Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #212790 > unrolled thread

webmail and email from command line

Back to article view | Back to linux.debian.user

Contents

  webmail and email from command line loredana <llcfree@gmail.com> - 2019-08-14 16:30 +0200
    Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-14 17:10 +0200
      Re: webmail and email from command line loredana <llcfree@gmail.com> - 2019-08-14 18:10 +0200
        Re: webmail and email from command line john doe <johndoe65534@mail.com> - 2019-08-14 18:30 +0200
          Re: webmail and email from command line lena <lena@pangea.org> - 2019-08-16 16:10 +0200
        Re: webmail and email from command line tomas@tuxteam.de - 2019-08-14 18:30 +0200
          Re: webmail and email from command line Joe Dennigan <general@jdenn.fastmail.fm> - 2019-08-14 21:40 +0200
          Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-16 04:00 +0200
        Re: webmail and email from command line Dan Purgert <dan@djph.net> - 2019-08-14 19:10 +0200
        Re: webmail and email from command line Paul Sutton <zleap@disroot.org> - 2019-08-14 19:30 +0200
        Re: webmail and email from command line Joe Pfeiffer <pfeiffer@cs.nmsu.edu> - 2019-08-14 20:40 +0200
          Re: webmail and email from command line David Wright <deblis@lionunicorn.co.uk> - 2019-08-16 03:50 +0200
    Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-16 04:10 +0200
      Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-16 10:20 +0200
        Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-18 23:20 +0200
          Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-18 23:50 +0200
            Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-19 03:20 +0200
              Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-19 10:40 +0200
                Re: webmail and email from command line Nektarios Katakis <nektarios@mail.nektarioskatakis.xyz> - 2019-08-19 11:20 +0200
                Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-19 15:50 +0200
                  Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-19 17:30 +0200
                    Re: webmail and email from command line Jude DaShiell <jdashiel@panix.com> - 2019-08-19 17:30 +0200
                      Re: webmail and email from command line tomas@tuxteam.de - 2019-08-19 17:50 +0200
                    Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-19 18:10 +0200
                      Why I mistrust bigcorps [was: webmail and email from command line] <tomas@tuxteam.de> - 2019-08-19 19:30 +0200
                    Re: webmail and email from command line Joe <joe@jretrading.com> - 2019-08-19 22:10 +0200
                      Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-19 23:10 +0200
              Re: webmail and email from command line Alessandro Vesely <vesely@tana.it> - 2019-08-19 11:40 +0200
                Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-19 16:10 +0200
                  Re: webmail and email from command line <tomas@tuxteam.de> - 2019-08-19 17:30 +0200
                    Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-19 18:10 +0200
                      Re: webmail and email from command line Alessandro Vesely <vesely@tana.it> - 2019-08-19 19:40 +0200
                        Re: webmail and email from command line Celejar <celejar@gmail.com> - 2019-08-19 20:30 +0200
                          Re: webmail and email from command line Joe <joe@jretrading.com> - 2019-08-19 22:00 +0200
      Re: webmail and email from command line loredana <llcfree@gmail.com> - 2019-08-16 14:10 +0200
        Re: webmail and email from command line Jude DaShiell <jdashiel@panix.com> - 2019-08-16 15:00 +0200
          Re: webmail and email from command line loredana <llcfree@gmail.com> - 2019-08-16 15:30 +0200
            Re: webmail and email from command line Jude DaShiell <jdashiel@panix.com> - 2019-08-16 19:20 +0200
    Re: webmail and email from command line loredana <llcfree@gmail.com> - 2019-08-20 19:40 +0200

Page 2 of 2 — ← Prev page 1 [2]

#212982

[Multipart message — attachments visible in raw view] — view raw

On Mon, Aug 19, 2019 at 09:47:55AM -0400, Celejar wrote:
> On Mon, 19 Aug 2019 10:32:31 +0200
> <tomas@tuxteam.de> wrote:
> 
> > On Sun, Aug 18, 2019 at 09:15:45PM -0400, Celejar wrote:
> > > On Sun, 18 Aug 2019 23:43:35 +0200
> > > <tomas@tuxteam.de> wrote:
> > > 
> > > > On Sun, Aug 18, 2019 at 05:19:28PM -0400, Celejar wrote:
> > > > > On Fri, 16 Aug 2019 10:10:35 +0200
> > 
> > [...]
> > 
> > > I think terming Google's decision to call software that doesn't
> > > implement OAuth "less secure" "evil" is hyperbole [...]
> > 
> > This nicely demonstrates my point: OAuth is a HTTP oriented access
> > delegation protocol. Why should that be at all relevant, e.g. in
> > the context of IMAP?
> 
> >From the Introduction to RFC 6749:

Edited by D. Hardt, Microsoft. Hmmm.

