Hacker News Reader

Comment by jawns | Hacker News Reader

Don't most ISPs ban residential accounts from running something like this?

Comcast terms:

> use or run dedicated, stand-alone equipment or servers from the Premises that provide network content or any other services to anyone outside of your Premises local area network (“Premises LAN”), also commonly referred to as public services or servers. Examples of prohibited equipment and servers include, but are not limited to, email, web hosting, file sharing, and proxy services and servers

Verizon terms:

> You also may not exceed the bandwidth usage limitations that Verizon may establish from time to time for the Service, or use the Service to host any type of server.

AT&T terms:

> using such account for the purpose of operating a server of any type;

Sources:

https://www.xfinity.com/corporate/customers/policies/highspe...

https://www.verizon.com/about/terms-conditions/verizon-onlin...

https://www.att.com/legal/terms.aup.html

View on HN

hey jawns, great question. I'm Giri Sreenivas, co-founder and CEO of Helm. To answer your question, ISPs block port 25 and email service providers typically reject emails coming from residential IP blocks.

To build a plug and play solution, we knew that our server could not require listening for inbound connections on a residential internet connection. So we set about looking into how we could route traffic to and from a home server but we needed to do this in a way that prevented us from being able to spy on traffic. We investigated solutions like sshuttle and eventually settled on the combination of a simple iptables configuration combined with a VPN connection. Helm establishes an outbound VPN connection to a dedicated EC2 instance with an iptables configuration that routes packets to and from the connected Helm server. The EC2 instance also has a static IP address associated with it.

It's important to stop here and explain that the only way this architecture is viable while adhering to our design tenet of knowing as little about our customers as possible is because of the Let's Encrypt project. Every Helm server has a unique domain associated with it and trusted certificates for that domain are fetched from Let's Encrypt. We strive to ensure that all inbound and outbound traffic routed through the EC2 instance is using TLS with these certificates from Let's Encrypt. This way, our EC2 instance is effectively just an extra hop on the Internet.

I hope that answers your question, let me know!

For the most advanced of users, would you opensource the server so that we can host our own gateway servers instead of relying on Helm? That would solve the "what happens if Helm goes down" question and "how do we trust Helm" question.

Still wouldn't solve "how do I know my emails won't end up in spam" but at least we're getting closer (to at least what I would want to pay for.)

wouldn't that be postfix and a caldav server?

Thank you for this very informative reply. (I hope you'll put this information in a more prominent place on your site.)

I found the answer by clicking Technology from the top menu, and the explanation is the very first paragraph to be read.

“To a unique gateway” with a static IP is hardly an actual answer. Under whose AWS account is this server provisioned? Who has root?

It was enough to answer user jawns' question.

I thought that sending email from EC2 instance was not allowed and only option was using their SES service.

I'm pretty sure it's allowed, it's just that you'll get caught in every spam filter. I don't know if they've considered that problem, or they're just hoping that using the same IPs long-term will fix the problem in reputation-based blacklists.

You can request email sending support when you set up reverse DNS.

I guess email can be sent from the residential connection but recieved through EC2?

You can send email from an EC2 instance but good luck getting anyone to accept it. A lot of email providers block EC2 wholesale, or if they do accept it you are going to have to have a long standing reputation.

What do you mean by blocking "wholesale"? I started hosting an email server in EC2 and the worst I've had is my emails going to a spam folder if that person hasn't received an email from my address yet (and never after they've marked me as not being spam). That happened surprisingly rarely and didn't feel like much worse than I would get by just sending people email from gmail with an address they don't know. I don't think things are as bas as you make them out to be.

edit: I guess I should be clear that I have an elastic IP (which is free) and setup reverse DNS and DKIM and SPF, but I think those are fairly standard now a days (I don't know honestly I've only run an email server for a few months).

It depends on whom you send to. Like ironically I sent an abuse complaint to Verizon for a spammer and got rejected because they blocked all of Digital Ocean's IP space. Yahoo was particularly difficult too sending me a response saying they won't take my mail immediately on a single email to my brother. I had to go through a lot to get that fixed. Again this was due to being on cloud provider IP space.

GMail is more reasonable with perhaps being spam filtered but never blocked outright. I have also been blocked by government labs and academic institutions. I also have complied with RDNS, DKIM, SPF and got a top score on mx toolbox. Now that I have been up for a while I have had less issues besides with the ones that block cloud provider spaces.

