It takes only an hour or two to set up a decent Postfix/Dovecot server. It takes about a week to make it bulletproof. I monitor the logs and write custom filters to weed out the attacks de jour.

Did you know that SSL certs are free, now, through Certbot (courtesy of the EFF)? And there's a certbot app in the Ubuntu distribution that makes provisioning them a cinch. The down-side is you are limited to 50 unique certificates per IP -- per week...

Mine is pretty secure. I've been running UNIX type mail servers since the .uucp bang path days.

 

https://edition-m.cnn.com/2019/09/21/opinions/chinese-spy-trains-are-not-a-credible-threat-schneier/index.html?r=https://edition.cnn.com/

Your thinking is the wrongest possible. Everything can be escaped as long there is will for it, but you don't want to fight, to risk yourselves and you want someone to do it for you. When 5 million people go on a mutiny only God can stop them.

 

Your thinking is the wrongest possible. Everything can be escaped as long there is will for it, but you don't want to fight, to risk yourselves and you want someone to do it for you. When 5 million people go on a mutiny only God can stop them.

My thinking? ... I merely posted an article and a quote ... that doesn't mean that I actually endorsed it!

 

Another 5-eyes agreement.

https://www.dailymail.co.uk/news/ar...ted-messages-terror-suspects-paedophiles.html

The new treaty will see police and prosecutors submit requests for information to a judge while being overseen by the investigatory powers commissioner.

Both the US and the UK have agreed not to target people from each other's countries.

The UK has also assured that any information the US gets about British companies cannot be used in cases that may end in a death penalty sentence.

Most of personal secrecy message services use end-to-end encryption so the service providers don't have access to personal keys. This means that something like the threat of prison will be used to force key handover for individuals.

 

I have spent the last week setting up a new email server for my business to replace the one that has been serving me faithfully for the past 15 years (also built by me).

I could save a heck of a lot of time by hosting my email with Google or any other email hosting service.

But I refuse to do so. I simply don't trust any third parties with my confidential data. And I know Google (and many other hosting providers) reads all the mail that goes through their network.

My associates think I'm nuts to expend the time and effort to roll my own, but at least I can see all the traffic that goes through my box, I can personally manage data encryption, and I know that -- if anything ever gets somewhere it ain't supposed to be -- I can only blame myself.

And I do the same with my web and file servers.

New mail server complete and functioning.

Old mail server in the process of being decommissioned.

This is kinda cool (old server uptime):

08:39:58 up 869 days, 22:26, 1 user, load average: 0.00, 0.00, 0.00

 

New mail server complete and functioning.

Old mail server in the process of being decommissioned.

This is kinda cool (old server uptime):

08:39:58 up 869 days, 22:26, 1 user, load average: 0.00, 0.00, 0.00

One of my old engineering tftp, nfs and file servers for production machine backups.

 

One of my old engineering tftp, nfs and file servers for production machine backups.

Yeah, well, 869 days ago, the UPS failed.

 

Yeah, well, 869 days ago, the UPS failed.

Looks like I need some new hardware. My Linux desktop PC is pretty long in the tooth too.

I run the 'unstable' version of Debian on this machine so it's updated to the latest bleeding edge and rebooted frequently.

 

https://www.asiaone.com/asia/obsessed-fan-finds-japanese-idols-home-zooming-her-eyes

Japanese idol Ena Matsuoka was attacked outside her home last month after a fan figured out her address from selfies she posted on social media — just by zooming in on the reflection on her pupils, according to media reports.

 

https://www.justice.gov/usao-edny/p...management-charged-fraud-money-laundering-and

“As alleged, the defendants falsely claimed for years that their surveillance and security equipment was manufactured on Long Island, padding their pockets with money from lucrative contracts without regard for the risk to our country’s national security posed by secretly peddling made-in-China electronics with known cyber vulnerabilities,” stated United States Attorney Donoghue. “With today’s arrests, the defendants’ brazen deceptions and fraud schemes have been exposed, and they will face serious consequences for slapping phony ‘Made in the U.S.A.’ labels on products that our armed forces and other sensitive government facilities depended upon.” Mr. Donoghue expressed his appreciation to U.S. Army Criminal Investigation Command’s Major Procurement Fraud Unit for their work on the case.

