Not a clue myself, but when I have to choose, I go with Mistral. They used to have a very good policy last time I’ve read it. They’re also targeting the European market a lot (and are located in Europe), which seems much safer than US or China in terms of data handling to me.

They also shared open-weight state-of-the-art models and ideas multiple times. The 7B Mistral was a thing for a while, and they were the first to ever publish an open-weight MoE model (Mixtral) I believe.

Does that mean they would encrypt inbound emails with your key?

Yes.

Email is inherently unsecure … so I wonder how much security/privacy does that actually provide

Indeed, the effect of this is limited. If the system is running properly, all new incoming emails are immediately encrypted - never even stored unencrypted on the disk. Which means that, if an attacker compromises the server, they would not see the body of past emails. They would, however, be able to intercept new raw incoming emails. Another aspect of this functionality is that it’d be near-impossible for posteo to do the evil thing and actually store the incoming messages without incriminating themselves badly if it’s ever found out. That additional aspect is a political pressure for them to do their job very well.

In total, the email architecture is badly broken anyway, but features like that help a little bit.

It looks interesting. However, few things are hard for me to process:

• They seem to be busy with hosting, an IPO last month and honestly quite interesting sounding projects like home heating as a heat sink for their datacenters. That honestly sounds interesting. But on the other hand, for emails specifically, I’m thinking of something very single-focused, narrow-scoped. “Do one thing but do it well” type of approach.
• I got lost in their docs trying to understand if they support inbound encryption with a user-provided PGP key or not.
• They require SMS registration. Like reaaalllyyyy? Sorry for this emotional part, I just so didn’t expect this. It’s a disaster from almost every possible angle. It’s terrible security, trivially remotely hackable. Terrible privacy. I guess it may help them just a tiny bit with their non-paid accounts as a throttle barrier (so that I don’t register 1000 times in a row). But man, it’s not worth all the negative aspects that this brings.

I think they specifically say to not use email encryption at all. Instead they mention Magic Wormhole and Signal.

Thank you for the comment! This is the provider I went with in the end. In particular, I’ve liked:

• They support inbound encryption with my public PGP key.
• Very good docs, saying what exactly they do. I could read all the details I wanted to know.
• Strong stance on open-source: “our product offering exclusively uses open source software and free protocols, for security reasons. We only use Javascript which has open source code.”
• Sustainability, e.g. they only use permanent contracts for employees. (And many other points that resonated with me.)
• They don’t have calling support, but I consider it even better actually, because I want my emails to be very reliable, cheap and de-coupled from the rest of things. Calling I can honestly self-host just fine, since I don’t have to worry much if stuff breaks or changes (as opposed to email, which would better be stable for me).

It’s a bit limiting that they don’t support an unlimited number of aliases, but at least they support 3 of them, and the “+” sign same as google and many others do.

Thank you for your response! This was one of two main contenders for me. What I’ve found about mailbox is that they have medium-strength stance on open-source (using, but not using only this). They likely support inbound encryption with a user-provided PGP key (“PGP-encrypted inbox” https://mailbox.org/en/prices/#compare-all-features--2). They are reasonably priced and upgradable with some additional payment to have VoIP support.

The other main contender for me was posteo, and after thinking and reading over the last 2 days, I’ve decided to go with them. In particular, I’ve liked:

• Very good docs, saying what exactly they do. I could read all the details I wanted to know.
• Strong stance on open-source: “our product offering exclusively uses open source software and free protocols, for security reasons. We only use Javascript which has open source code.”
• Sustainability, e.g. they only use permanent contracts for employees. (And many other points that resonated with me.)
• They don’t have calling support, but I consider it even better actually, because I want my emails to be very reliable, cheap and de-coupled from the rest of things. Calling I can honestly self-host just fine, since I don’t have to worry much if stuff breaks or changes (as opposed to email, which would better be stable for me).

Again I actually value having read about mailbox as well - it’s a very good alternative!

Looks quite good to me actually! I like infinite aliases stated right away. The price seems reasonable. I’d wish they’d have inbound encryption with user-provided PGP keys though - a feature I’m looking for, personally.