Microsoft is the toughest one. Fortunately, I don't have friends that use outlook.com or w/e

Does your email get blocked if it is sent to a business on O365?

haven't tried in a while. It can, they dont' follow all the rules and do a little more blocking in the interest of their users or based off a ML spam detection or something.

Some things that should be delivered are not. I'd have to dig back into this to see what the exact issue is.

unfortunately DO does not seem to be as active as Amazon in maintaining the reputation of their IPs.

Deliverability is a moving target, so you can’t really rely on your delivery metrics from last week.

Why? The SPAM Scoring Industry is a kind of monoculture that will impede or cancel delivery of messages. Most big email providers outsource SPAM scoring to a third party like Symantec or Brightworks. And when your email is found offensive by Brightworks with one of their clients, you’re banned on all of their clients. Part of how SPAM scorers gather intel us by hooking into the CFL system so they get a notification when a user hits the junk button to delete an email. Another way is by checking for mass duplication in your emails. Another way is tracking open rates via the email provider’s UI sending metrics to the scorer’s APIs.

And then there’s the CIDR block lists they coordinate and distribute as a courtesy for their customers. So you might be able to deliver to @gmail.com and then @yahoo.com won’t even take a connection from your server’s IP.

Why does all this happen? According to my friend who works for a midrange ISP on their email service, they have about 120PB to store real email. And the amount of SPAM they reject outright (never reaches any box, not even the junk box) is 93% of all their email traffic. They simply can’t afford to store all the SPAM.

This is very consistent with what our experience has been with Elastic IPs combined with email authentication and blacklist monitoring.

> I guess I should be clear that I have an elastic IP (which is free)

Free when in use, you pay for it when it is not in use.

This is not a god situation. So, EC2 are handy and flexible servers, but not really because some arbitrary internet services are banned, and in all of a sudden your whole setup depends on the cloud provider. Talk about tight coupling. We go backwards. This is really sad.

You can send email using EC2 instances, including mass commercial campaigns (aka "legal spam"...).

However, there are a few things to do, more specifically, you must contact AWS to get "clean" IP ranges (fresh IPs, never allocated to instances), sign some agreements and pay additional fees.

It's not exactly as simple as an API call to create an ec2 instance, but it's doable.

With random IPs, there is a good chance indeed that it is already burnt by a previous allocation.

> I thought that sending email from EC2 instance was not allowed and only option was using their SES service.

Amazon EC2 throttles traffic on port 25 of all EC2 instances by default, but you can request that this throttle be removed: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-p...

Doubt that AWS would allow anyone to send on behalf of 3 parties like Helm appears to do though.

It's interesting that Amazon is portrayed as the "massive corporate server" provider that stores your email "outside your home" on your homepage, yet you use AWS EC2 instances to pipe email traffic to/from Helm.

I understand that it's just an encrypted VPN connection, and are not actually storing email on the EC2 instances. But is there any way for your customers to ensure that? Can your customers shell into the Helm and/or EC2 instance(s)?

We will be making public the configuration for these instances as part of what we publish in open source. We haven't considered allowing customers remote access to the gateway but we will based on your suggestion. Thanks!

If you _do_ "consider it", I hope you discard it as an awful idea pretty much immediately.

I'd suggest allowing customers who're concerned to run their own instances with your code on it (perhaps a Docker image?) - but giving random customers shell access to gateways you're responsible for (at least to Amazon) - would be insane...

Signal/WhisperSystems are doing some interesting work on how to prove the code running on their servers is identical to their published and auditable code - might be worth checking that out (for a post MVP roadmap idea).

Yeah, there'a a lot of confusion about "the cloud". Consumer SaaS (Gmail, Facebook, Alexa, etc.) is "evil" and privacy-invading but B2B IaaS (EC2, GCP, etc.) is not bad. Often these services come from the same companies so we can't simply claim that Amazon or Google are wholly good or evil when it comes to privacy.

If you are proxying the content with a VPN with a static IP on an EC2 instance you cannot police people sending out spam as you cannot see and meter the SMTP traffic. So does everyone get a dedicated instance and IP? If that is the case people are going to have issues getting their email accepted by almost all providers due to the IP being new and on a cloud provider block. If it is a subset of IPs that you create a reputation for and comply with DKIM, SPF etc how are you going to keep it from getting ruined by bad actors?

