Hacker News new | ask | show | jobs
by bad_user 2886 days ago
The takeaway for the rest of us is that you should never depend so much on one big company. Put your eggs in multiple baskets, preferably the smaller players (but not too small, as that might mean incompetent).

E.g. my email, calendar and contacts are at FastMail with my own domain, cloud storage is at Dropbox but looking to migrate to pCloud (after their recent fiasco). For notes I use Evernote, but investigating Standard Notes. I also don’t buy DRM-ed books or other products, e.g. I buy DRM-free audio books from Downpour. I have a Spotify account but I regularly buy the music I like. I have an iPhone but I’ll be damned if I’ll let Apple dictate my web browser therefore I use Firefox and apps that play along with it.

My Google and Microsoft accounts are basically unused. I use Docs at times but I regularly back them up automatically. I don’t even use Google’s Search anymore. I have some apps purchased for Android but I stopped using Android for now. If they block me for anything, I couldn’t care less.

These companies that have products in multiple markets are after lock-in of their users by any means necessary. Don’t fall into that trap. The alternatives cost more, but your freedom and privacy are worth it.

7 comments

> For notes I use Evernote, but investigating Standard Notes.

I am a (former) Evernote employee. Before I joined I didn't use Evernote. After I left I started using Evernote extensively (Hard to use the app when you are constantly messing up your test account doing dev work :-) )

From my experience there I know that:

1) the people there really care about the customers. If there is any sort of problem, the customer support will really go to bat for the customer. There are more than a few times where CS ensured that a bug fix made it in.

2) If there is any sort of data corruption, Evernote will stop the weekly release to get back the data before doing the next release.

3) You can get a hold of a live human being to get support

4) Evernote has a explicit policy of never going to an ad model.

5) User privacy is highly important.

6) User security is highly important - if Evernote had a choice between Evernote as a company getting hacked or a user (not even a customer) getting their account hacked. Evernote errors on the side of protecting the users' security.

Please reward this positive company by paying for the product - that is their only revenue source :-)

I have been rewarding Evernote, I'm a Premium user and I like the service a lot.

But the thing I miss with Evernote is the ability to create end-to-end encrypted notes. I don't necessarily want all notes to be encrypted, just some.

I hope they add this capability.

I don't know current priorities but I do know that such a feature is strongly under consideration.

The major barrier (as I recall) is getting such a feature to play nicely with multiple installed clients and the web client.

I'm not familiar with Fastmail - do you find it comparable in terms of usability to say, Google Calendar?

I'm interested in switching away but nothing I've found beats Gsuite in terms of ease of use, and paying for Gsuite for my domain means I don't have my data pawed over like plain gmail accounts are.

FastMail's Calendar is pretty OK for my needs. Google Calendar is better though. But I don't miss it.

Personally I found it hard to migrate to G Suite after being off for about 3 years and couldn't do it.

For example FastMail is less featured, but the web interface is really responsive and the keyboard shortcuts are better. Whereas Google Admin is a nightmare and GMail has gotten really sluggish in the latest iteration for no good reason.

GMail has labels, many people are addicted to those. But regular IMAP folders play better with desktop email clients and I prefer desktop clients. GMail's labels are cool for classifying stuff (e.g. My Projects), however IMAP folders are good for separating the junk. For example I don't want Mailing Lists in my archive.

G Suite has many limits that bother me that do not apply to FastMail:

- Limits maximum IMAP connections to 15: https://support.google.com/mail/answer/7126229?hl=en

- Limits bandwidth: https://support.google.com/a/answer/2751577?hl=en

- Limits maximum number of user aliases to 30: https://support.google.com/a/answer/33327?hl=en

I have hit all of these limits at some point.

FastMail works with something called "sub-domain aliasing". So if you have `user@domain.com`, you can come up with addresses on the fly, like `google@user.domain.com`. I do that for every online service I use. And the web client is friendly to that too. E.g. you can define "wildcard identities" or you can set certain identities to be used per folder.

Sadly Gmail only supports "plus aliasing". This is weaker because it's easier to remove the alias and because many websites, including big names, do not accept "+" as a valid symbol.

You can configure G Suite to redirect all email via a regular expression, so you sort of have it, however it doesn't work if you want to also send email, which you need to reply for support and stuff. This is because Gmail will not sign your emails with DKIM unless the email is a genuine user alias, no dynamically created email addresses allowed, except for plus aliasing.

Speaking of which, even when you send from a legitimate user alias in GMail, GMail will leak your primary email address via the Return-Path and other email headers. This means that user aliases in GMail do NOT work for maintaining privacy. For example one practice I have is to create a throw-away email address that I put on my blog. I don't want my email to get in the hands of spammers via my website. And I get contacted via it and sometimes I reply. Personally I don't want my primary email address to leak when doing that, but that's what GMail does. And I'm not even mentioning that adding email aliases is freaking painful, as you have to add it once in Google Admin and a second time in GMail's web interface.

Basically GMail is useless if you want to have multiple email aliases.

