I don't know about the parent comment's requirements, but I'm:
1. Someone who has some servers and a little tiny bit of technical knowledge. Or, to be exactly, I happen to already run Postfix+Dovecot+rspamd for my email.
2. Someone who is interested in personal email security/privacy, in particular in terms of both in-transit and on-storage encryption. I can't realistically watch for every CVE and patch all the holes on the day 1, so I would always love something that would let me trust my servers and network less.
I don't have any specific threat model or a designated adversary. I just see "hey, there's a some new stuff that looks promising" (this submission) and wonder if it could improve my life. However, the documentation is sparse, or, I'd better say, nearly non-existent (or I'm looking at a wrong place). So, asking if someone had already spent time to evaluate or had actually used that and can share their experience is a logical choice.
Thus, I just wonder - is Magma for me, can I run a secure personal email server with it? Like, use it to replace my Postfix+Dovecot system? Can I expect it to be no less reliable than my current setup (which is just your average run-off-the-mill configuration, documented in every other "how to set up your own mail server" article)? Is it correct to expect it to add some value in terms of security? What the exact those improvements would be?
As I (very briefly) mentioned, it looks to me like Magma isn't ready for prime-time yet. I've seen reports that, for instance, the LDAP server allows completely insecure configurations (cleartext passwords on the wire) without so much as a warning. That sort of thing should not be possible with a product like this, and makes me think they're gluing together pre-existing code, which is also a little worrisome[1].
Beyond that, I tend to be pretty conservative with things like email. What you currently run, assuming it is configured correctly, is solid; I'd personally be hesitant to replace it until other folks have bled over the inevitable first bugs and it has been in use long enough for people to learn how to operate it, figure out any weirdness, etc. At the least, you'll be skipping what will probably be several point releases right after whenever they actually call it done.
TLDR; if I were you, I'd hold off. (And am personally holding off.) I'm very interested in this, in theory, but even though I am technical, I'm not a cryptographer or a security researcher, and even if I were I don't have the time to audit it. I want those folks to beat it up before I wade in.
[1] Nothing wrong with that in principle, but combined with the jagged edges, it makes me wonder how much attention any grafted code is actually getting.
1. Someone who has some servers and a little tiny bit of technical knowledge. Or, to be exactly, I happen to already run Postfix+Dovecot+rspamd for my email.
2. Someone who is interested in personal email security/privacy, in particular in terms of both in-transit and on-storage encryption. I can't realistically watch for every CVE and patch all the holes on the day 1, so I would always love something that would let me trust my servers and network less.
I don't have any specific threat model or a designated adversary. I just see "hey, there's a some new stuff that looks promising" (this submission) and wonder if it could improve my life. However, the documentation is sparse, or, I'd better say, nearly non-existent (or I'm looking at a wrong place). So, asking if someone had already spent time to evaluate or had actually used that and can share their experience is a logical choice.
Thus, I just wonder - is Magma for me, can I run a secure personal email server with it? Like, use it to replace my Postfix+Dovecot system? Can I expect it to be no less reliable than my current setup (which is just your average run-off-the-mill configuration, documented in every other "how to set up your own mail server" article)? Is it correct to expect it to add some value in terms of security? What the exact those improvements would be?