15characterslon

It worked perfectly well. It still works. Companies can transfer the data and no one gets sued. Legal enough.

It doesn't support syncing properly, if you use it on desktop + Android + iOS you have to trust three different app vendors, browser integration isn't nearly as good as 1Password, custom fields are badly integrated.

Bitwarden is subscription-based too. Or are you on the free tier with almost no features?

They had massive problems with their main database cluster (MySQL). If you read through their engineering blog, most of the outages were related to their growth and the main database cluster. They moved workloads for some features to different clusters, but that's only to buy more time. Eventually they'll do proper shredding (by user or org I guess, not by feature) but that takes time.

Their engineering blog is full of articles about MySQL and the main "mysql1" database cluster, e.g. https://github.blog/2021-09-27-partitioning-githubs-relation...

Best not turn it on again at all. Just to be sure ;)

Maybe you could use family sharing. https://support.google.com/youtube/answer/7507744?hl=en

It's funny you say that because kids today don't really have files either, since all the content is confined in apps.

And that's why we shouldn't fix bugs anymore? https://xkcd.com/1172/

Fixing this would only affect users who send emails "from" other users email addresses, basically users who commit fraud.

That's not true. SPF and DKIM were explicitly made to prevent email forging by authenticating the server, and the server is responsible for authenticating the user.

Please name even a single major mail provider that allows to send emails with arbitrary "from" headers.

https://datatracker.ietf.org/doc/html/rfc7208 https://datatracker.ietf.org/doc/html/rfc7489

No, they don't do that check, that is the problem.

As others said, DKIM always includes "from". And almost none of the emails I get are S/MIME or PGP signed.

Like you said: SPF and DMARC only authenticate the server. It's up to the server to authenticate the user.

Scenario: imagine your bank uses Mailbox.org to send emails. How would you verify that an email is legit? Any Mailbox user can send emails through Mailbox with your bank as "from" and all of these emails pass SPF and DKIM checks. Your mail server has no way to distinct a legit email from a fake one. This is why it's important that the server does this check (check that sender account and "from" match / are a valid combination).

AFAIK they still refuse to acknowledge the problem. But since they deleted the forum thread, how would I know.

What they said in the forum doesn't make much sense. Yes, anyone in the wold can send emails with any address as "from". The big difference is that those emails won't pass SPF and DMARC checks.

If I wanted to use them, I would need to configure SPF and DMARC for my domain so that their mail servers pass those checks. At this point I would expect their mail servers only to allow sending "from" my domain when my account is used.

Note that just about any major mail provider does this check (e.g. Google). It is industry standard. It is crazy that they even refuse to acknowledge this. I'm working in this field and this is basic knowledge. I just don't get how they can do this professionally and not understand what the problem is. The only explanation I have is that for some reason it would be hard for them to fix and so they try to ignore it / make it disappear by deleting the forum thread.

Also they use the same DMARC key for all customers, which is weird. Usually each customer gets it's own DMARC key.

Be aware that Mailbox.org allows any user to send emails as ("from") any other user via SMTP and these emails will look legit since they pass SPF and DKIM checks. Many consider this a security issue.

There was a quite lengthy discussion about this in their forum but they deleted it since. They refused to fix it. Archive.org still has it. Content is in German (sorry):

https://web.archive.org/web/20210123192856/https://userforum...

But what alternatives are there? I just need a solution for the usual stuff: mail, contacts, calendar, notes, tasks, files and meetings. Microsoft? Haha, hell no (they never did free anyway). Also using multiple services (e.g. Fastmail for mail and Dropbox for files) is way more expensive.

Gotta know exactly what is behind those mosaic pixels.

How much does it cost to run this on Azure?

According to statista, the UK has about 14 million residents younger than 20 years, so they're just counting everyone as a potential victim.

https://www.statista.com/statistics/281208/population-of-the...

Maybe deliver high quality results for adblock users only. Lower server costs for adblock users while maximizing ad-revenue for users without adblock. Win-win.

You can set your own passphrase in sync settings. This will enable end-to-end encryption and Google won't be able to read your synced data (not just passwords but also history and other synced data).

I didn't mean to insult you. I think it's great if you're experimenting and I fully support that. It's just that the headline set high expectations and the article reads like this is being used in production, which I would strongly advise against.

It was easier than I thought to create a mail server that works as well as Gmail’s

No it isn't and no you didn't.

The article doesn't even cover basic stuff like email rules and spam filtering (incl. tuning and spam learning). It doesn't "look after itself" like the author wanted (article doesn't mention any update strategy). The author acknowledges that email servers are "open to attack" but this setup doesn't seem to include any security improvements over traditional setups. In fact, maintaining this looks harder due to the amount of custom scripts and lack of good documentation.

And of course it doesn't cover any of the things that actually make Gmail special like labels, having a consistent set of apps for web and mobile, push notifications (esp. on iOS), really good spam filtering, really good search (incl. OCR for attachments), high availability, image proxying, smart suggestions, datacenter security, Google doing code and infrastructure audits all the time, using reproducible builds, ...

It's great that the author is experimenting and learning, but if I had any private data hosted by the author, I would be worried now.

The README could be improved here. I didn't know about Nitter, Invidious, ... It wasn't clear to me that these are just different frontends for the same services when I read the README.

That would be my point too. DNS-based content blocking is very ineffective and can be outsmarted very easily.

DNS filters might be very easy to set up but if they become more major they can be outsmarted very easily - what if Google starts serving ads from www.google.com, would you block that domain name too? Browser extensions can block content far more precisely.

And smart TVs and such stuff could easily switch resolvers and just not use your Pihole's DNS resolver - that would work even without DoH as long as you don't intercept traffic on your router. E.g. Fire TV already adds Google DNS as an additional DNS server (you can't change that). Chromecast only uses Google DNS (AFAIK you can't change that either). I guess the only viable option here is just not to buy those products.

Most major public (non-ISP) DNS resolvers support DNS-over-TLS today. (This includes Google, Cloudflare and Quad9.) The problem for the ISP is that switching to those resolvers would mean users would no longer use their DNS resolvers. I guess they're selling the data and that's why they're so mad about it. Mozilla is AFAIK the first one to include support for it in a browser. Chrome doesn't support it yet but will do so soon.

Depends on whether you consider a 7 months old feature new or not.

https://www.ghacks.net/2018/10/01/chrome-70-features-option-...

You are wrong, sir. This is a browser feature.

https://www.ghacks.net/2018/10/01/chrome-70-features-option-...

GitHub Actions are pretty neat. They were announced last year and I've started using them a few months ago.

You can sign up for the beta here: https://github.com/features/actions

Introduction: https://www.youtube.com/watch?v=_yPml1iTbmM

I'm a little bit anxious because the pricing has not yet been published. Both GitHub Actions and package registry will be free for public repositories but it is not yet known how much it will cost for private repositories after the beta.

It would be nice if it would support custom sync servers. I'm using a custom sync server with Firefox and therefore Lockbox does does not show any of my passwords after login.

Seems to be opt-out, at least it was enabled for me by default on Android. :/

Also the world's richest 50% own more than the poorest 50%.