> *****
> 
> In the traditional client-server authentication model [...]

> Third-party applications are required to store the resource
>       owner's credentials for future use, typically a password in
>       clear-text.

So for Mr. Hardt, Kerberos doesn't exist. Or he's talking HTTP context
only.

But I disgress: more interesting is this [1]:

   "Eran Hammer resigned his role of lead author for the OAuth
    2.0 project, withdrew from the IETF working group, and removed
    his name from the specification in July 2012. Hammer cited a
    conflict between web and enterprise cultures as his reason
    for leaving, noting that IETF is a community that is 'all
    about enterprise use cases' and 'not capable of simple.'"

See also "decommoditizing protocols [2]

> You can argue that none of this matters to you, since you trust
> whatever OSS software you're using, but I stand by what I wrote that
> it's unfair to term Google's decision to refer to applications that
> don't implement OAuth "less secure" "evil".

Whatever you mean by "none of this": I am interested in security.
But in /my/ security, on in /your/ security -- not Google's or
Microsoft's (or whatever bigcorp's out there). Much less in their
business model's security.

> I was referring to the client side - Chrome / Chromium achieved
> dominance (particularly on the desktop) largely because they were
> widely recognized as being more performant than the alternatives.

Remember that Google is an advertising company?

> Firefox may be catching up now, but my impression is that for years,
> both experts as well as laymen often preferred Chrome / Chromium
> because of its speed. [Note that I have always stuck to Firefox for
> almost all my browsing, largely because I don't like / trust Google, so
> we're not as far apart as we might seem.]

[...]

> We agree - I want it out of my cereal bowl as well ;)

Google-free cereals for all ;-D

Cheers

[1] https://en.wikipedia.org/wiki/OAuth#Controversy
[2] https://www.levien.com/free/decommoditizing.html

-- t

[toc] | [prev] | [next] | [standalone]

#212983

On Mon, 19 Aug 2019, tomas@tuxteam.de wrote:

> Date: Mon, 19 Aug 2019 11:19:58
> From: tomas@tuxteam.de
> To: debian-user@lists.debian.org
> Subject: Re: webmail and email from command line
>
> On Mon, Aug 19, 2019 at 09:47:55AM -0400, Celejar wrote:
> > On Mon, 19 Aug 2019 10:32:31 +0200
> > <tomas@tuxteam.de> wrote:
> >
> > > On Sun, Aug 18, 2019 at 09:15:45PM -0400, Celejar wrote:
> > > > On Sun, 18 Aug 2019 23:43:35 +0200
> > > > <tomas@tuxteam.de> wrote:
> > > >
> > > > > On Sun, Aug 18, 2019 at 05:19:28PM -0400, Celejar wrote:
> > > > > > On Fri, 16 Aug 2019 10:10:35 +0200
> > >
> > > [...]
> > >
> > > > I think terming Google's decision to call software that doesn't
> > > > implement OAuth "less secure" "evil" is hyperbole [...]
> > >
> > > This nicely demonstrates my point: OAuth is a HTTP oriented access
> > > delegation protocol. Why should that be at all relevant, e.g. in
> > > the context of IMAP?
> >
> > >From the Introduction to RFC 6749:
>
> Edited by D. Hardt, Microsoft. Hmmm.
>
> > *****
> >
> > In the traditional client-server authentication model [...]
>
> > Third-party applications are required to store the resource
> >       owner's credentials for future use, typically a password in
> >       clear-text.
>
> So for Mr. Hardt, Kerberos doesn't exist. Or he's talking HTTP context
> only.
>
> But I disgress: more interesting is this [1]:
>
>    "Eran Hammer resigned his role of lead author for the OAuth
>     2.0 project, withdrew from the IETF working group, and removed
>     his name from the specification in July 2012. Hammer cited a
>     conflict between web and enterprise cultures as his reason
>     for leaving, noting that IETF is a community that is 'all
>     about enterprise use cases' and 'not capable of simple.'"
>
> See also "decommoditizing protocols [2]
>
> > You can argue that none of this matters to you, since you trust
> > whatever OSS software you're using, but I stand by what I wrote that
> > it's unfair to term Google's decision to refer to applications that
> > don't implement OAuth "less secure" "evil".
>
> Whatever you mean by "none of this": I am interested in security.
> But in /my/ security, on in /your/ security -- not Google's or
> Microsoft's (or whatever bigcorp's out there). Much less in their
> business model's security.
>
> > I was referring to the client side - Chrome / Chromium achieved
> > dominance (particularly on the desktop) largely because they were
> > widely recognized as being more performant than the alternatives.
>
> Remember that Google is an advertising company?
>
> > Firefox may be catching up now, but my impression is that for years,
> > both experts as well as laymen often preferred Chrome / Chromium
> > because of its speed. [Note that I have always stuck to Firefox for
> > almost all my browsing, largely because I don't like / trust Google, so
> > we're not as far apart as we might seem.]
>
> [...]
>
> > We agree - I want it out of my cereal bowl as well ;)
>
> Google-free cereals for all ;-D
>
> Cheers
>
> [1] https://en.wikipedia.org/wiki/OAuth#Controversy
> [2] https://www.levien.com/free/decommoditizing.html

