspace and a /24 just to have your email ?

Re:Internet Archive: Security breach alert by TheDong on Thursday October 10, 2024 @01:18AM (#41795760)
This is hacker news, we're all either founders who have 2 billion dollars in (illiquid) stock options, or FAANG employees making 600k/year, what else are we going to do if we want email?

Sure, you could pay fastmail $40/year for this, but that's not really the hacker news spirit, and no one on this site knows how to count as low as $40.

The real justifications you can give yourself:

Shared VPS hosting pretty much all bans email, AWS, DO, etc all have ToS that say "no email" as anti-spam measures.

Shared IP space will go straight to spam due to people having spammed on it in the past. Buy a /24 to ensure you don't go straight to spam.

Rackspace ensures you actually own your email, at least moreso than with other shared hosting, and owning your email is important.

Re:Internet Archive: Security breach alert by 2Gkashmiri on Thursday October 10, 2024 @05:44AM (#41797193)
been using racknerd.com vps for last 3 years for running miab. ZERO problems so far.

costs around $12/year+domain

Re:Internet Archive: Security breach alert by account42 on Thursday October 10, 2024 @06:35AM (#41797450)
> Shared VPS hosting pretty much all bans email, AWS, DO, etc all have ToS that say "no email" as anti-spam measures.

Complete FUD.

Here is DO's acceptable use policy:

https://www.digitalocean.com/legal/acceptable-use-policy

You can see that they explicitly have policies for email hosts.

Here is a guide they host on how to setup a mail server:

https://www.digitalocean.com/community/tutorials/how-to-run-...

They forbid spamming, not all mail.

> Shared IP space will go straight to spam due to people having spammed on it in the past. Buy a /24 to ensure you don't go straight to spam.

I have had no problems with deliverability to Google from an IP on a shared block. I don't send marketing mails or any other kind of spam though. Microsoft blocks my IP but they are too small (outside businesses) for me to care to give them special snowflake treatment.

Deliverability of your own mails is also irrelevant for the original discussion about using unique email addresses for signing up to services - you don't need to be able to send at all for that.

Re:Internet Archive: Security breach alert by jmb99 on Thursday October 10, 2024 @03:02AM (#41796310)
For the “least painful” self-hosted email setup, you can’t be hosting on an IP in a subnet that’s ever sent spam, if you want to avoid being blackholed occasionally. This means you can’t have an IP allocated to you by a hosting provider, or a residential ISP, or a “business” ISP, or any cloud provider. That leaves very few options.

Note that I am speaking from personal experience here. I have been self-hosting email for over a decade, from the same IP, with (roughly) the same DNS records. Occasionally, for no reason, I will end up on the global spam list for Gmail, Outlook, or iCloud - never more than one at the same time, and never with a discernible reason. The best I can figure is that the IP is allocated to me by a hosting provider that occasionally sends out spam from its subnet (aka any hosting provider that doesn’t block smtp). I have also tried self-hosting a different mail server from a variety of residential IPs in different cities and countries, and ran into the same problem.

Re:Internet Archive: Security breach alert by marmaduke on Thursday October 10, 2024 @01:18AM (#41795761)
It’s a joke ! You can run an email server off your phone
Re:Internet Archive: Security breach alert by squarefoot on Thursday October 10, 2024 @05:37AM (#41797171)
Not sure if mobile carriers would allow the required ports to be routed, and the connection is usually behind CGNAT, so you can't accept connections from the outside to receive emails. Many home ISPs however can give you a (mostly) unfiltered public IP that once paired with a dynamic DNS service can be reached from the outside. Once the network part is solved, a small cheap box (*Pi like board, mini PC, etc) can be set up to act as mail server, with firewall rules on the router that don't expose anything else to the outside.
Re:Internet Archive: Security breach alert by marmaduke on Saturday October 12, 2024 @04:53AM (#41817628)
I meant just in terms of compute power. Like my isp gives me a static IP with forward and reverse dns, and the box lets me put the phone WiFi ip address in the DMZ so all traffic is handled by the phone. Then the termux app lets me run sshd and other stuff.

