TL;DR: Haven’t posted since July but I wasn’t slacking, got temporarily context-switched out of opensource stuff. I tanked a year in work psychology # As some of you know, I study work psychology and have been attending evening classes for the last four years, sometimes up to 9 hours / week and more often between 3 and 6 hours / week. I’m pretty invested as you can tell, it’s a lot of time that I could spend in bed but that I spend in class instead :-)
TL;DR: worked on my webmail, on a custom MDA and on a python framework for API development. Worked on my webmail # Again, I’d like to emphasize that this is something that’s going to span over many months so… don’t hold your breath.
TL;DR: Reworked my infrastructure at poolp.org, implemented folder pinning, worked on my webmail. poolp.org infrastructure rework # I decided to move my servers from online.net to vultr.com (affiliation link).
TL;DR: Worked on the OpenSMTPD 6.7 release; Did a lot of work on the new table API; Wrote several PoCs; WARNING:
Examples of code and configuration that appear in this article are here to help illustrate and explain development stages of my work.
TL;DR: Worked on my webmail; Did a bit of OpenSMTPD work; Webmail vs mutt # I started using console clients to read my mail back when I was a student in early 2000s, and I’ve been using mutt for as long as I can recall now. I installed various mail clients along the years, some with graphical interfaces such as thunderbird or sylpheed, others with a web interface such as nullWebmail, SquirrelMail, Roundcube, Mailpile or currently Rainloop. No matter which, I always end up falling back to mutt for most tasks.
TL;DR: - Qualys released an advisory for a bad, bad vulnerability - an MTA is a very bad software to have a vulnerability in - hole was plugged but that's not enough, similar bugs should be mitigated in the future - article discusses what could have prevented escalation despite the bug What happened ? # Qualys contacted by e-mail to tell me they found a vulnerability in OpenSMTPD and would send me the encrypted draft for advisory.
TL;DR: - brought back libasr to OpenSMTPD, it is no longer an external dependency - libtls-enabled OpenSMTPD is now a thing - documented filters and improved reporting No shiny feature this month, ungrateful work # OpenSMTPD has had quite a few features implemented since its latest major release. As we get closer and closer to the next major release, my work on new features will slow down to focus more on getting the release in shape.
TL;DR: - wrote, reworked and translated multiple articles this month - got some goodies ready for my patrons - lots of work in OpenSMTPD's grammar, documentation and filters protocol WARNING:
TL;DR: - SMTP is the way computers exchange e-mails - it is a decentralised protocol meaning that ANYONE can run a node and be independant - it is being centralised at companies that have a history of abuse - it is being centralised in a country that has a history of abuse Where did you read this already ? # In August, I published a small article titled “You should not run your mail server because mail is hard” which was basically my opinion on why people keep saying it is hard to run a mail server. Unexpectedly, the article became very popular, reached 100K reads and still gets hits and comments several months after publishing.
TL;DR: - greylisting is a sound idea - yet it is not really practical today - people tend to disable it or find work-arounds - SPF-aware greylisting makes greylisting usable again SMTP failures in a nutshell # SMTP is a fail-safe protocol which attempts very hard to ensure that messages do not get lost once they are in transit. Among the various mechanisms and requirements in place is the use of “Temporary Failures”.