Google could evaluate the non-browser software in use and pass what is
secure and fail the other packages with explanations for the authors of
failed packages but what google could do and what google is doing or will
be doing are three different matters altogether.  Lord Ackton in his full
quote had a few things to say about this and other corporate situations
in which we find ourselves these days.  By the way, his full quote is
longer than its first seven words and even better for that for my money.

>
> -- t >

-- 

[toc] | [prev] | [next] | [standalone]

#212984

[Multipart message — attachments visible in raw view] — view raw

On Mon, Aug 19, 2019 at 11:29:04AM -0400, Jude DaShiell wrote:

> Google could evaluate the non-browser software in use and pass what is
> secure and fail the other packages with explanations for the authors of
> failed packages [...]

I think it's more subtle than that. "Traditional" (i.e. non-Webmail)
clients are qualified as "insecure" although they haven't to be.

This will softly nudge people towards (Google) webmail.

OTOH I don't want to be misunderstood. Google is big, and they actually
do a couple of things which benefit us all. Project Zero, for one.
Google Summer of Code, for another.

Cheers
-- tomás

[toc] | [prev] | [next] | [standalone]

#212985

On Mon, 19 Aug 2019 17:19:58 +0200
<tomas@tuxteam.de> wrote:

> On Mon, Aug 19, 2019 at 09:47:55AM -0400, Celejar wrote:
> > On Mon, 19 Aug 2019 10:32:31 +0200
> > <tomas@tuxteam.de> wrote:
> > 
> > > On Sun, Aug 18, 2019 at 09:15:45PM -0400, Celejar wrote:
> > > > On Sun, 18 Aug 2019 23:43:35 +0200
> > > > <tomas@tuxteam.de> wrote:
> > > > 
> > > > > On Sun, Aug 18, 2019 at 05:19:28PM -0400, Celejar wrote:
> > > > > > On Fri, 16 Aug 2019 10:10:35 +0200
> > > 
> > > [...]
> > > 
> > > > I think terming Google's decision to call software that doesn't
> > > > implement OAuth "less secure" "evil" is hyperbole [...]
> > > 
> > > This nicely demonstrates my point: OAuth is a HTTP oriented access
> > > delegation protocol. Why should that be at all relevant, e.g. in
> > > the context of IMAP?
> > 
> > >From the Introduction to RFC 6749:
> 
> Edited by D. Hardt, Microsoft. Hmmm.

Ad hominem.

> > *****
> > 
> > In the traditional client-server authentication model [...]
> 
> > Third-party applications are required to store the resource
> >       owner's credentials for future use, typically a password in
> >       clear-text.
> 
> So for Mr. Hardt, Kerberos doesn't exist. Or he's talking HTTP context
> only.

Not sure what your point is here: how are the relative merits of
OAuth and Kerberos relevant to the underlying question of whether it is
or is not reasonable for Google to call OAuth more secure than plain
password authentication?

> But I disgress: more interesting is this [1]:
> 
>    "Eran Hammer resigned his role of lead author for the OAuth
>     2.0 project, withdrew from the IETF working group, and removed
>     his name from the specification in July 2012. Hammer cited a
>     conflict between web and enterprise cultures as his reason
>     for leaving, noting that IETF is a community that is 'all
>     about enterprise use cases' and 'not capable of simple.'"

Not sure how this is relevant to our discussion.

> See also "decommoditizing protocols [2]

Relevance? Explain?

> > You can argue that none of this matters to you, since you trust
> > whatever OSS software you're using, but I stand by what I wrote that
> > it's unfair to term Google's decision to refer to applications that
> > don't implement OAuth "less secure" "evil".
> 
> Whatever you mean by "none of this": I am interested in security.
> But in /my/ security, on in /your/ security -- not Google's or
> Microsoft's (or whatever bigcorp's out there). Much less in their
> business model's security.

You're not addressing what I wrote: I cited the OAuth RFC's explanation
for why something like OAuth is more secure than plain password
authentication. You've thrown in all sorts of interesting history and
ideology, but haven't directly addressed the points in the RFC.

