Re: Certificate Postfix.org missing?

[Viktor Dukhovni]

> On Apr 26, 2021, at 8:25 PM, @lbutlr  wrote:
> 
> It's not the 1990s, encryption and decryption overhead of a stream is not an 
> issue, and is more than made up by the fact that the headers and HTML are 
> compressed binary blobs instead of sent as plain text.

The Postfix web server returns rather compact headers, while the
TLS handshake adds at least one extra round-trip, and the certificate
size likely more than makes up for any header compression.

Sorry, TLS being faster than cleartext is largely a marketing myth.

Now let's return to talking about Postfix...

-- 
Viktor.

Re: Certificate Postfix.org missing?

[@lbutlr]

On 26 Apr 2021, at 17:05, Jaroslaw Rafa  wrote:
> Dnia 26.04.2021 o godz. 23:06:49 Allen Coates pisze:
>> 
>> Also, I understand that HTTPS downloads are a touch faster...
> 
> What should be the reason for HTTPS downloads being faster when HTTPS requires
> additional encryption and decryption on both sides, which takes CPU time...?

It's not the 1990s, encryption and decryption overhead of a stream is not an 
issue, and is more than made up by the fact that the headers and HTML are 
compressed binary blobs instead of sent as plain text.

-- 
"Are you pondering what I'm pondering?"
"I think so, Brain! How much deeper would the ocean be if there
weren't sponges down there?"

Re: Certificate Postfix.org missing?

[Jaroslaw Rafa]

Dnia 26.04.2021 o godz. 23:06:49 Allen Coates pisze:
> 
> Also, I understand that HTTPS downloads are a touch faster...

What should be the reason for HTTPS downloads being faster when HTTPS requires
additional encryption and decryption on both sides, which takes CPU time...?
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[Allen Coates]

On 23/04/2021 07:36, Nicky Thomassen wrote:
> With the risk of going off-topic, I do not see the reason for encrypting
> everything on the internet from a more practical point of view, as it just 
> gives
> overhead: It takes time to set up and maintain, takes processing power on both
> ends, and in the case of Postfix, makes no sense since there is nothing to
> protect.
> 
> Encryption gives (ideally) authenticity, confidentiality and integrity
> https://en.wikipedia.org/wiki/Information_security#Basic_principles
> 
> But there is no need for that on a read-only site like Postfix'. In my 
> opinion,
> anyway.
> 

The certificate ensures AUTHENTICITY.  Users can be sure they are seeing the
GENUINE Postfix site.  You PGP-sign software downloads for the same reason.

Also, I understand that HTTPS downloads are a touch faster...

My vote is in favour of HTTPS.  :-)

Allen C

Re: Certificate Postfix.org missing?

[Jos Chrispijn]

IL Ka:


I believe this is about http://www.postfix.org/ 
There is no https there.


That's the one I meant, sorry I didn't include the www subdomain.
I expexted www always to be included as a subdomain name as you can't 
predict which URL users will type in their browser's URL bar.


Best, Jos

-- With both feet on the ground you can't make any step forward

Re: Certificate Postfix.org missing?

[Kris Deugau]

Sven Schwedas wrote:

On 23.04.21 08:36, Nicky Thomassen wrote:
But there is no need for that on a read-only site like Postfix'. In my 
opinion,

anyway.


It's only a read-only site as long as there's no man in the middle 
attack injecting malicious code into the connection. There's too few 
people who disable things like Javascript by default, and that battle is 
well and truly lost as far as the general public is concerned, so we 
need defence in depth measures to protect people from their own laziness.


This.

It's not just inserting malicious JS;  some of the big US providers have 
inserted ads (or overridden a site's existing ad slots, effectively 
stealing such revenue as may or may not have been made by the visited 
site), and did so at the pure HTML content level.  HTTPS at least 
protects the end user against their own ISP or any other unethical 
fingers with access to the connection path.


Dedicated tin-foil-hat-wearers can no doubt spin off far more sinister 
possibilities for this kind of in-flight alteration of web content.


-kgd

Re: Certificate Postfix.org missing?