And actually I think this is a kind of setup people could get into: an Android dist that focuses on self hosting off an older device.

Re:Internet Archive: Security breach alert by dgellow on Thursday October 10, 2024 @05:09AM (#41797032)
Satire
Re:Internet Archive: Security breach alert by biztos on Friday October 11, 2024 @01:07AM (#41806350)
Hold on.

Where are you finding $100 avocado toast?

Re:Internet Archive: Security breach alert by JCharante on Thursday October 10, 2024 @03:44AM (#41796546)
I have an even easier approach:

- have an iphone/mac w/ icloud+

- go into settings

- add custom email

- get redirected to login to cloudflare

- buy/pick a domain for $12

- icloud+ automatically sets up the MX records on the domain via cloudflare

- enable catch-all emails in icloud settings

- Done!

Takes about 10 minutes & icloud provides the email hosting without any additional fees

Re:Internet Archive: Security breach alert by beAbU on Thursday October 10, 2024 @03:02AM (#41796312)
1/ Buy a domain of your choice 2/ Register an account on Migadu.com and pay them $20/year 3/ Configure your domain nameserver with the settings provided by Migadu 4/ Done.
Re:Internet Archive: Security breach alert by echoangle on Thursday October 10, 2024 @12:41AM (#41795573)
Some providers allow you to use Alias emails (I think google redirects mail to [email protected] to [email protected]), and if you use your own domain, you can just use a catchall redirect and enter a random address ([email protected] which goes to [email protected]).
Re:Internet Archive: Security breach alert by drsim on Thursday October 10, 2024 @12:43AM (#41795589)
Many providers support plus addresses like [email protected]. Servicename can be anything and doesn’t require any setup.
Re:Internet Archive: Security breach alert by duggan on Thursday October 10, 2024 @02:56AM (#41796290)
The +, however is just a comment delimiter.

All a service provider or malicious actor has to do is simply not include it when storing or publishing it to evade tracking.

Stripping it is not uncommon for services to prevent duplicate accounts.

Re:Internet Archive: Security breach alert by meindnoch on Thursday October 10, 2024 @06:27AM (#41797410)
1. Register domain on Cloudflare

2. Configure a catch-all forwarding address to your private GMail

Done.

Re:Internet Archive: Security breach alert by useless_foghorn on Thursday October 10, 2024 @01:21PM (#41801070)
I use Bitwarden coupled with AnonAddy (0) for simple and free on demand email alias generation.

0. https://bitwarden.com/help/generator/#username-types

Re:Internet Archive: Security breach alert by buildsjets on Thursday October 10, 2024 @03:06PM (#41802275)
Register an account on spamgourmet.com, move on with life.
Re:Internet Archive: Security breach alert by LtdJorge on Friday October 11, 2024 @04:09AM (#41807357)
Purelymail allows it
Re:Internet Archive: Security breach alert by nicolas_t on Thursday October 10, 2024 @12:46AM (#41795604)
Same here, only issue I’ve ever had was when my email address had the name of the company in it in the format of [email protected] CS people are sometimes confused by that and I’ve been accused of attempting to hack them by a small shop online because of my email.
Re:Internet Archive: Security breach alert by JCharante on Thursday October 10, 2024 @03:41AM (#41796533)
"Are you from corporate?" is what I often get when I need to give my email to a store associate.
Re:Internet Archive: Security breach alert by qingcharles on Thursday October 10, 2024 @01:44AM (#41795912)
Major SMTP provider refused my email address as login because of this. Luckily my moaning eventually made its way to one of their developers who fixed it.

You can't sign up for a Samsung account with the name Samsung anywhere in your e-mail address. Aliexpress another offender. There my email is just spam@domain.

Re:Internet Archive: Security breach alert by jmb99 on Thursday October 10, 2024 @02:55AM (#41796284)
I used ali@domain for aliexpress, which was accepted.