> > I was referring to the client side - Chrome / Chromium achieved
> > dominance (particularly on the desktop) largely because they were
> > widely recognized as being more performant than the alternatives.
> 
> Remember that Google is an advertising company?

Of course I remember, but you keep ignoring the technical points I'm
making, and instead argue from ideology and innuendo. Do you or
do you not agree that much of Chrome / Chromium's success for years was
due to its technical merits?

> > Firefox may be catching up now, but my impression is that for years,
> > both experts as well as laymen often preferred Chrome / Chromium
> > because of its speed. [Note that I have always stuck to Firefox for
> > almost all my browsing, largely because I don't like / trust Google, so
> > we're not as far apart as we might seem.]
> 
> [...]
> 
> > We agree - I want it out of my cereal bowl as well ;)
> 
> Google-free cereals for all ;-D

On this we agree!

Celejar

[toc] | [prev] | [next] | [standalone]

#212991 — Why I mistrust bigcorps [was: webmail and email from command line]

[Multipart message — attachments visible in raw view] — view raw

[note: veering dangerously off-topic. If anyone kicks us out,
I'll accept without protesting]

On Mon, Aug 19, 2019 at 12:03:25PM -0400, Celejar wrote:
> On Mon, 19 Aug 2019 17:19:58 +0200
> <tomas@tuxteam.de> wrote:

[...]

> > Edited by D. Hardt, Microsoft. Hmmm.
> 
> Ad hominem.

rather ad corporationem. Mr. Hardt most probably is a nice guy
himself.


> > > Third-party applications are required to store the resource
> > >       owner's credentials for future use, typically a password in
> > >       clear-text.
> > 
> > So for Mr. Hardt, Kerberos doesn't exist. Or he's talking HTTP context
> > only.
> 
> Not sure what your point is here: how are the relative merits of
> OAuth and Kerberos [...]

The way you quoted rfc6749 made it seem that its way of handling
third-party authentication was unique. It is not. But for "normal"
mail business it isn't even necessary!

> > But I disgress: more interesting is this [1]:
> > 
> >    "Eran Hammer resigned his role of lead author for the OAuth
> >     2.0 project, withdrew from the IETF working group, and removed
> >     his name from the specification in July 2012. Hammer cited a
> >     conflict between web and enterprise cultures as his reason
> >     for leaving, noting that IETF is a community that is 'all
> >     about enterprise use cases' and 'not capable of simple.'"
> 
> Not sure how this is relevant to our discussion.
> 
> > See also "decommoditizing protocols [2]
> 
> Relevance? Explain?

It is very much: it illustrates how bigcorps subvert standadrs
processes and use their leverage to influence perception ("not
secure" as a moniker for "not OAuth" or "not our way") to nudge
people.

> You're not addressing what I wrote: I cited the OAuth RFC's explanation
> for why something like OAuth is more secure than plain password
> authentication. You've thrown in all sorts of interesting history and
> ideology, but haven't directly addressed the points in the RFC.

OAuth may be "more secure for third-party website authentication",
that is what it was made for. It definitely isn't more secure
than "pasword authentication over a verified TLS link", and that's
how e.g. IMAP works. Heck, I'd venture that IMAPS is more secure,
because simpler (no third party).

> > > I was referring to the client side - Chrome / Chromium achieved
> > > dominance (particularly on the desktop) largely because they were
> > > widely recognized as being more performant than the alternatives.
> > 
> > Remember that Google is an advertising company?
> 
> Of course I remember, but you keep ignoring the technical points I'm
> making, and instead argue from ideology and innuendo. Do you or
> do you not agree that much of Chrome / Chromium's success for years was
> due to its technical merits?

Not really. Firefox had its weak phase, but it was short and seems
over. And I'm sure that it is in Google's strategy to influence that
perception.

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#213007

On Mon, 19 Aug 2019 17:19:58 +0200
<tomas@tuxteam.de> wrote:


> 
> So for Mr. Hardt, Kerberos doesn't exist. Or he's talking HTTP context
> only.
> 

MS has used Active Directory in some form or other since Win2000, and
AD is basically Kerberos plus LDAP. An AD 'domain' is basically a realm.

So yes, all their technical employees know about it.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#213013

[Multipart message — attachments visible in raw view] — view raw

On Mon, Aug 19, 2019 at 09:01:02PM +0100, Joe wrote:
> On Mon, 19 Aug 2019 17:19:58 +0200
> <tomas@tuxteam.de> wrote:
> 
> 
> > 
> > So for Mr. Hardt, Kerberos doesn't exist. Or he's talking HTTP context
> > only.
> > 
> 
> MS has used Active Directory in some form or other since Win2000, and
> AD is basically Kerberos plus LDAP. An AD 'domain' is basically a realm.
> 
> So yes, all their technical employees know about it.