[Phil Stracchino]

On 4/23/21 9:26 AM, Jaroslaw Rafa wrote:
> Dnia 23.04.2021 o godz. 08:27:31 Phil Stracchino pisze:
>> On 4/23/21 5:15 AM, Jaroslaw Rafa wrote:
>>> However, "thanks" to Google and other
>>> big e-mail providers who started to enforce that EVERY email send to them
>>> must pass SPF/DMARC check - as a method of "antispam protection" (which it
>>> isn't, because spammer can have a perfectly valid SPF/DMARC setup) - 
>>
>> Well, yes, they can, but they can't send mail to you claiming to be from
>> your bank's domain without it failing SPF and/or DMARC checks.  So it IS
>> a perfectly valid anti-spam measure.
> 
> Anti-spoofing, not anti-spam. That's exactly what I wrote.


OK, point.


-- 
  Phil Stracchino
  Babylon Communications
  ph...@caerllewys.net
  p...@co.ordinate.org
  Landline: +1.603.293.8485
  Mobile:   +1.603.998.6958

Re: Certificate Postfix.org missing?

[Richard Damon]

On 4/23/21 9:26 AM, Jaroslaw Rafa wrote:
>
> All these emails can - and usually do - perfectly pass SPF/DMARC check. So
> it is a huge mistake to treat SPF/DMARC as an anti-spam measure and a
> positive SPF/DMARC check as an indicator that the message is not spam. It
> has nothing to do with the message being spam/non-spam.

My comment to this is that yes, if they setup their system to pass
SPF/DMARC, then it will pass that test. But then you can use classic
reputation of domain to decide that this is likely some unknown spammer,
and maybe even after a bit (since it has SOME cost to setup the domains,
they will tend to reuse them) you can be sure those messages are spam.
It also says that user side 'block' lists become usable again, as every
message won't have a totally new domain.

Yes, positive SPF/DMARC check by itself doesn't mean a lot, just that it
allows other tests to means something.

-- 
Richard Damon

Re: Certificate Postfix.org missing?

[Jaroslaw Rafa]

Dnia 23.04.2021 o godz. 08:27:31 Phil Stracchino pisze:
> On 4/23/21 5:15 AM, Jaroslaw Rafa wrote:
> > However, "thanks" to Google and other
> > big e-mail providers who started to enforce that EVERY email send to them
> > must pass SPF/DMARC check - as a method of "antispam protection" (which it
> > isn't, because spammer can have a perfectly valid SPF/DMARC setup) - 
> 
> 
> Well, yes, they can, but they can't send mail to you claiming to be from
> your bank's domain without it failing SPF and/or DMARC checks.  So it IS
> a perfectly valid anti-spam measure.

Anti-spoofing, not anti-spam. That's exactly what I wrote.

SPF/DMARC does nothing to a typical spammer that does not pretend that he's
someone else than he is, but just uses spam as a shitty method to advertise
their product, whatever it is. And huge majority of the thousands of spams I
have ever seen in my life fall into that category. They try to sell crappy
SEO services, "shady" financial services for companies, they are selling
e-mail addresses lists for another wannabe spammers etc. "Regular" products,
like for example car accessories or fashion, are also advertised this way. I
have even seen a spam advertising... antispam software! (it was probably not
worth giving a try ;)). Of course, there are also straightforward frauds
like "Nigerian" scheme or "Russian woman looking for husband". But all those
people do not try to use someone else's email address, they usually use
existing e-mail addresses created specifically for the purpose of spamming,
because they want to get replies from their "targets".

All these emails can - and usually do - perfectly pass SPF/DMARC check. So
it is a huge mistake to treat SPF/DMARC as an anti-spam measure and a
positive SPF/DMARC check as an indicator that the message is not spam. It
has nothing to do with the message being spam/non-spam.

SPF/DMARC protects from impersonation. Negative SPF/DMARC check is a sign
that the message may be (but not necessarily actually is) not really coming
from the sender it claims to come. Only that. Therefore - as I wrote - it
should be used to protect email from selected domains. One important
requirement should be that these domains send mail *only directly to their
customers*. Usually this applies to automated, "transactional" email like
signup confirmations, password change links, purchase notifications from
e-shops, bank account statements etc. It should *not* be used for domains
that have real, human e-mail users who can for example participate in
mailing lists.

