5 ms·

I'd absolutely be all for it - I've been running my mail server since the 90s, and used to run it out of my closet. There are two major, somewhat interlocking

by _jal 8y ago

I'd absolutely be all for it - I've been running my mail server since the 90s, and used to run it out of my closet. There are two major, somewhat interlocking problems, though: home users with compromised machines currently represent the population of home "mail servers" (spam malware) at the moment. Selling this involves convincing mail administrators that not simply blackholing all of what is currently a cesspool is a good idea. That's not easy. The second problem is that fixed-IPs, open well-known ports and DNS have become a product differentiator for ISPs. Those are "business" features; dumb ole' consumers don't "need" them. I don't see any compelling argument that would convince either prong of that trap - hell, I agree with you, but as a mail admin both professionally and personally, the first one gives me hives, thinking about the years of work it'll take to re-stabilize a functional antispam infrastructure to handle it. And after that, you need to convince Comcast to change their revenue-extraction plans and generally be less dickish. If just you want a mail server now, your best bet is a cheap VM somewhere. It can be really low-end and cheap.

loup-vaillant 8y ago
Dynamic IP is a bummer, but outright closing ports is a direct violation of net neutrality. It's baffling that it's tolerated at all. An ISP's job is to forward IP packets. Not read them. TCP/UDP ports number are the content of those IP packets—not the meta data. Filtering based on such content is already a form of discrimination. What's next, deep packet inspection? Some ISP filter by default, but they do this at the router level, and you can either configure or change the router. That's okay, possibly even beneficial. Blocking at the backbone level however is just evil.
- walrus01 8y ago
  Counterpoint: Unless you've been in network engineering for an ISP with tens of thousands or more residential customers, you have no idea how much spam/abuse/trojaned PC traffic comes from residential users. There's a very good reason why ISPs block some of this, for the protection of their own users. It's even necessary to block port 139 windows file sharing or people will connect PCs with totally open file shares straight into their cable or DSL modems. It's a real headache. The average HN user is in like the 99.9th percentile of residential internet users. HN users, give them a proper DIA feed, sure. Everyone else, I'm wary.
  - znpy 8y ago
    > The average HN user is in like the 99.9th percentile of residential internet users. And we have the right of doing this. Anyhow: the dynamic ip problem might be solved with ipv6. The spam problem... Imho graylisting + spf + dkim + reverse-ptr should be enough to kill spamlists once and for all.
    - walrus01 8y ago
      Good luck getting the average residential ISP to edit rDNS records for you. It's a special thing they will only do in certain circumstances and as a special one-off thing. Automated provisioning tools and customer service are not set up for it. I'm not saying that is a good thing, or satisfactory, but that's the current status quo. I'm all in favor of ipv6 everywhere but the current reality is that a huge number of organizations presently have v4 only smtpd in their MX records, if you try to do a pure v6 approach you will break delivery to/from something like 65% of the internet.
    - bradknowles 8y ago
      Even when gr[ae]ylisting was introduced (see <http://projects.puremagic.com/greylisting/whitepaper.html> http://projects.puremagic.com/greylisting/whitepaper.html>), it was quickly recognized that there are some important sites out there that don't follow the RFCs, and therefore they break gr[ae]yisting. The page at <https://www.greylisting.org/whitelisting.php> https://www.greylisting.org/whitelisting.php> links to a source at <http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk/schema/whitelist_ip.txt> http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk... that doesn't even exist anymore. For postfix, we now have the project at <https://github.com/stevejenkins/postwhite> https://github.com/stevejenkins/postwhite> to help automate the maintenance of whitelists of sites that break gr[ae]ylising. IMO, we passed the point years ago when gr[ae]ylisting was still a useful technique. For anything within the last decade or so, I would say it probably does more harm than good.
    - bradknowles 8y ago
      See also the "Disadvantages" section at <https://en.wikipedia.org/wiki/Greylisting> https://en.wikipedia.org/wiki/Greylisting>, and read section 4 of RFC6647 at <https://tools.ietf.org/html/rfc6647#section-4> https://tools.ietf.org/html/rfc6647#section-4>. Note that his RFC was written in 2012.
megous 8y ago
Other way I've thought of effectively achieving this is by using VPS for static IP outside of residential ranges and home machine connected by WireGuard VPN. WireGuard handles roaming easilly, so dynamic IP is no problem, IPv6 is no problem, and the mail will stay on your home machine. You'll also bypass your country's/ISP tracking somewhat if you place your VPS outside of the country.
- lsh123 8y ago
  I run home mail sever for a while. I used to have smtp at home but a few years back I switched to a smtp proxy/forwarder on AWS ($5-6/month) connected via TLS SMTP on custom port at home (which also serves IMAPS on a custom port). Once a year I have to update DNS when my Comcast IP changes. Otherwise it is completely trouble free setup.
znpy 8y ago
> The second problem is that fixed-IPs, open well-known ports and DNS have become a product differentiator for ISPs. Those are "business" features; dumb ole' consumers don't "need" them. I understand the fixed ip thing, but closing well-known ports by default should be considered a form of censorship. It is like selling a mobile phone, except the user find out that they can only listen but cannot talk.
dtech 8y ago
> If just you want a mail server now, your best bet is a cheap VM somewhere. How do you make that work? In my experience, the mail will just be blocked because the IP has no reputation and the range is probably grey/blacklisted.