Another use-case I have for FastMail is to send email from my own VPS. I have two VPSs actually and I want them to send emails on important events. FastMail allows me to set a "SMTP only" password. And in case my VPS gets compromised, theoretically at least the attacker will not have access to my email archive. And FastMail's limits on sending email are pretty relaxed. You can send notification emails from your own VPS without worry. Just don't send spam as they'll probably react to that.

It's ironic, but for all of GMail's praise, it's actually pretty bad at handling email.

Also, not sure what exactly you're using from G Suite, but Google Drive is absolute trash for synchronizing files, including its File Drive Stream, its latest iteration. I've seen it ignore updates, I've seen it generate conflicts, I've seen it corrupt content. Google Drive is good for its web functionality, but you can't rely on it to actually copy your files. If I fear the desktop sync will corrupt my files, then I cannot use it, sorry.

> GMail will leak your primary email address via the Return-Path and other email headers.

Hmm, I just now sent from a Gmail alias to a non-Google account. Don't see my primary address anywhere in the received headers.

Could the circumstances under which you see leakage be specific to some particular use case?

I'm on mobile right now so I can't be bothered looking it up, but the fastmail devs mentioned here a week or two ago that they're working on labels. So if you like that feature it's coming :)
I used to think labels were a great advance.

Now I see a better alternative: Powerful pattern search, with a store of the patterns for later reuse.

Fastmail has this, and reference documentation is excellent:

  https://www.fastmail.com/help/receive/search.html
Minor GUI annoyances: Advanced search not obviously discoverable, list of saved searches scales poorly.
Fastmail sounds alright, but realistically whoever your e-mail provider is you're in trouble if they go away.
Use your own domain at the very least. Preferrably one that is your legal name so that if anyone ever tries to take it (either from just buying it if it lapses, or just attacking it/you) you have some legal protection in the US from the ACPA.

Then it's just a matter of keeping backups of your email.

Agreed. I use my own domain and I use my providers email forwarding to a sass email client. If my email provider pisses me off I just change my forwarding to some other provider. I may lose old mail, if the provider goes away completely, but that's not too big a deal for me and backups could solve it if it was important.

Now, if my domain host goes belly up, I'll probably have a somewhat painful process of porting my domains elsewhere. It's still doable but it would probably mean a few days of downtime.

only use your own domain if you want everything tied to your real name
I have my own domain and I use desktop email clients, so I always have a full copy of my email archive.

It would take me at most 1 hour to move, on the clock. I know because I moved between email provides about 3 times already.

("imapsync" helps)

Its trivial to backup your important emails offline as they come in. Any time you allow a 3rd party to control your data or your property (digital or physical) you are taking a chance. One of many reasons "the cloud" is overrated and overhyped. There may be reasons to use cloud computing, such as the convenience, but shared data-space always remains inherently insecure and anything stores there is, by definition, outside of your control.
The nice thing about a custom domain however is all you have to do is repoint it to a different provider if that happens.
Until your domain gets pulled off by your registar for whatever weird reason. There's no absolute way to escape, sadly.
I agree with that, but the distribution of where you have things makes it a bit more difficult. If I have amazon hosting my domain, email, website, and I shop there, then me getting banned because they didn't like me returning too many things will affect everything else. Having my domain at No-IP, Email at fastmail, website self hosted means that Microsoft banning an account I use won't affect any of that.
If your domain gets stolen then you're similarly out of luck. You now need to change your email on every website you use, which for many requires email confirmation or contacting support.
The chances of losing your domain are lower than your chances of becoming a false-positive of one of these Saas account-banning automations.
The sky is falling :-)

But no, we are not talking about the same degree of risk.

You're comparing car rides with BASE jumping.

That’s why I host my own Email. Maybe after more of these random, unaccountable unappealable accounr bannings happen, people will wise up and stop relying on cloud services for essential things.
Tried hosting my email too. Not worth the hassle. Too much work to set it up, then to keep your domain or your IP out of blacklists, to take care of your reputation, etc.

You can host your own email just like you can generate your own electricity. It's definitely worth it for other people and we definitely need more people that self host to keep email an open standard, but personally I've got better things to do.

I agree that it’s hard. I justify the effort spent because my email access is essentially my single source of failure credential for the rest of my online life. Some things that are important are hard.
> an iPhone but I’ll be damned if I’ll let Apple dictate my web browser therefore I use Firefox and apps that play along with it

AFAIK all iOS web browsers must use WebKit so really are little more than a shell on top of Safari.

Indeed, but I keep my browsing history, bookmarks and everything else in Firefox, which I also use on all my 3 laptops, so it synchronizes between them.
How do you back up your Google account automatically?
A cron job with rclone. Converts and copies Google Docs too.

https://rclone.org/

What was that Dropbox recent fiasco?
What fiasco?
TL;DR: they don't give a shit about privacy.

https://hbr.org/2018/07/a-study-of-thousands-of-dropbox-proj...

Quote:

> Dropbox gave us access to project-folder-related data, which Dropbox had aggregated and anonymized, for all the scientists using its platform over the period from May 2015 to May 2017 — a group that represented 1,000 university departments (from the top 100 universities and their Dropbox collaborators from other anonymized universities of any rank).

This was done without the consent of those involved.

Wired seems to cover the story: https://www.wired.com/story/dropbox-sharing-data-study-ethic...