Well, yes. Obviously. If "they" compromise at a level below what we are capable of seeing - for example baseband controllers on every brand of motherboard that we own, then there's nothing we can do about it. There's nothing anyone can do about that, including the theoretical "run my own email server from home".

So I don't waste much sleep worrying about that case, because there's nothing I could about it. We do everything we can to ensure security - for example airgapped internal networks with physically separate switching hardware rather than VLANs to avoid the risk of compromised switch firmware.

If that's still too much risk for you, the choice is to get offline entirely. We're not in that business, we're in the business of providing a really usable email service with the best security protections that we can provide without compromising the usability to the point that people won't use it.

Thanks for the plug. We definitely recommend that users who are concerned about security use GPG with our servers via the standard IMAP/SMTP protocols. We have very good standards support, and as others have pointed out in this thread - if we ran GPG server-side, you'd be delegating the security to us anyway, because we would see plaintext versions of your communication.

For the best security, you should definitely be running the encryption on equipment under your control (and not 0wned under you... which is your own lookout in that scenario)

We run encrypted channels between our datacentres - we're not trusting telco pipes to be private.

Oops, that was me - I managed to get logged out through not posting here for so long.

Cloudflare only helps with web.

Spamhaus - lovely, but the traffic is already coming down your uplink by then - we were already firewalling it all, doesn't help.

(FastMail Ops btw)

But we have a solution in place now, so we're in a lot nicer place than we were on Sunday when we were first hit.

Oh cool - can I have user ID 666 then, since you won't need it any more?

Anything that needs more than FB or SMS I just use email. My email delivers fast, and straight to my watch/phone/ipad/laptop:

https://www.youtube.com/watch?...

The watch is more convenient when it's on my wrist, but it doesn't film as well.

No, nobody has noticed that:

http://www.smh.com.au/business...

They're just imaginging things. The data says it's bullshit.

Yeah, indeed. Let me know when somebody has one of those that doesn't have a laughably small pentalty for Facebook if they change their mind and I will completely change my tune.

Honestly, I use FB's messaging interchangably with SMS. I don't expect to keep history of either of them. Anything I want to keep gets sent as email.

IRC is great for work. I don't use it for random people though. All my choir and gym friends are on Facebook, and coordinate things through there. I'm not going to cut myself off from that.

The core question with running on anybody else's platform, unless they are a regulated carrier somewhere which is required by a law to carry your traffic, is what happens when they change the rules?

Would you be comfortable building your entire business on top of it? What if Facebook imposes new limits or rules that mean you can't use it any more.

I had a conversation with a friend back in 2008-2009 some time over Facebook Messanger. We tried to find it last year. It rembered a chat we had in 2007, then nothing until 2010. It's not your own immutable copy the way that email is. Every new messaging platform claims it will kill email, but funnily enough they never do, because they don't offer what email offers - your own immutable copy and interoperability with everyone else. Email actually is the real distributed social network.

The coward might laugh at your storage cluster, but I'm laughing too, because I've heard this song before.

And every time I see another one of these, I am reminded why I run standalone replicas with the replication right up at the application level with integrity checks to ensure that a failure in one place doesn't wipe other things.

http://blog.fastmail.com/2014/...

People are right to laugh that a single bad disk can take your site offline for hours because the storage cluster software screwed up. I don't use heartbeat any more, because we found it was LESS reliable than our servers, and we had more downtime because heartbeat screwed up. Clusters and SPOF SANs fall right into the same basket in my mind - a single place where everything breaks.

I feel for your ops team, but like the others - I hope they learn the points-of-failure lesson from this.

See there it is - horse fucking. That's exactly the kind of slippery slope that the anti-gay-marriage people are fighting against.

(/sarcasm)

I was home-schooled untli year 11. I got 96/100 in the school system, which I considered to be a pretty good score (made me about 8th in a school of 500ish). My sister came through 3 years later and got a straight 100/100. She was also home-schooled until year 11.

The plural of annecdote is still at the opinion level here. Just like any schooling - it depends more on the method of teaching and the individual student than where the schooling is.

In my case, my parents mostly just left me to my own devices. They pointed me at the enclopedia and told me that most of what I needed was in there somewhere, and showed me how to use the index. This was mostly pre-internet. They also took us to the library frequently so we could have access to more books than they could afford.

Yeah, but it's probably about the same quality as what Galileo had, which might be kinda the point...