by _jal 8y ago

loup-vaillant 8y ago

Dynamic IP is a bummer, but outright closing ports is a direct violation of net neutrality. It's baffling that it's tolerated at all. An ISP's job is to forward IP packets. Not read them. TCP/UDP ports number are the content of those IP packets—not the meta data. Filtering based on such content is already a form of discrimination. What's next, deep packet inspection? Some ISP filter by default, but they do this at the router level, and you can either configure or change the router. That's okay, possibly even beneficial. Blocking at the backbone level however is just evil.

walrus01 8y ago
Counterpoint: Unless you've been in network engineering for an ISP with tens of thousands or more residential customers, you have no idea how much spam/abuse/trojaned PC traffic comes from residential users. There's a very good reason why ISPs block some of this, for the protection of their own users. It's even necessary to block port 139 windows file sharing or people will connect PCs with totally open file shares straight into their cable or DSL modems. It's a real headache. The average HN user is in like the 99.9th percentile of residential internet users. HN users, give them a proper DIA feed, sure. Everyone else, I'm wary.
- znpy 8y ago
  > The average HN user is in like the 99.9th percentile of residential internet users. And we have the right of doing this. Anyhow: the dynamic ip problem might be solved with ipv6. The spam problem... Imho graylisting + spf + dkim + reverse-ptr should be enough to kill spamlists once and for all.
  - walrus01 8y ago
    Good luck getting the average residential ISP to edit rDNS records for you. It's a special thing they will only do in certain circumstances and as a special one-off thing. Automated provisioning tools and customer service are not set up for it. I'm not saying that is a good thing, or satisfactory, but that's the current status quo. I'm all in favor of ipv6 everywhere but the current reality is that a huge number of organizations presently have v4 only smtpd in their MX records, if you try to do a pure v6 approach you will break delivery to/from something like 65% of the internet.
  - bradknowles 8y ago
    Even when gr[ae]ylisting was introduced (see <http://projects.puremagic.com/greylisting/whitepaper.html> http://projects.puremagic.com/greylisting/whitepaper.html>), it was quickly recognized that there are some important sites out there that don't follow the RFCs, and therefore they break gr[ae]yisting. The page at <https://www.greylisting.org/whitelisting.php> https://www.greylisting.org/whitelisting.php> links to a source at <http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk/schema/whitelist_ip.txt> http://projects.puremagic.com/web-svn/wsvn/greylisting/trunk... that doesn't even exist anymore. For postfix, we now have the project at <https://github.com/stevejenkins/postwhite> https://github.com/stevejenkins/postwhite> to help automate the maintenance of whitelists of sites that break gr[ae]ylising. IMO, we passed the point years ago when gr[ae]ylisting was still a useful technique. For anything within the last decade or so, I would say it probably does more harm than good.
  - bradknowles 8y ago
    See also the "Disadvantages" section at <https://en.wikipedia.org/wiki/Greylisting> https://en.wikipedia.org/wiki/Greylisting>, and read section 4 of RFC6647 at <https://tools.ietf.org/html/rfc6647#section-4> https://tools.ietf.org/html/rfc6647#section-4>. Note that his RFC was written in 2012.

megous 8y ago

Other way I've thought of effectively achieving this is by using VPS for static IP outside of residential ranges and home machine connected by WireGuard VPN. WireGuard handles roaming easilly, so dynamic IP is no problem, IPv6 is no problem, and the mail will stay on your home machine. You'll also bypass your country's/ISP tracking somewhat if you place your VPS outside of the country.

lsh123 8y ago
I run home mail sever for a while. I used to have smtp at home but a few years back I switched to a smtp proxy/forwarder on AWS ($5-6/month) connected via TLS SMTP on custom port at home (which also serves IMAPS on a custom port). Once a year I have to update DNS when my Comcast IP changes. Otherwise it is completely trouble free setup.

znpy 8y ago

> The second problem is that fixed-IPs, open well-known ports and DNS have become a product differentiator for ISPs. Those are "business" features; dumb ole' consumers don't "need" them. I understand the fixed ip thing, but closing well-known ports by default should be considered a form of censorship. It is like selling a mobile phone, except the user find out that they can only listen but cannot talk.

dtech 8y ago

> If just you want a mail server now, your best bet is a cheap VM somewhere. How do you make that work? In my experience, the mail will just be blocked because the IP has no reputation and the range is probably grey/blacklisted.