This topic has been already discussed millions of times, but - as said -
"big" providers are forcing it their own way. They are viewing the entire
Internet as a world of e-commerce. From that point of view, if all websites
are e-commerce, then the encryption on each website is necessary. If all
e-mails are transactional (sent only as a result of e-commerce activites),
then SPF/DMARC on any e-mail is necessary. But in reality the Internet is
not as they imagine it to be. Not yet. But by forcing us to adopt the
practices they "invented" they are more and more pushing towards that vision
- Internet being a huge marketplace only, nothing else. :(
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[Phil Stracchino]

On 4/23/21 5:15 AM, Jaroslaw Rafa wrote:
> However, "thanks" to Google and other
> big e-mail providers who started to enforce that EVERY email send to them
> must pass SPF/DMARC check - as a method of "antispam protection" (which it
> isn't, because spammer can have a perfectly valid SPF/DMARC setup) - 


Well, yes, they can, but they can't send mail to you claiming to be from
your bank's domain without it failing SPF and/or DMARC checks.  So it IS
a perfectly valid anti-spam measure.


-- 
  Phil Stracchino
  Babylon Communications
  ph...@caerllewys.net
  p...@co.ordinate.org
  Landline: +1.603.293.8485
  Mobile:   +1.603.998.6958

Re: Certificate Postfix.org missing?

[Sven Schwedas]

On 23.04.21 08:36, Nicky Thomassen wrote:

But there is no need for that on a read-only site like Postfix'. In my opinion,
anyway.


It's only a read-only site as long as there's no man in the middle 
attack injecting malicious code into the connection. There's too few 
people who disable things like Javascript by default, and that battle is 
well and truly lost as far as the general public is concerned, so we 
need defence in depth measures to protect people from their own laziness.


Setting up HTTPS is trivial to anyone technically competent, and browser 
vendors *know* they cannot require them to cost money, so they're 
overall a net positive.




OpenPGP_signature
Description: OpenPGP digital signature

Re: Certificate Postfix.org missing?

[Jaroslaw Rafa]

Dnia 23.04.2021 o godz. 08:36:36 Nicky Thomassen pisze:
> 
> With the risk of going off-topic, I do not see the reason for encrypting
> everything on the internet from a more practical point of view, as it just 
> gives
> overhead: It takes time to set up and maintain, takes processing power on both
> ends, and in the case of Postfix, makes no sense since there is nothing to
> protect.
> 
> Encryption gives (ideally) authenticity, confidentiality and integrity
> https://en.wikipedia.org/wiki/Information_security#Basic_principles
> 
> But there is no need for that on a read-only site like Postfix'. In my 
> opinion,
> anyway.

You are totally right, but I think the main reason for encrypting everything
is just the pressure from browser developers trying to enforce this. For me,
it is like someone started to imagine ALL websites being e-commerce (or
similar) websites, where you have to process your private data, so
encryption is needed. Like someone forgot about existence of publicly
available, purely information-oriented websites, where there is nothing to
encrypt...
(For example, the Wikipedia link you quoted above is HTTPS. What is there on
publicly available site like Wikipedia - except maybe your login
credentials, if you have an account there - that needs encryption? ;))

Going back on-topic :), I think that somewhat similar situation is with use
of SPF and/or DMARC. To my knowledge, SPF/DMARC was never meant for
"general" use. It has been invented as a way to protect particular
"sensitive" sender domains (eg. the domain from which you get e-mails from
your bank) from being easily spoofed. However, "thanks" to Google and other
big e-mail providers who started to enforce that EVERY email send to them
must pass SPF/DMARC check - as a method of "antispam protection" (which it
isn't, because spammer can have a perfectly valid SPF/DMARC setup) - people
were forced to adopt it universally, whether necessary or not (which for
example causes problems with mailing lists).
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[Nicky Thomassen]

Thu, 22 Apr 2021 19:26:57 +0200 skrev Claus Assmann
:

> It would be nice if the people who write browsers don't try to force
> their kind of "standards" on others... ("but you can get a free cert"
> -- what happens when those browsers do not "accept" those free certs
> anymore?)