There was some sarcasm in my remark ;-)

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#212967

 On Mon 19/Aug/2019 03:15:45 +0200 Celejar wrote:
> I think terming Google's decision to call software that doesn't
> implement OAuth "less secure" "evil" is hyperbole that doesn't help our
> broader cause of opposing its breaking of standards, imposing various
> sorts of lock-in, invasions of privacy, etc.


Breaking of standards?  Not sure about the web, but for email
protocols Google counts many active participants and gmail is often
among the early adopters (e.g. ARC).

On the other hand, I am perplexed when I see epic personalities of
IETF standard making, like Brian Carpenter, Dave Crocket, and many
other, preferably use gmail addresses.  Most of them used to prefer
sending from their own mail servers.  Obviously, they find gmail more
convenient...  Of course, protocols will be useless when there will be
just one or two providers.

Even John Klensin, the author of ESMTP, although he uses his own
domain for sending mail through Exim, uses outlook.com for incoming
MX.  Presumably, that's more convenient than maintaining efficient
anti-virus and anti-spam.  Notably, as an SMTP purist, John deploys
neither SPF nor DKIM.

At this point I realize this message is not so off-topic as I had
figured when I hit the reply button.  So, let me mention I'm also
still running my own server.  I use Courier-MTA, which integrates SMTP
and IMAP with maildrop (delivery agent and mail filter) and a plethora
of utilities.  Of course, I recommend it.


jm2c
Ale

[toc] | [prev] | [next] | [standalone]

#212978

On Mon, 19 Aug 2019 11:33:52 +0200
Alessandro Vesely <vesely@tana.it> wrote:

>  On Mon 19/Aug/2019 03:15:45 +0200 Celejar wrote:
> > I think terming Google's decision to call software that doesn't
> > implement OAuth "less secure" "evil" is hyperbole that doesn't help our
> > broader cause of opposing its breaking of standards, imposing various
> > sorts of lock-in, invasions of privacy, etc.
> 
> 
> Breaking of standards?  Not sure about the web, but for email
> protocols Google counts many active participants and gmail is often
> among the early adopters (e.g. ARC).

I think I've seen many reports of Gmail's breaking of standards over
the years, but here's one that I've been able to find:

http://pyropus.ca/software/getmail/faq.html#faq-notabug-gmail-bug

...

> At this point I realize this message is not so off-topic as I had
> figured when I hit the reply button.  So, let me mention I'm also
> still running my own server.  I use Courier-MTA, which integrates SMTP
> and IMAP with maildrop (delivery agent and mail filter) and a plethora
> of utilities.  Of course, I recommend it.

I'd love to run my own mail stack, and I think I could handle the
software deployment reasonably well, but from everything I've read,
the headaches required to make sure that major mail operators will
actually accept my mail are more than I have time or patience for:

https://arstechnica.com/information-technology/2014/02/how-to-run-your-own-e-mail-server-with-your-own-domain-part-1/
https://arstechnica.com/gadgets/2018/12/review-helm-personal-server-gets-email-self-hosting-almost-exactly-right/

Celejar

[toc] | [prev] | [next] | [standalone]

#212981

[Multipart message — attachments visible in raw view] — view raw

On Mon, Aug 19, 2019 at 10:06:33AM -0400, Celejar wrote:

[...]

> I'd love to run my own mail stack, and I think I could handle the
> software deployment reasonably well, but from everything I've read,
> the headaches required to make sure that major mail operators will
> actually accept my mail are more than I have time or patience for:

It's not /that/ bad. I'm doing it myself, and I'm a C programmer.
As a sysad I'm a catastrophe :-)

Cheers
-- t

[toc] | [prev] | [next] | [standalone]

#212986

On Mon, 19 Aug 2019 17:21:40 +0200
<tomas@tuxteam.de> wrote:

> On Mon, Aug 19, 2019 at 10:06:33AM -0400, Celejar wrote:
> 
> [...]
> 
> > I'd love to run my own mail stack, and I think I could handle the
> > software deployment reasonably well, but from everything I've read,
> > the headaches required to make sure that major mail operators will
> > actually accept my mail are more than I have time or patience for:
> 
> It's not /that/ bad. I'm doing it myself, and I'm a C programmer.
> As a sysad I'm a catastrophe :-)

As I've explained, I'm not scared of the basic software configuration
and deployment. I have no patience, however, for constant monitoring to
make sure I stay off blacklists, and dealing with all sorts of
unspecified rules and conditions established by various organizations
for them to accept my mail.

