The Open Source Road: Why GMW Systems Went Back to Basics
We moved GMW Systems' email off Microsoft 365 and built our own in nineteen days. Here's why.
Nineteen days. That's how long it took to build a working version of GMW Systems Subspace — our own mail, calendar, and contacts platform — after we decided to move GMW Systems' email off Microsoft 365.
Let me be honest about why we did it. It wasn't a grudge against Microsoft. It's not a "big tech is evil" story, though I have opinions. It started with a simple observation I've made a thousand times over twenty-five-plus years of doing this:
You use 5% of the functionality 95% of the time. The other 95% just makes everything slow, confusing, and bogged down.
That's an opinion. But I'm an expert, so I get to say it.
This whole story, really, is a back-to-basics story. Not a retreat — a decision. A lot of us got talked into software that does everything, and somewhere along the way it stopped doing the one thing we asked it to do.
The change that broke the camel's back
Microsoft announced that starting February 2027, it will retire SMS and voice codes as Microsoft 365 login methods — passkeys and authenticator apps become the standard. That's genuinely a good security move for a lot of people. Passwords alone aren't enough anymore; I say that to clients every week.
But here's the thing: it assumes a smartphone. And what about the people who don't have one? Like my mom — she has a landline. A voice code on that landline is her only way in, and it's going away.
We can't assume everyone wants to refresh their tech every six months. A lot of the people I support are just trying to run a small business, a food bank, a church office — and they want their email to work. They want it simple. They want it to be theirs.
Email isn't a feature. It's the bread and butter of the internet — the common language every device on earth speaks, the workhorse everything else runs on. If the platform you're renting your email from is making it harder, not easier, something's wrong. We knew we could do it simpler, faster, and better.
So we did.
What we built
GMW Systems Subspace is our own email platform: mail, calendar, contacts, all in one clean interface that doesn't fight you. Back to the basics — it does the things a family or small workgroup actually needs, and does them well:
- Linked email accounts — completely private but can be configured to share
- Linked calendars — color-coded, shared, "just like the big guys," except it's yours
- Junk-mail training that learns
- Your data on your own server, under your control
And underneath it all, we run on open source tools we trust. The mail itself runs on Postfix and Dovecot — names that have quietly carried most of the world's email for decades and are still the standards. Then Nextcloud for files, Collabora for in-browser document editing, LibreOffice for the desktop.
I've said it before and I'll say it again: these tools are ready for prime time. The open source ecosystem has quietly become every bit as capable as the commercial stack — for a fraction of the cost (and often free!) with no per-seat fees creeping up every year and no forced feature churn. And here's the thing: because they're built by people who actually use them, they tend to focus on the 5% of features you use 95% of the time — and get those right.
And security?
Fair question — if we're bucking a security mandate, what are we doing instead? Here's the honest answer.
Our admins use 2FA. Every GMW Systems administrator has two-factor authentication on their account — the same authenticator-app codes the big platforms push. That's non-negotiable for the people who hold the keys.
Regular users don't have to. And that's deliberate. Most of the people we support aren't going to install an authenticator app just to check their email — and some genuinely can't. So instead of pushing the burden onto every user, we locked the front door and left the doorbell alone:
- Account lockout — five failed login attempts locks the account for a quarter of an hour. Brute-force bots get nowhere.
- Bot blocking at the server — the mail server watches for the IP addresses that hammer at the door and bans them automatically, just like the big guys do.
- Rate limiting and delays — login attempts are slowed and throttled, so guessing is impractical.
- Locked-down access — the whole system sits behind our own firewall, on our own servers, with the doors to the inside locked tight and monitored.
- Link stewardship — every link in a message gets a second look at the real address before it opens, so a disguised "click here" never catches you off guard.
The result: the parts that matter are locked down hard — without demanding a smartphone from the janitor who's been on their feet all day.
Here's the part the big platforms can't copy: we know our clients — all of them, by name. That changes everything. Microsoft has to secure a billion strangers, so it pushes security onto the user — passkeys, authenticator apps, lockout rules tuned for the average. We push security onto the system instead. A few bad attempts and the account is out. A network that hammers at the door gets banned entirely. And when we get it wrong? One phone call fixes it — try getting that from a support chatbot. That's the burden shift, and it only works because we're small enough to know who's knocking.
And this isn't just about my mom. I'm in my 50's now — but I'll be in my 80's someday too, and I don't want the software I depend on to turn its back on me when I get there. Nobody should have to climb a tech treadmill just to read their email.
Why this matters for you
You might be wondering: is he telling me to dump Microsoft? No. I'm telling you the opposite.
Microsoft 365 is still the right call for larger organizations that live inside the Microsoft ecosystem — Teams, SharePoint, partners who expect it, compliance requirements that demand it. We support clients on M365 every day, and we do it happily. There is no one right answer. There's the right answer for your business.
But here's what I know: most small businesses I meet are paying for a skyscraper when they need a ranch house. There's nothing wrong with wanting things simple — most of us got into business to do the work, not to run a software department. The typical company now runs about 32 separate software subscriptions — that's from Cledara's 2026 SaaS Spend Index, based on real payment data, not a vendor survey — and Productiv's research finds close to half of business software licenses go unused. That's complexity creep, and complexity is the enemy of a small operation. Back to basics isn't nostalgia — it's a strategy.
The open source road is a choice, not a mandate. It's for the people who want their data to be theirs, who want tools sized to their actual work, and who want the person who built the system to answer the phone.
That last part matters more than ever. Every big platform is pushing chatbot support now — training us to expect less human help. That's not how I operate. I use AI to automate the routine stuff — monitoring, backups, checks. It frees up time for the part that matters: helping you directly.
AI for speed. Human for trust.
GMW Systems runs its own mail on our own servers. Clients can run on GMW Systems Subspace too, if they want. And if you're curious about the open source road for your business — whether that means mail, files, or just a second opinion on what you're paying for — call me. We'll figure out what actually fits.
Because at the end of the day, the best technology isn't the biggest. It's the one that works for you — and stays out of your way so you can do your work.
- Garrett