With the risk of going off-topic, I do not see the reason for encrypting
everything on the internet from a more practical point of view, as it just gives
overhead: It takes time to set up and maintain, takes processing power on both
ends, and in the case of Postfix, makes no sense since there is nothing to
protect.

Encryption gives (ideally) authenticity, confidentiality and integrity
https://en.wikipedia.org/wiki/Information_security#Basic_principles

But there is no need for that on a read-only site like Postfix'. In my opinion,
anyway.


The best

Re: Certificate Postfix.org missing?

[Antonio Leding]

Another +1 that with vanilla FF v87 + macOS HS, the power is in the 
hands of the user (where it truly belongs) via a user-knob controlling 
whether or not FF complains about non-https…


- - -

 On 22 Apr 2021, at 10:51, Richard wrote:


Date: Thursday, April 22, 2021 19:26:57 +0200
From: Claus Assmann 

On Thu, Apr 22, 2021, John Levine wrote:

Nope, vanilla install on MacOS.

Not sure what your "vanilla install" is...

Firefox 88.0 on MacOS:
www.postfix.org
and
http://www.postfix.org/
show the web page just fine without a problem.

It would be nice if the people who write browsers don't try to force
their kind of "standards" on others... ("but you can get a free
cert" -- what happens when those browsers do not "accept" those
free certs anymore?)


The interaction one gets with firefox with a non-https site depends
on how one has set the "HTTPS-Only Mode" options at the bottom of the
privacy & security preferences. With it enabled I get a warning, but
can select to continue to the HTTP site. With it off I connect
without any warnings, but the lock in the URL bar has a line through
it.

Re: Certificate Postfix.org missing?

[Richard]

> Date: Thursday, April 22, 2021 19:26:57 +0200
> From: Claus Assmann 
>
> On Thu, Apr 22, 2021, John Levine wrote:
>> Nope, vanilla install on MacOS.
> Not sure what your "vanilla install" is...
> 
> Firefox 88.0 on MacOS:
> www.postfix.org
> and
> http://www.postfix.org/
> show the web page just fine without a problem.
> 
> It would be nice if the people who write browsers don't try to force
> their kind of "standards" on others... ("but you can get a free
> cert" -- what happens when those browsers do not "accept" those
> free certs anymore?)

The interaction one gets with firefox with a non-https site depends
on how one has set the "HTTPS-Only Mode" options at the bottom of the
privacy & security preferences. With it enabled I get a warning, but
can select to continue to the HTTP site. With it off I connect
without any warnings, but the lock in the URL bar has a line through
it.

Re: Certificate Postfix.org missing?

[Claus Assmann]

On Thu, Apr 22, 2021, John Levine wrote:
> Nope, vanilla install on MacOS.
Not sure what your "vanilla install" is...

Firefox 88.0 on MacOS:
www.postfix.org
and
http://www.postfix.org/
show the web page just fine without a problem.

It would be nice if the people who write browsers don't try to force
their kind of "standards" on others... ("but you can get a free cert"
-- what happens when those browsers do not "accept" those free certs
anymore?)

Re: Certificate Postfix.org missing?

[John Levine]

It appears that Jaroslaw Rafa  said:
>Dnia 22.04.2021 o godz. 12:04:23 John Levine pisze:
>> 
>> Safari and Brave also show a Not Secure warning. Firefox won't connect
>> at all unless you manually edit the https to http in the address box.
>> Pick your poison. 
>
>My four instances of Firefox on four different computers (all newest
>releases) connect perfectly to http-only sites. Maybe you have HTTPS only
>mode turned on in the preferences (AFAIK, it is not on by default), or have
>some extension like "HTTPS Everywhere" installed?

Nope, vanilla install on MacOS.

-- 
Regards,
John Levine, jo...@taugh.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly

Re: Certificate Postfix.org missing?