Celejar

[toc] | [prev] | [next] | [standalone]

#212992

On Mon 19/Aug/2019 18:05:57 +0200 Celejar wrote:
> On Mon, 19 Aug 2019 17:21:40 +0200
> <tomas@tuxteam.de> wrote:
> 
>> On Mon, Aug 19, 2019 at 10:06:33AM -0400, Celejar wrote:
>>
>> [...]
>>
>>> I'd love to run my own mail stack, and I think I could handle the
>>> software deployment reasonably well, but from everything I've read,
>>> the headaches required to make sure that major mail operators will
>>> actually accept my mail are more than I have time or patience for:
>>
>> It's not /that/ bad. I'm doing it myself, and I'm a C programmer.
>> As a sysad I'm a catastrophe :-)
> 
> As I've explained, I'm not scared of the basic software configuration
> and deployment. I have no patience, however, for constant monitoring to
> make sure I stay off blacklists, and dealing with all sorts of
> unspecified rules and conditions established by various organizations
> for them to accept my mail.


The most difficult thing is obtaining an suitable Internet connection.
 As an alternative, someone upstream suggested a hosting site.  I keep
forgetting how that would be better than Google.  I get quite a few
thank-you messages every day from DigitalOcean Security, Google Cloud
Platform, Amazon EC2, and similar providers to whom my server sends
abuse complaints automatically.  Sometimes I get notifications that
the relevant account was stroked.  What does go wrong there?

For one thing, among the eight support tools listed in the cited Ars
Technica howto there's no firewall.  Having the server /in the office/
and working at its console makes it much easier to see what's going
on.  I think that's what everybody should be doing.  It is a social
abuse that server connections cost so much more than residential ones,
and if I were a conspiracy theorist I would point my finger there.


Best
Ale

[toc] | [prev] | [next] | [standalone]

#212999

On Mon, 19 Aug 2019 19:33:55 +0200
Alessandro Vesely <vesely@tana.it> wrote:

> On Mon 19/Aug/2019 18:05:57 +0200 Celejar wrote:
> > On Mon, 19 Aug 2019 17:21:40 +0200
> > <tomas@tuxteam.de> wrote:
> > 
> >> On Mon, Aug 19, 2019 at 10:06:33AM -0400, Celejar wrote:
> >>
> >> [...]
> >>
> >>> I'd love to run my own mail stack, and I think I could handle the
> >>> software deployment reasonably well, but from everything I've read,
> >>> the headaches required to make sure that major mail operators will
> >>> actually accept my mail are more than I have time or patience for:
> >>
> >> It's not /that/ bad. I'm doing it myself, and I'm a C programmer.
> >> As a sysad I'm a catastrophe :-)
> > 
> > As I've explained, I'm not scared of the basic software configuration
> > and deployment. I have no patience, however, for constant monitoring to
> > make sure I stay off blacklists, and dealing with all sorts of
> > unspecified rules and conditions established by various organizations
> > for them to accept my mail.
> 
> 
> The most difficult thing is obtaining an suitable Internet connection.

Quite so.

Celejar

[toc] | [prev] | [next] | [standalone]

#213005

On Mon, 19 Aug 2019 14:20:29 -0400
Celejar <celejar@gmail.com> wrote:

> On Mon, 19 Aug 2019 19:33:55 +0200
> Alessandro Vesely <vesely@tana.it> wrote:
> 
> > On Mon 19/Aug/2019 18:05:57 +0200 Celejar wrote:  
> > > On Mon, 19 Aug 2019 17:21:40 +0200
> > > <tomas@tuxteam.de> wrote:
> > >   
> > >> On Mon, Aug 19, 2019 at 10:06:33AM -0400, Celejar wrote:
> > >>
> > >> [...]
> > >>  
> > >>> I'd love to run my own mail stack, and I think I could handle
> > >>> the software deployment reasonably well, but from everything
> > >>> I've read, the headaches required to make sure that major mail
> > >>> operators will actually accept my mail are more than I have
> > >>> time or patience for:  
> > >>
> > >> It's not /that/ bad. I'm doing it myself, and I'm a C programmer.
> > >> As a sysad I'm a catastrophe :-)  
> > > 
> > > As I've explained, I'm not scared of the basic software
> > > configuration and deployment. I have no patience, however, for
> > > constant monitoring to make sure I stay off blacklists, and
> > > dealing with all sorts of unspecified rules and conditions
> > > established by various organizations for them to accept my mail.  
> > 
> > 
> > The most difficult thing is obtaining an suitable Internet
> > connection.  
> 
> Quite so.

