This isn’t really a security issue as much as it is a DDOS issue.

Imagine you own a brick and mortar store. And periodically one thousand fucking people sprint into your store and start recording the UPCs on all the products, knocking over every product in the store along the way. They don’t buy anything, they’re exclusively there to collect information from your store which they can use to grift investors and burn precious resources, and if they fuck your shit up in the process, that’s your problem.

This bot just sits at the door and ensures the people coming in there are actually shoppers interested in the content of some items of your store.

You could skip the detour through hashes/electricity and do something with a proof-of-stake cryptocurrency, and just pay for access. The site owner actually gets compensated instead of burning dead dinosaurs.

Maybe if the act of transferring crypto didn’t use a comparable or greater amount of energy…

I remember when OEMs just didn’t rape you on RAM and storage.

One corporation DDOS’s your server to death so that you need the other corporations’ protection.

https://apps.yunohost.org/wishlist

It exposes the server to the entire internet…

Maybe reverse proxies will do it for you

Reverse proxies require configuration.

what the security risks are for HTTPS for a service that will already be accessible remotely?

Already accessible via VPN. Meaning it’s only accessible to those explicitly allowed to access it.

It’s a lot more simple. If anything Nextcloud is better for Enterprise customers.

Exposing https requires a lot more configuration and also carries with it security risks.

OwnCloud

Hmmm we could use my Cryptpad instance… OK but I don’t get notification on my GMail

😡 ntfy.sh 😡

They don’t get my email address on a privately-hosted server…

You could use Matrix but it is very finicky and complicated.

You could use XMPP but they don’t have any nice clients.

You could use Zulip but it’s confusing as fuck to navigate.

You could use Mattermost but it’s tied to a corporation that seems intent on removing features from the open source version to convince you to buy a license.

You could use Quiet (not self-hosted but p2p) but it’s very new and very Alpha.

You can use NextCloud Talk but that’s probably more than you need, and it seems to be very difficult to maintain for many.

I won’t engage in any arguments, these are just my opinions, and options for OP.

Ghost is just one piece of selfhosted software. But I have inquired and they have declined.

They’re not running a charity.

They are, actually. They’re a registered non-profit.

Chances are the email requirement is just what they have for other features.

More unnecessary functionality.

You should probably ask the developers then

…which ones?

functioning service something like password reset is necessary.

It is not necessary if you don’t lose your password, which I don’t ever, because I use a password manager. It’s also not necessary if you have administrative access to the server.

not even trying to put yourself into other shoes

Brother we have the opposite problem. You are not putting yourself in my shoes, or other people like me.

I am not suggesting everyone should get rid of it, I’m asking why it can’t be optional and easily disabled…

Since then you would need to have another way to achive the goals e-mail does.

None of those things are necessary. Like I don’t even have email configured on my server because I don’t need it at all except when the developer unnecessarily integrates it to the extent that it breaks it.

for that one user that does not want it.

I am not at all the only one. Just look at the other comments and votes in this thread.

maybe the design goals of the software do not fit your goals.

That makes no sense. Nothing about the software goals are related to email integration.

the majority of users want and/or need one for user management

Is it too much to ask for self-hosted users/developers to use something slightly more modern, convenient, and easier to implement? Or to simply make it optional? As long as it’s not even an option we’re pretty much doomed to the dinosaur-era of internetting permanently.

your only options are to code it, or ask someone else to

I wasn’t asking for options, I was asking for an explanation.

so it makes sense to spend limited resources on a thing which has the biggest userspace

It makes zero sense to spend any resources on adding compatibility with proprietary and malicious protocols, regardless of “userspace”.