[Jaroslaw Rafa]

Dnia 22.04.2021 o godz. 12:04:23 John Levine pisze:
> 
> Safari and Brave also show a Not Secure warning. Firefox won't connect
> at all unless you manually edit the https to http in the address box.
> Pick your poison. 

My four instances of Firefox on four different computers (all newest
releases) connect perfectly to http-only sites. Maybe you have HTTPS only
mode turned on in the preferences (AFAIK, it is not on by default), or have
some extension like "HTTPS Everywhere" installed?
-- 
Regards,
   Jaroslaw Rafa
   r...@rafa.eu.org
--
"In a million years, when kids go to school, they're gonna know: once there
was a Hushpuppy, and she lived with her daddy in the Bathtub."

Re: Certificate Postfix.org missing?

[John Levine]

It appears that Nick Tait  said:
>>> Chrome shows it as "Not secure" followed by postfix.com by gracefully 
>>> hiding the implied www.
>> I think you meant to write "by disgracefully hiding...".
>
>I'm not hearing many reasons to use HTTPS... Just lots of reasons not to 
>use Chrome? ;-)

Safari and Brave also show a Not Secure warning. Firefox won't connect
at all unless you manually edit the https to http in the address box.
Pick your poison. 

Having set up a few hundred web sites I can report that adding a LE
certificate really isn't hard.

R's,
John

Re: Certificate Postfix.org missing?

[Benny Pedersen]

On 2021-04-22 04:06, Nick Tait wrote:

On 22/04/2021 10:32 am, Gary Smith wrote:

-Original Message-
From: owner-postfix-us...@postfix.org 
 On Behalf Of Viktor Dukhovni

Sent: Wednesday, April 21, 2021 3:02 PM
To: Postfix users 
Subject: Re: Certificate Postfix.org missing?

On Apr 21, 2021, at 4:34 PM, Gary Smith  
wrote:


Chrome shows it as "Not secure" followed by postfix.com by gracefully 
hiding the implied www.

I think you meant to write "by disgracefully hiding...".


I'm not hearing many reasons to use HTTPS... Just lots of reasons not
to use Chrome? ;-)


it does not support ftp:// anymore, so when will it stop supporting 
http:// its a scary world in 2021 :-)

Re: Certificate Postfix.org missing?

[Nick Tait]

On 22/04/2021 10:32 am, Gary Smith wrote:

-Original Message-
From: owner-postfix-us...@postfix.org  On 
Behalf Of Viktor Dukhovni
Sent: Wednesday, April 21, 2021 3:02 PM
To: Postfix users 
Subject: Re: Certificate Postfix.org missing?


On Apr 21, 2021, at 4:34 PM, Gary Smith  wrote:

Chrome shows it as "Not secure" followed by postfix.com by gracefully hiding 
the implied www.

I think you meant to write "by disgracefully hiding...".


I'm not hearing many reasons to use HTTPS... Just lots of reasons not to 
use Chrome? ;-)

Re: Certificate Postfix.org missing?

[Benny Pedersen]

On 2021-04-21 21:46, @lbutlr wrote:


In addition, if you use https and HTTP/2 the site wiil be faster and
use less bandwidth.
Win, win, win.


postfix website could be served with gopher://

if we want to be serious :=)

RE: Certificate Postfix.org missing?

[Gary Smith]

-Original Message-
From: owner-postfix-us...@postfix.org  On 
Behalf Of Viktor Dukhovni
Sent: Wednesday, April 21, 2021 3:02 PM
To: Postfix users 
Subject: Re: Certificate Postfix.org missing?

> On Apr 21, 2021, at 4:34 PM, Gary Smith  wrote:
> 
> Chrome shows it as "Not secure" followed by postfix.com by gracefully hiding 
> the implied www.

I think you meant to write "by disgracefully hiding...".

-- 
Viktor.


You my friend are 100% correct.  

Re: Certificate Postfix.org missing?

[Viktor Dukhovni]

> On Apr 21, 2021, at 4:34 PM, Gary Smith  wrote:
> 
> Chrome shows it as "Not secure" followed by postfix.com by gracefully hiding 
> the implied www.

I think you meant to write "by disgracefully hiding...".

