LÖVE

Apparently some time in the last few years, major ISPs started blocking outgoing connections on port 25 from residential accounts / dynamic IPs.

https://www.xfinity.com/support/interne ... supported/

This is probably a bit silly since there's nothing inherently insecure about port 25; server could easily allow TLS upgrade on that port, or accept unencrypted SMTP on a different port. Anyway, there are email services that provide an alternate port for this, or choose not to enforce TLS upgrade on 587 or some other port. Two that look promising are mailgun.com and smtp2go.com. Their free service is limited, but don't look like they require a credit card and should be enough if your game's not throwing a crazy amount of different errors.

Unfortunately gmail only allows unencrypted connections over port 25 as far as I can tell. It looks like maybe it can be reconfigured for "G Suite" (formerly Google Apps), but I haven't tried it.

I'm finally convinced #363 (some kind of API on top of openssl / whatever ships with Windows) is a good idea, as the world seems to be moving in the general direction of trying to enforce encryption everywhere even when unnecessary.

Thanks a lot for the feedback and fresh ideas!

airstruck wrote: ↑Tue May 09, 2017 8:52 pm Apparently some time in the last few years, major ISPs started blocking outgoing connections on port 25 from residential accounts / dynamic IPs.

https://www.xfinity.com/support/interne ... supported/

This is probably a bit silly since there's nothing inherently insecure about port 25; server could easily allow TLS upgrade on that port, or accept unencrypted SMTP on a different port.

Hmm.. I've read about that, but kinda hoped that would be a thing of the past. Oh well, so gmail doesn't work then after all.

Anyway, there are email services that provide an alternate port for this, or choose not to enforce TLS upgrade on 587 or some other port. Two that look promising are mailgun.com and smtp2go.com. Their free service is limited, but don't look like they require a credit card and should be enough if your game's not throwing a crazy amount of different errors.

Thanks!
Unfortunately, smtp2go only works without authentication if you send from an IP that you specified in your account, so that doesn't scale.

MailGun on the other hand might be a solution What I'm trying to pull off is not really in line with their business model, but everything kind of works out:

• Unless you prove ownership of a domain you can only send emails to authorized recipients, which is fine because we only ever want to send to a single email address.
• You do need to authenticate to the smtp server with a username and password (unless I missed something), but in this case that's not a huge deal, either: You can set up custom credentials that you could revoke later if you needed to.
• Anyone who digs through the source and gets theirs hands on your credentials can't really do much except spamming your email address. It's still ugly that you need to include credentials, but at least those credentials aren't very valuable.

So, it's not as simple as using your existing gmail account, but I could cover all steps in a short tutorial and you'd be good to go in 15, 20 minutes.

However: It is true that you don't need a credit card to sign up and send test emails, but those 10,000 emails per month only unlock once you enter credit card details, and they are very vague about your quota until then:

Our Free plan allows you to send email, but log retention is limited to 2 days and sending will stop once you reach your free allocation.

It might be necessary to enter credit card details to be on the safe side. I'm not sure...

Unfortunately gmail only allows unencrypted connections over port 25 as far as I can tell. It looks like maybe it can be reconfigured for "G Suite" (formerly Google Apps), but I haven't tried it.

Yup, I came across that It sounded really promising, but it looks like there is no option to get your hands on a G Suite account under 5$/month...

I'm finally convinced #363 (some kind of API on top of openssl / whatever ships with Windows) is a good idea as the world seems to be moving in the general direction of trying to enforce encryption everywhere even when unnecessary.

Yes, that would be really nice to have
It's a bit restrictive that Love doesn't offer anything like that out of the box. I had to set up a little http to https proxy on my server just to be able to make a call to itch.io's API... And https would make things like downloading updates automatically (see adnzzzzZ's excellent blog post) a lot more comfortable.

crush-test.love

Shouldnt it be crash-test.love?

yetneverdone wrote: ↑Wed May 10, 2017 3:44 am Shouldnt it be crash-test.love?

Oh, I was hoping that it was obvious why it's crush and not crash...

0x25a0 wrote: ↑Wed May 10, 2017 11:33 am

yetneverdone wrote: ↑Wed May 10, 2017 3:44 am Shouldnt it be crash-test.love?

Oh, I was hoping that it was obvious why it's crush and not crash...

Oh, is it "crush" as in the "love" thingy?

Exactly

0x25a0 wrote: ↑Wed May 10, 2017 2:34 pmExactly

Oooooh. Hahaha silly me. It's like the other modules name as well, sort of since the others are kind of inappropriate haha.