Re: [arch-d] Fwd: New Version Notification for draft-nottingham-avoiding-internet-centralization-04.txt

[John Levine <[e-mail]>]

It appears that Eliot Lear  <[e-mail]> said:
> 2. EMail has been a cesspool for a long time, and has served as a virus
>    vector.  When these two companies collude, as they surely do, to
>    address cybersecurity risks, how many attacks are averted?

Of course they do. What do you think M3AAWG is for? But it's more
complicated than that because mail is very asymmetrical. While I can
believe the the majority of mail recipients are hosted at Google and
Microsoft, most mail is sent, even after you filter out the spam, from
bulk mail specialists like Mailchimp and Constant Contact. That is
somewhat concentrated, albeit not as much as mail hosting, and it is
striking that there is no overlap between the large mail hosts and
large mail senders.

It's also worth noting the limits of the methods in that paper.  Two of the
largest "hosts" they list are Proofpoint and Mimecast, neither of which host
any mail at all.  They're front ends who deliver to whatever mail system the
customer uses.  I would guess that the most popular back end is hosted Exchange
but they're not telling.

> 3. The alternative to service centralization in this case might be
>    software concentration (Exchange and Dovecot? on the server side and
>    Apple Mail / Outlook on the client side, with some Google Mail
>    readers for Android).

Having done some surveys I can tell you that the most popular mail
software by far is Exim, mostly because it is packaged with the
control panels that VPS providers use, but few of those installations
have a significant number of users. For systems with insteresting
numbers of users I'd guess it's split between Exchange at places who
have to use Windows and Postfix at places that don't, with Microsoft
pushing their customers pretty hard to move to hosted Exchange.

I think this tells us that even figuring out what's centralized and
where can be surprisingly hard.

R's,
John