Thank you! Depending on the use case, they seem to be pretty reasonably priced as well. One feature that I’d personally be happy to see but they don’t seem to support it is inbound PGP encryption with a user-provided key tough.

Thank you for the response! It was interesting to read about them. However, it’s also notable that they don’t offer inbound encryption with user-provided GPG keys. For me that part matters. Again thanks for the response in any case!

Thanks for the response! Do you know if startmail has inbound encryption? That is, I give them my locally-generated public key, and they encrypt all incoming emails immediately as they arrive?

Yup. They work very reliably on average, but the recent failure of 2 drives at once together with a personal loss of one of the founders (and the most active externally visible developer I think) was really tough for them. They’re currently recovering, but it’s tough.

To OP or others, please re-post if you’ll do it through epetitionen.bundestag.de!

I’m using them already! Actually mentioned in the post body, too:

So far I like disroot a lot. But they are principled about being unpaid, so if the financial ends don’t meet each other my emails will be in trouble. I’m donating to them, but I have my worries. I’m willing to pay a little if I know that my money will go for a quality service, for expansion of coverage (new users) and for open-source technologies.

But I’m also wary of continuity in case of financial struggles, hence this post. Maybe I should just wait out the current struggle with the failing disk and hope they will continue to operate on donations as they successfully have been for years and years… In any case, I’d like to know the alternatives, too.

For me personally, this quote was insightful:

When someone shows you who they are, believe them

That being said, man, you’ve just paid them. Of course I’d also not just jump overboard all of a sudden.

I’ve literally registered with them yesterday. Seems nice so far, worth exploring further.

Thanks for sharing! Good post, totally worth the read.

And I know which company to stay away from, and will solidly recommend this to others as well.

• I think AI disclosure has to be a hard rule. Not done properly? Remove.
• I think there has to be a threshold of when to allow, otherwise we’ll get (and are already) overwhelmed. For example, be X months old is an easy check that would filter out low-effort posting.

Besides these basic rules that I think are absolutely mandatory, I’m not sure how far to go. I’d want to say that the project needs to explain Free Software affinity or explain why it’s posted on lemmy or something like that… But it’s so easy to fake it with, the irony of it, AI texts.

In conclusion,

• Decision-wise, I wouldn’t mind if the resolution is the full removal on AI-driven projects.
• Decision-wise, I would absolutely request a hard-ban if the lemmy text is AI-written.
• Decision-wise, I could accept if the rule is to accept some small sliver of AI posts that would come our way otherwise. Maybe some projects where AI assists in writing code, but does not replace the programmer. Maybe that is OK, if the project otherwise is “relevant to the open source ideology” (Rule 1 of this community).

EDIT: Also, something to think about is… community, not just code. For community health, it might be better to remove AI-driven projects entirely. Because we aren’t just about code. We’re also about continuing to exist long-term.

EDIT 2: I think codeberg actually did it better than my improvised thinking. I’d go with codeberg’s rules: https://blog.codeberg.org/protecting-our-floss-commons-from-llms.html

They’re also a Dutch non-profit organization, and both their services and their infra are all developed/maintained in the open using exclusively open-source projects.

I guess you’re right in a sense that, I’m not aware of anyone specifically getting money with the job “just hurt them somehow”.

I don’t know if people receive money to say other things though. Like that a googlified phone or other things are secure (when they’re much less secure, and that can be proven in the technical realm). Do people receive money for that? I’m aggressively blocking all ads and barely watch any youtube at all, so I’m a bad judge for that. I’ve seen what looks to me as traces of that, but I could be wrong. So I’ll take back my claim and just state that I merely have doubts. Maybe someone can add more information on that. If they know whether people are getting for saying that google is secure, or that some of the alternative firmware is just as secure. It would not be attacking GrapheneOS then, but it would be attacking and muddying the truth.

Both absolutely true, AND they live in a world where a lot of money is being paid paid to attack them. It’s like elections in a corrupt country: on paper you may even have fair voting, but in practice there will be constant attempts at sabotage.

They live in a harsh world. Personally, I forgive them their paranoia. A huge chunk of security+freedom on mobile currently stands on their shoulders, and on PinePhone / Librem5.