People in the land that invented the Internet often have remarkably
little choice in terms of Internet connection. Many people have only one
option. There are at least three ISPs in the UK which have 'good' IP
addresses and keep them that way.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#212864

First of all, I wish to thank all of you who shared their experience.
Be reassured I am taking any constructive suggestion into serious
account and exploring more.

Then:

On Fri, Aug 16, 2019 at 2:03 AM Celejar <celejar@gmail.com> wrote:
>
> On Wed, 14 Aug 2019 16:24:49 +000

> loredana <llcfree@gmail.com> wrote:
> > secure applications, this is likely not to be a viable solution (it
> > seems that google is going to forbit less secure application access
> > starting November first of this year and it is already a pain to use
> > it now).
>
> What is your source for Google's plans, and how is it already a pain?

I am following the google development on this issue, but I got the
date from the mu4e mailing list. I'l post the link, if I can find it
again (remember, I am almost blind and even replying to email is, at
the moment, really slow and difficult).

> have been using getmail and sylpheed with several Google mail accounts
> for years, and it seemed pretty straightforward - just set the "allow
> less secure apps" option, and then configure POP3 / SMTP normally.

In the email that started this thread, I tried to make clear that this
is something happening "now". I use the internet for crossing oceans
quickly since bitnet and I remember whet google was born as
google."org". I am myself a long term gmail user and this is why I
carefully look after main changes. The way email clients will
authenticate to gmail is drfinitely one of them and is going to affect
us for sure.

I may be able to be more responsive once I find a good way of avoiding webmail.
Meanwhile, here is the best I could find toward a possible solution
that may help avoid the OAUTH2 authorization issue by complying with
it.

You need debian buster as a minimum, then look at the gmailieer
package. It seems to be oauth2 enabled and therefore be able to access
gmail and possibly other mail providers. I still have to test it. If
you try it, be careful because it requires notmuch and notmuch is in
the less secure apps list, so you have to allow less secure apps
first, I guess, and hopefully be able to set it off/on as you like
again (if you can, this will probably get a feeling about the pain
...).

gmailieer is GPLv3+ and in debian. IMHO this these are two good
things. The debian package page:
https://packages.debian.org/search?keywords=gmailieer

It seems that mbsync (isink) is on itw long way to become OAUTH2
enableb, too, as possibly other applications. It is a matter of timen
and the free software community will catch up, as usual.

I don't think the authentication issue is going to affect webmail
users for a while.

Loredana

[toc] | [prev] | [next] | [standalone]

#212873

On Fri, 16 Aug 2019, loredana wrote:

> Date: Fri, 16 Aug 2019 10:02:17
> From: loredana <llcfree@gmail.com>
> To: Celejar <celejar@gmail.com>
> Cc: debian-user@lists.debian.org
> Subject: Re: webmail and email from command line
> Resent-Date: Fri, 16 Aug 2019 12:03:05 +0000 (UTC)
> Resent-From: debian-user@lists.debian.org
>
> First of all, I wish to thank all of you who shared their experience.
> Be reassured I am taking any constructive suggestion into serious
> account and exploring more.
>
> Then:
>
> On Fri, Aug 16, 2019 at 2:03 AM Celejar <celejar@gmail.com> wrote:
> >
> > On Wed, 14 Aug 2019 16:24:49 +000
>
> > loredana <llcfree@gmail.com> wrote:
> > > secure applications, this is likely not to be a viable solution (it
> > > seems that google is going to forbit less secure application access
> > > starting November first of this year and it is already a pain to use
> > > it now).
> >
> > What is your source for Google's plans, and how is it already a pain?
>
> I am following the google development on this issue, but I got the
> date from the mu4e mailing list. I'l post the link, if I can find it
> again (remember, I am almost blind and even replying to email is, at
> the moment, really slow and difficult).
>
> > have been using getmail and sylpheed with several Google mail accounts
> > for years, and it seemed pretty straightforward - just set the "allow
> > less secure apps" option, and then configure POP3 / SMTP normally.
>
> In the email that started this thread, I tried to make clear that this
> is something happening "now". I use the internet for crossing oceans
> quickly since bitnet and I remember whet google was born as
> google."org". I am myself a long term gmail user and this is why I
> carefully look after main changes. The way email clients will
> authenticate to gmail is drfinitely one of them and is going to affect
> us for sure.
>
> I may be able to be more responsive once I find a good way of avoiding webmail.
> Meanwhile, here is the best I could find toward a possible solution
> that may help avoid the OAUTH2 authorization issue by complying with
> it.
>
> You need debian buster as a minimum, then look at the gmailieer
> package. It seems to be oauth2 enabled and therefore be able to access
> gmail and possibly other mail providers. I still have to test it. If
> you try it, be careful because it requires notmuch and notmuch is in
> the less secure apps list, so you have to allow less secure apps
> first, I guess, and hopefully be able to set it off/on as you like
> again (if you can, this will probably get a feeling about the pain
> ...).
>
> gmailieer is GPLv3+ and in debian. IMHO this these are two good
> things. The debian package page:
> https://packages.debian.org/search?keywords=gmailieer
>
> It seems that mbsync (isink) is on itw long way to become OAUTH2
> enableb, too, as possibly other applications. It is a matter of timen
> and the free software community will catch up, as usual.
>
> I don't think the authentication issue is going to affect webmail
> users for a while.

