Hacker Newsnew | past | comments | ask | show | jobs | submit | R_Spaghetti's commentslogin

I'm not sure whether Microsoft, the makers of Windows 95 (after which I stopped taking them seriously), are the sharpest tool in the box when it comes to security.


I checked the first 3 companies I saw with the label 'EU hosted'. bunq.com and lifebit.ai are hosted on AWS, and tomtom.com is hosted on Azure.

https://info.addr.tools/bunq.com https://info.addr.tools/lifebit.ai https://info.addr.tools/tomtom.com


Good that you checked that. I focused on getting substance on the platform for indexing purposes first. I plan to do a quality check ASAP and expect a lot of these mismatches to resolve once the feature for companies to claim their pages goes live.


Another reason to dump an american big tech firm and switch to Bunny.net for example. Better a democratic based error than an american greed based CEO.


As a further addition, Google does this for show (it’s not their business model) and is not equipped to deal with the criminals at Meta, as recently became apparent from, among other things, this disclosure: https://archive.is/nWpDZ https://localmess.github.io


You write: I'm fortunate enough to work at a company (enum.co) where digital sovereignty is not just a phrase.

info.addr.tools shows [1]: MX 1 smtp.google.com. TXT "mailcoach-verification=a873d3f3-0f4f-4a04-a085-d53f70708e84"

TXT "v=spf1 include:_spf.google.com ~all"

TXT "google-site-verification=TTrl7IWxuGQBEqbNAz17GKZzS-utrW7SCZbgdo5tkk0"

This is not just a phrase, it is a DNS entry. Using the most evil in phrases of digital sovereignty.

[1] https://info.addr.tools/enum.co


To be fair to enum, the services they sell are around k8, an s3-equivalent, and devops. If they sold/promised self-hosting/sovereign email services, and then were "caught" using gmail, that might be a different story.

Your point stands - they're not fully completely independent. And maybe the language in the OP's article could have been different.. but the OP also specifically says "Oh no, I said the forbidden phrase: Self-hosted mail server. I was always told to never under any circumstances do that. But it's really not that deep."

They're aware of the issue, everyone is aware of the issue. It's an issue :-) But I get your point too.


I think it would be fair for them to use something like proton or enterprise msft relay service. Actually this is only for inbound mail, it can be self hosted without any issues, spf on the other hand (outbound verification) does need a relay at minimum.


Hi R_Spaghetti,

Founder of enum here. That's a fair point, and a good catch.

Honestly, using Google Workspace for our internal email was a pragmatic choice early on to let us focus on building our core product. It's a classic startup trade-off, and one we're scheduled to fix in the coming weeks.

I want to be clear, though: our customer-facing platform and all its data are and always have been 100% sovereign. Our infrastructure is totally independent of Big Tech.

Thanks for holding us accountable!


> Our infrastructure is totally independent of Big Tech

That's wishful thinking. You cannot be truly independent from them, no one can. They control major BGP routes, major ASN, big fiber cables, etc. It's just impossible


'If you wish to make an apple pie from scratch, you must first invent the universe.'

- Carl Sagan

They aren't going to cut the fiber cables if your Google accounts gets locked.


That’s fine. But as R_Spaghetti has kindly pointed out maybe you could try and convince your colleague to change the post to rather accommodate “… digital sovereignty is still just a phrase …” and then possibly add something like “and we are working to change that” :) Just a thought. Of course we all are free to talk anything we want, do anything we want, and definitely write and post anything we want.


Email is the one notable exception for self hosting. I self host everything, but let email be handled by 3rd parties.


Yeah I really will give people a pass here. The state of email is one of the worst collective mistakes I think we've made.

You can literally be an expert in everything relevant - and your mail will still not get delivered just because you're not google/mailgun/etc.

I was trying to do a very simple email-to-self use-case. I was sending mail from my VPS (residential IP not even allowed at all) which was an IPv4 i'd had for literally 2+ years to exactly only myself - my personal gmail. I had it all set up - SPF, DKIM, TLS, etc etc. And I was STILL randomly getting emails sent directly to spam / showing up with the annoying ! icon (grates on my sensibilities). I ended up determining - after tremendous, tremendous pain in researching / debugging - that my DKIM sigs and SPF were all indeed perfect (I had been doubting myself until I realized I could just check what gmail thought about SPF/DKIM/etc. It all passed). And my only sin was just not being in the in-crowd.

