News for hackers. Stuff that matters.
Re:E-Mail Security in the Wake of Petraeus by rsync on Friday November 23, 2012 @12:00PM (#4822818)
Running your own mail server changes everything.

At the end of the day Men With Guns(TM) may still come to your colo facility and just take the equipment, but even in that edge scenario, you would know something was up in a way you wouldn't with gmail.

In non edge cases, you are the provider and the owner of the equipment, and it is you who will be given the court order - you'll see what is going on and have the opportunity to respond as YOU see fit, not as google sees fit. Furthermore, depending on your practices and countermeasures, you may have actions available to you with your own assets that, of course, you wouldn't have with gmail.

In fact, the advantages of running your own mail server are so great, that over the past few years I've decided it's probably time to start self-providing my own dialtone and voicemail the same way I self-provide my own email. For all of the same reasons.

Re:E-Mail Security in the Wake of Petraeus by DanBC on Friday November 23, 2012 @01:02PM (#4823057)
Some people are not able to keep up with the security patching required to host their own server.

Some people are not able to keep up with best current practice to ensure that email from their server is deliverable.

Running your own email server is for many people a sub-optimal solution. Sure, for a small number of people it's a great idea.

Re:E-Mail Security in the Wake of Petraeus by rsync on Friday November 23, 2012 @04:37PM (#4823762)
I think it's the only idea ... what other alternative is there ?

Not "encryption" since that's not the problem we are trying to solve - you can do that with gmail right now. I'm talking about the "I woke up this morning and my email was delivered to the local DA and I had no idea and played no part in it" problem ...

Re:E-Mail Security in the Wake of Petraeus by sliverstorm on Friday November 23, 2012 @05:08PM (#4823830)
Or the, "Chinese hackers dragnetted my account after they found a hole in GMail". Something to be said for being a small fish when the big boys go at it.
Re:E-Mail Security in the Wake of Petraeus by ZoFreX on Saturday November 24, 2012 @11:02AM (#4825540)
If they can subpoena ISPs for the data, they don't even need to seize your server to get your emails, and you'll be none the wiser.
Re:E-Mail Security in the Wake of Petraeus by liotier on Tuesday November 27, 2012 @04:51AM (#4836425)
Actually they would need to seize my server physically - my ISP does not have the root password. But :

- It is located in France, which makes it difficult for the US government. Easy for the French government though.

- It is a mom & pop ISP, who will tell me if someone forces them to yield access to he hardware.

- I will notice if the server goes offline.

That said, a competent, motivated and well endowed intruder will probably find a way through one of the other services on the same host - if intrusion occurs, I guess it will be through a Wordpress plugin. But if I wanted elevated security, a host with just sshd, courrier, postfix and the afferent mail processing is a pretty tough nut to crack.

Re:E-Mail Security in the Wake of Petraeus by sliverstorm on Friday November 23, 2012 @05:05PM (#4823823)
If you don't use a colo, how do you get around blanket IP range blocks? Are you hosting at home over "business" class internet service?