Running using 2fa may be possible with non-browser apps if your security
records indicate you ran with what google considers an untrusted app and
google has it listed.  You can generate an app-specific password for the
non-browser app and will need to save it.  Then you modify your
non-browser app settings on local machine and key in that app-specific
password in place of the other password you used earlier.  This has been
documented for mutt as being possible and may work for other non-browser
apps too.  You'll need to give google a mobile number for account
recovery and the like too.

> > Loredana > >

--

[toc] | [prev] | [next] | [standalone]

#212875

On Fri, Aug 16, 2019 at 12:51 PM Jude DaShiell <jdashiel@panix.com> wrote:

> Running using 2fa may be possible with non-browser apps if your security
> records indicate you ran with what google considers an untrusted app and
> google has it listed.  You can generate an app-specific password for the
> non-browser app and will need to save it.  Then you modify your
> non-browser app settings on local machine and key in that app-specific
> password in place of the other password you used earlier.  This has been
> documented for mutt as being possible and may work for other non-browser
> apps too.  You'll need to give google a mobile number for account
> recovery and the like too.

Yes, that should work too (see the first mail in this thread).

But ... what stopped me and made me think is: what if I prefer to have
access to "my" mail without giving up a mobile or not so mobile
telephone number?

I am happier if this is made possible for everybody who prefer so via
a free application. Not sure gmailieer is going to work, not until I
try it. Bu it looks promising.

Cheers,
Loredana

[toc] | [prev] | [next] | [standalone]

#212881

anyone who needs that, needs a burner account.  Those are lots less
permanent and when your account is taken by someone else since you have
no way to recover that account it's understood whatever you had in it
was encrypted and is disposible.  Google provides a higher level of
management than you need for this kind of account.  The aol "service" it
turns out had these kind of accounts which once a screen name was taken
over you lost the account that went with it.
Search for public internet sites and check out what mail services those
have to offer and I think you'll be happy.

On Fri, 16 Aug 2019, loredana wrote:

> Date: Fri, 16 Aug 2019 11:26:53
> From: loredana <llcfree@gmail.com>
> To: Jude DaShiell <jdashiel@panix.com>
> Cc: debian-user@lists.debian.org
> Subject: Re: webmail and email from command line
> Resent-Date: Fri, 16 Aug 2019 13:27:39 +0000 (UTC)
> Resent-From: debian-user@lists.debian.org
>
> On Fri, Aug 16, 2019 at 12:51 PM Jude DaShiell <jdashiel@panix.com> wrote:
>
> > Running using 2fa may be possible with non-browser apps if your security
> > records indicate you ran with what google considers an untrusted app and
> > google has it listed.  You can generate an app-specific password for the
> > non-browser app and will need to save it.  Then you modify your
> > non-browser app settings on local machine and key in that app-specific
> > password in place of the other password you used earlier.  This has been
> > documented for mutt as being possible and may work for other non-browser
> > apps too.  You'll need to give google a mobile number for account
> > recovery and the like too.
>
> Yes, that should work too (see the first mail in this thread).
>
> But ... what stopped me and made me think is: what if I prefer to have
> access to "my" mail without giving up a mobile or not so mobile
> telephone number?
>
> I am happier if this is made possible for everybody who prefer so via
> a free application. Not sure gmailieer is going to work, not until I
> try it. Bu it looks promising.
>
> Cheers,
> Loredana
>
>

-- 

[toc] | [prev] | [next] | [standalone]

#213039

On Wed, Aug 14, 2019 at 4:24 PM loredana <llcfree@gmail.com> wrote:
>
> Greetings,
>
> I posted the following message to debian-accessibility and I post it
> again as suggested.

My mistake.
I can't cope with this threading hijacking. As I said in my first
post, I do have a serious problem I am trying to solve.

I will browse the mailing list for a while, just in case somebody out
there wants to help and I will be back (to debian-accessibility) once
I find a working solution.

For the time being, I need to give to my mailbox a well deserved break.

Thanks again to those who helped.

Bye,
Loredana

"A chi piu' sa, piu' perder tempo spiace" - Dante Alighieri

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web