“Greed is at the heart of this scheme, a reprehensible motive when the subjects in this case allegedly put into question the security of men and women who don uniforms each day to protect our nation,” stated FBI Assistant Director-in-Charge Sweeney. “There is no mistaking the cyber vulnerabilities created when this company sold electronic surveillance products made in the PRC, and then using those items in our government agencies and the branches of our armed forces. I cannot stress enough that we will do everything we can to search out and stop any other company willing to cut corners and pocket profits that endanger the lives of Americans, and make this country less safe.”

 

https://www.justice.gov/usao-edny/p...management-charged-fraud-money-laundering-and

I just bought a Samsung S10+ smartphone ... there is no way in hell I will ever, ever never buy Huawei ... no matter how much of a bargain or perky features it boasts...

 

I was expecting to see oriental names but it seems the Mafia is still alive and well in NY.

 

I was expecting to see oriental names but it seems the Mafia is still alive and well in NY.

Cabassos’ 70-foot luxury yacht, known as the Tranquilo

 

https://arstechnica.com/tech-policy...for-removing-police-gps-tracker-from-his-car/
Cops put GPS tracker on man’s car, charge him with theft for removing it

 

https://www.eff.org/deeplinks/2019/...rt-rules-police-cant-force-you-tell-them-your

The Pennsylvania Supreme Court issued a forceful opinion today holding that the Fifth Amendment to the U.S. Constitution protects individuals from being forced to disclose the passcode to their devices to the police. In a 4-3 decision in Commonwealth v. Davis, the court found that disclosing a password is “testimony” protected by the Fifth Amendment’s privilege against self-incrimination.

 

https://www.eff.org/deeplinks/2019/...rt-rules-police-cant-force-you-tell-them-your

That's excellent news. Thanks for sharing.

 

That's excellent news. Thanks for sharing.

I still believe there are circumstances that serve the public good, whereby access to devices is necessary. But it should be difficult. Perhaps the following scenarios should be allowed (there may be more):

• Law enforcement presents unimpeachable evidence that a device contains evidence of malfeasance;
• The device may be required to be relinquished to law enforcement. Subsequently, law enforcement may be allowed to break in without the abandonment of a password or other personal security methods;
• Forced identification of all public identities without disclosure of security information. There is no protection for alternate identities under law

 

• Law enforcement presents unimpeachable evidence that a device contains evidence of malfeasance;
• Forced identification of all public identities without disclosure of security information. There is no protection for alternate identities under law

US jurisprudence presupposes innocence. The state must prove one's guilt -- without one's help.

It is better that ten guilty persons escape than that one innocent suffer.

 

US jurisprudence presupposes innocence. The state must prove one's guilt -- without one's help.

That principle applies in court cases. A different standard applies in the investigation phase. A likelihood of law being broken is sufficient for the issuance of a warrant.

I note that you omitted my second scenario. What was your reason for that?

 

I still believe there are circumstances that serve the public good, whereby access to devices is necessary. But it should be difficult. Perhaps the following scenarios should be allowed (there may be more):

• Law enforcement presents unimpeachable evidence that a device contains evidence of malfeasance;
• The device may be required to be relinquished to law enforcement. Subsequently, law enforcement may be allowed to break in without the abandonment of a password or other personal security methods;
• Forced identification of all public identities without disclosure of security information. There is no protection for alternate identities under law

Absolutely not. The simple fact is that physical/mental violence and loss of liberty are the tools used to force a persons private thoughts into the public when they resist. When that happens to private citizens in this country there needs to be legal accounting In extremis or not. I'm not saying those tools should never be used but they should be extralegal in all cases of private thoughts unless you have signed a specific waver of rights.