-- 
Viktor.

RE: Certificate Postfix.org missing?

[Gary Smith]

On Wed, Apr 21, 2021 at 10:08:37PM +0200, Jos Chrispijn wrote:

> > There is neither a service at port 443, nor a postfix.org website.
> 
> You mean you don't authorize this site to use the Postfix name?
> Don't understand, too cryptic.

As stated there is no postfix.org website:

$ curl http://postfix.org
curl: (6) Could not resolve host: postfix.org

indeed no host named "postfix.org".  The are MX records for postfix.org, which 
is how we get to use the list.  There is a website at www.postfix.org.

-- 
Viktor.


I suspect the original author was probably refereeing to www.postfix.org.  

Chrome shows it as "Not secure" followed by postfix.com by gracefully hiding 
the implied www.

Re: Certificate Postfix.org missing?

[Antonio Leding]

Perhaps I’m wrong here but I think Wietse meant www.postfix.org vs. 
just postfix.org — as in only the former exists…


- - -

On 21 Apr 2021, at 13:08, Jos Chrispijn wrote:


Wietse Venema:


There is neither a service at port 443, nor a postfix.org website.


You mean you don't authorize this site to use the Postfix name?
Don't understand, too cryptic.

Best, Jos

-- With both feet on the ground you can't make any step forward

Re: Certificate Postfix.org missing?

[Viktor Dukhovni]

On Wed, Apr 21, 2021 at 10:08:37PM +0200, Jos Chrispijn wrote:

> > There is neither a service at port 443, nor a postfix.org website.
> 
> You mean you don't authorize this site to use the Postfix name?
> Don't understand, too cryptic.

As stated there is no postfix.org website:

$ curl http://postfix.org
curl: (6) Could not resolve host: postfix.org

indeed no host named "postfix.org".  The are MX records for postfix.org,
which is how we get to use the list.  There is a website at
www.postfix.org.

-- 
Viktor.

Re: Certificate Postfix.org missing?

[Jos Chrispijn]

Wietse Venema:


There is neither a service at port 443, nor a postfix.org website.


You mean you don't authorize this site to use the Postfix name?
Don't understand, too cryptic.

Best, Jos

-- With both feet on the ground you can't make any step forward

Re: Certificate Postfix.org missing?

[@lbutlr]

On 21 Apr 2021, at 07:06, IL Ka  wrote:
> It should be easy to install Letsencrypt certificate there, but I am not sure 
> if it's worth the effort

Since http is starting to be flagged as a security problem and users will be 
getting (or may already be getting) scary warnings when loading http, I'm 
pretty sure it is.

In addition, if you use https and HTTP/2 the site wiil be faster and use less 
bandwidth.

Win, win, win.

-- 
Q is for QUENTIN who sank in the mire
R is for RHODA consumed by a fire

Re: Certificate Postfix.org missing?

[John Levine]

It appears that IL Ka  said:
>-=-=-=-=-=-
>
>>
>>
>> There is neither a service at port 443, nor a postfix.org website.
>>
>>
>I believe this is about http://www.postfix.org/
>There is no https there.
>
>It should be easy to install Letsencrypt certificate there, but I am not
>sure if it's worth the effort

Web browsers, notably including Chrome, are increasingly showing warnings about
sites that are http only.  Considering how easy it is to use certbot to get LE
certificates, I'd get with the progam.

R's,
John

Re: Certificate Postfix.org missing?

[IL Ka]

>
>
> There is neither a service at port 443, nor a postfix.org website.
>
>
I believe this is about http://www.postfix.org/
There is no https there.

It should be easy to install Letsencrypt certificate there, but I am not
sure if it's worth the effort

Re: Certificate Postfix.org missing?

[Wietse Venema]

Jos Chrispijn:
> Might be wrong, but just saw that the https// certificate is missing on 
> your informatie website?

There is neither a service at port 443, nor a postfix.org website.

Wietse

Certificate Postfix.org missing?

[Jos Chrispijn]

Might be wrong, but just saw that the https// certificate is missing on 
your informatie website?


Best, Jos

-- With both feet on the ground you can't make any step forward