Incredibly frustrating. The only winning move is not to play. I ended up just switching from emails-to-self to using a discord webhook to @ myself in my private discord server, so I get a push notification.

And this was just me, sending to myself! Low volume (0-2 emails per WEEK). Literally not even trying to actually send emails to other people.


I'm self-hosting for 17 years and counting.

In my opinion, the pragmatic solution I use is:

1) use a specialized distribution (I use yunohost but there are others). This makes configuring SPF, DKIM, TLS and more a breeze

2) use a reputable relay to send your emails (I use OVH but again there are plenty of other choices)

Of course it means you are not "pure" because emails you send will go trough a 3rd party (the relay) but it solved the delivery issue entirely for me, so that I can continue to benefit from all the other benefits of self-hosting.


I'm self-hosting my mail server without a relay. It is still possible, you just need to be persistent. In the beginning Microsoft might just let your mails vanish and while they won't confirm this when you contact them doing so eventually resolved my delivery issues with their mail servers. With Google I didn't have any issues.


Do you run Yunohost in production? Did you consider Cloudron/Coolify/etc.? I use Yunohost for personal services, it's extremely robust, but has a few lacking features that you'd expect to have in more professional setups.


Self-host receiving email, even if you outsource sending it.


> This is not just a phrase, it is a DNS entry. Using the most evil in phrases of digital sovereignty.

damn, this guy don’t fuck around. respect


> TXT "google-site-verification=TTrl7IWxuGQBEqbNAz17GKZzS-utrW7SCZbgdo5tkk0" just to clarify, this part is not evil, it is just a compromise one makes to prevent Gmail from classifying outgoing email as spam (I think).


In red on your site: > Other Finance Apps: > Risk of sharing personal data with third parties In green: > Write-It-Down.com > Built on Google Sheets

I agree that putting your personal data into a free Google account indeed isn't a risk of sharing it with third parties. It is a guarantee.


[I have no personal involvement to this project, but I'll defend it anyway. And I am sure you knew what they meant, but still chose to write a pedantic comment]

If you use Gmail, Google Maps, YouTube etc, you already share a lot with Google; this spreadsheet is unlikely to make any different. If have managed to de-Google your life, good for you. Don't use this product either.

Other finance apps (I used to use mint.com before they shut down) require direct connections with your bank and investment accounts, generally via Plaid or Yodlee, and sometimes directly. This product avoids all that.

Now I personally don't think it's useful to me, since there are just too many expenses to keep track of, and doing it manually is too much work for me to even attempt. But privacy to Google would be pretty low on my list of concerns when using a spreadsheet.


How many expenses do you really have on a daily basis that they are too much to track? I don't like a spreadsheet for this since they have bad input UX on phones. I use a custom app I built and even though it is manual I don't really feel it since I have optimized the UX for n=1 and it just becomes a habit. I tried all these other automatic tracking apps like monarch money,mint,YNAB et al but they are just not real-time enough for me and don't keep me in touch as much, also the obvious data lock. Maybe I'll make it public someday but I haven't mostly because the common sentiment online is 'manual tracking is too much work' when it really isn't if you do it as you go vs all at once at the end of month etc.


Any meals/coffee/drinks outside, streaming subscriptions, gaming purchases, shopping, groceries, child activities, home services, mobile, gas + ev charging, home utilities, occasional cleaners, charity, hotels/flights, ubers....and there are probably things that I am missing.

Feels like a lot of work to me to track everything. And it's impossible to ask my partner to do the same.


Agreed, I’d pay for an Excel or LibreOffice Sheets version of this


I might just make one then :D



If you do, and you remember this comment, let me know :)


This is the reason why I'm reading this site - this is such a brilliant idea, super simple and without any vendor lockin at all.


It only works across Google shit.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: