Month: March 2014

When I posted about how I thought adding tagging tools to Keyboard Maestro was going to be a big deal, I hadn’t even used it yet — so here’s my first macro to use them. For me the biggest part is the fact that I can now start to use tags because I can quickly add them, whereas before it was far too much clicking of the mouse to tag files.

Here’s the setup:

And here is the one to remove all tags:

There are currently four options for working with tags:

• tags : This sets the tags to a specific set, hence leaving it blank removes all tags.
• tags (add) : Think of this like append, as you aren’t changing the existing tags, but appending one or more new tags to the list.
• tags (toggle) : As the name suggest this will toggle on and off one or more tags. I am actually thinking of changing my macros to use this method, but for now I am not. I want to see if my way has conflicts or not and I am not sure I want tags turned off if I blindly apply a tag to a list of files.
• tags (remvoe) {That typo is in the app, not mine.} : This removes a specific tag.

All in all Keyboard Maestro has fixed the biggest drawback to using tagging instead of folders: mouse management of tags. I think this will getting me using tags a lot more.

UPDATED (on Apr 2, 2014): The macros were updated after the developer told me I was doing it the long way.

Marco Arment recommends moving to FastMail to ease our email privacy woes:

I continue to recommend buying your own domain and pointing it at either your own IMAP server or a dedicated, paid, standard IMAP host. (I’ve used Fastmail for 7 years and have no complaints.)

Eighteen months ago I moved all my email hosting from Google Apps to FastMail. It was becoming clear that Google sometimes kills free services that people rely on. It seemed safer to pay a company that focuses on hosting Email, a company that isn’t distracted by building self-driving refrigerators or deep-sea Internet balloons.

I hate maintaining infrastructure, which ruled out running my own mail server. At the time, the only paid hosts with kudos seemed to be Rackspace and FastMail. Marco Arment recommended FastMail. Nobody recommended Rackspace. I chose FastMail.

Switching from Gmail to FastMail was simple, just a few DNS records to change. ((The only complication was having two domains in one FastMail account, which meant using “personality aliases”. Receiving email from several domains into a single FastMail account is easy but sending from a different personality requires some slightly obscure setup.))

Since switching there’s been no noticeable down-time. Email seems to be delivered promptly and spam filtering seems as good as Gmail.

Is switching from a free email host worth the effort? Does switching for privacy reasons make sense?

There are two big problems with Email privacy, one is identity; how do you know that only the intended people are reading your message? How do you know that the sender of an Email is who they claim to be?

The second problem is that almost all Email is sent over the open Internet in plain-text, which can be read by anybody with access to a server on the path from sender to recipient. Do you trust all of them?

Unless we start building personal trust networks (exchanging and verifying public/private keys) and encrypting our email, then we should probably give up on email privacy. When communicating in plain text over the public Internet we should assume that our messages are being read by third parties.

It doesn’t matter if we self host, pay a dedicated Email host with a simple privacy policy or use a giant advertising-supported technology company’s Email service for free. Email privacy without encryption and trusted, verified identity is an illusion.

Google and Microsoft are big companies with shareholder mouths to feed, and they make money by doing amazing things with data and selling those data to advertisers. I don’t begrudge these business models, but they complicate our provider-consumer relationship because now we’re sandwiched between the advertisers and the email host. Suddenly it’s a love triangle.

We know that advertisers pay handsomely to put their products in front of us. The free-to-use, ad-supported email host knows that the content of Emails allow them to show more relevant ads. That’s a more valuable service to both consumers and advertisers.

But complicated relationships become tiring. What used to be a simple exchange of personal data for services begins to feel creepy.

My relationship with Google reminds me of the sequence in the film Groundhog Day where Phil (Bill Murray) spends many Groundhog days learning everything he possibly can about Rita (Andy MacDowell) in an attempt to get her into bed. By the end of the sequence Phil is trying so hard to impress Rita by using what he’s learnt about her that he comes off as a phony. Instead of making him more effective at selling himself to Rita, Phil’s targeted advertising just makes their interactions feel forced and he seems increasingly desperate and creepy.

FastMail’s business model and privacy policy is simpler. My relationship with them is simpler. FastMail provide email hosting. I pay them money. They only read my email in order to prevent spam and provide a good service, so they say.

To force the Groundhog Day metaphor, my relationship with FastMail feels more like Phil and Rita at the end of the movie, when Phil gives up his incessant data collection and starts using all his time to make other people’s day as great as possible. Rita falls for him because he’s turned into this genuine, cool (freakishly talented) guy.

Can I trust FastMail with my privacy? It’s an Australian legal entity, which is harder for U.S. and U.K. intelligence services to bully. FastMail’s privacy policy says it will turn over my data to law enforcement if ordered by a federal warrant issued by an Australian judge, which is comforting, but in 2013 Telstra proved that at least one Australian company is willing to assist foreign intelligence services without a warrant.

When I emailed FastMail to ask about its history with warrants and whether it discloses requests to customers, director Richard Lovejoy replied:

We receive a very small volume of warrants, and currently I deal with them all personally. They are virtually all connected to ongoing criminal investigations, and often we are prohibited from notifying the user. In the cases that we are allowed to, I would normally send an email to the user concerned.

I can only take FastMail at its word. I’m still sending Email in plain-text and hoping that nothing I write incriminates me or lands me on some government blacklist. The main difference between FastMail and free email services is that FastMail’s entire financial success rests on people trusting it enough to continue paying for email hosting. No company that sends and receives plain-text messages on your behalf can guarantee your privacy but you have a choice. You can date the sincere nice-guy or the creepy, polyamorous show-off.

One of Michael Lopp’s travel tips:

My travel tip is this: every three months, sit down on the floor of your office, take whatever bags accompany you around the planet, open them, and pour the contents on your floor. From there, you are making two piles: shit you need and shit you think you need. My advice: obvious need is easy, and if there is any question in your mind regarding need, put it in the other pile.

I apply this tip to my bag I carry everyday, and do this about every month. I dump it all out and figure out what is unnecessary crap accumulated in my bag from a one time need. I lose a lot of junk every month, junk which would have otherwise kept accumulating. In fact, one thing that is nice about testing new bags is that I clean things up more often.

It takes me about 10 minutes to dump it all out and put it back together, and I’d still do it if it took me thirty minutes.

Richard J. Anderson takes a contrary stance about my post the other day, saying:

I’m really not happy about the idea of my government poking through my email either, but I’m not going to blame Google for that. We can address these issues, and educate people about what they’re giving up when they sign up for free email services, without the intolerable air of technological privilege. I suggest people like Ben Brooks try that, before being smug about how secure his ivory tower is.

Anderson is upset with the fact that I have “an intolerable air of arrogance around their idea of self-hosted email”. That’s fun.

For reference, the entirety of my arrogance was:

So, unless you are totally fine with your email being accessible to the government, and the company hosting it, I suggest you go host it yourself.

In fact I would argue the most arrogant part of my post was:

I personally don’t even like emailing people who use Gmail.

That’s an arrogant statement for sure. But I don’t see how I am arrogant because I pointed out the flaws with not self-hosting your email. Even Anderson concedes:

We can address these issues, and educate people about what they’re giving up when they sign up for free email services, without the intolerable air of technological privilege.

Pretty sure all I did was point out the issue. Now, on to his real beef: that it is somehow hard to setup email hosting for yourself. If you can edit HTML, you can setup your own email, and keeping the server patched is dead simple.

Actually the worst part of hosting your own email is the cost of it all.

Don’t take me to task over the idea of technical difficulties, because hosting a Mac mini at macminicolo.net and setting up email is almost trivial work (with millions of easy to follow guides and ready help) — no — take me to task over suggesting everyone buy a Mac mini to host their email on.

I haven’t set up Fastmail ((I’ve asked a buddy to write something about it for me.)) , but I am guessing setting up your own email server and setting up Fastmail is just about the same level of technical skills. That is: DNS changes and clicking things while following instructions.

Using OS X Server to host your emails was the easiest part of setting up the Mac mini server — truly. I don’t know how to do it on linux/unix, but I am sure there are a few guides out there.

Two more things before I let this go:

1. I don’t expect everyone to do this, as I said, I only expect those that care about their privacy to do this. If you don’t have the money, encrypt your email — again that’s not nearly as hard as people think it is. ((GPG for Mac Mail is dead simple to use. In Linux the setup is only a touch harder. The real hard part is just learning the terminology for the setup. Again, guides.))
2. Anderson says that if you don’t keep your server in your possession it isn’t secure. Actually, if it was in your home it’s not that secure, as your home is likely easier to break into than the secure data center my server is in. And yes, that means the Government could get to it, but I keep the email database encrypted for just that reason. It’s not perfect, but it is just about as good as it gets.

There is no fool proof email hosting setup, as you are always at the mercy of the person receiving your emails and how they store their end of the chain. There is a real, true, and active risk with hosting with Hotmail and Gmail right now — both companies can turn over your data without telling you, and actively mine your data for their own gain — that’s dangerous if you ask me. The only way around that, the only solution I like, is to host email yourself.