I am glad you are doing this because running a mail server is non trivial. I have done it for a long time now and love the fact that I own my email identity. It is one of the few things left you can own online.

I think this is the biggest problem. If there are a lot of bad actors, you drag down the whole system, but if you try to prevent bad actors you run into a lot of issues.

A hard problem, and I don't envy anyone trying to solve it.

No offense, but given that you are making a product that has a much higher potential to enable bad actors than usual, isn't it kind of you/your company's job to try to solve it?

EDIT: Just realized I responded to the wrong person :(

No, it's not. In fact it's your job to try and police yourself. But you probably on someone else to control you don't you?

I mean, my thought is that if a high volume of spam causes other email servers to block Helm, then it makes it unusable to the good actors in the system. I didn't see the CEO address this.

Or, maybe I just misunderstand smtp idk

Yeah, that's how I understand the issue too. I don't think there's an easy way to do things, either you end up blocking some people with a legitimate use case or you end up becoming a spam farm.

The person you are replying too isn't the CEO. Just another new user (that's why the username is in green).

You learn something new every day, I always assumed the green meant OP, like how reddit uses blue. I didn't even notice the change in username Thanks!

Thanks for teaching!

Spammers can already get mail servers without a problem. This doesn’t make that easier, because it’s already as easy as it can be.

Hi graybolt, I'm Dirk, co-founder and CTO at Helm. Each Helm Personal Server is assigned their own IP address. We make sure to only use IP addresses that haven't been put on blacklists. If people abuse the service by sending spam it will only affect the reputation of their assigned IP and won't cause harm to the reputation of other Helms.

How do you plan to protect users from themselves? I.e. 2 charater passwords.

If you're spending $500 on something to help keep your stuff private and secure, you're probably not a 2 character password kind of guy.

Oh boy, I know people with a fiber drop, 25tb raids with baby server farms and single character password. I think you highly underestimate the lazyness and/or stupidity of people. That doesn't even cover fishing.

Secondly, I think you underestimate the time intensive work that goes into clearing up an IP. I've run mail servers with users in the thousands. It's basically a full time job to keep a single ip clean. And that's with a half or less percentage of clueless users. I'm unsure how this will scale to hundreds of IPs let alone the thousands(x100) that would probably be needed to make creating your own hardware profitable.

Third, you're going to need to reach incompetent customers to make this profitable.

Yeah that isn't sufficient. Most people are going to get their email rejected or spam filtered from many sources. Having an IP that is not blacklisted is not sufficient to have it have enough reputation to be accepted by large providers.

There's an easy way to make Helm entirely uninteresting to spammers and that is for the server to limit the number of outbound emails that can be sent at a number that normal people would never exceed but that doesn't allow enough volume to be interesting to a spammer. There are much easier/cheaper alternatives for spammers today too.

Thanks for the question and your support!

Since most email's not encrypted, how is having each Helm user's email hop through your server any better for them in terms of privacy than just hosting their email on a remote mail provider in the first place?

You could still record every incoming and outgoing email as it goes through your server, couldn't you?

I really don't see the advantage of Helm.

Most (gmail claims ~90%) email is encrypted with opportunistic TLS in transit and can't be passively monitored.

https://transparencyreport.google.com/safer-email/overview?h...

Further, "the provider could intercept email" and "the provider stores all email" are very very different.

What's going on there with the "Support for encryption in transit" section?

Overwhelmingly at 0% in most regions which they say are:

> domains in terms of volume of email to and from Gmail, in alphabetical order

Something doesn't add up there.

The table does not include the "green" domains by default, you have to select it.

This is transport encryption, not actual email encryption.

What else runs on that EC2 instance?

Also the fact that we can't run servers from our home connections is ripe for a challenge if we ever get net neutrality protections back.

The 2015 Order said this, "A person engaged in the provision of broadband Internet access service, insofar as such person is so engaged, shall not block lawful content, applications, services, or nonharmful devices, subject to reasonable network management."

I would argue that banning personal email servers or personal servers at all is not reasonable network management (e.g. a nest thermometer or a smart microwave or an Alexa/Siri thing is a server), and if we're looking to explore home appliances that decentralize the web, we need to ensure that broadband providers' policies don't block them. Google Fiber screwed this up too.

doesn't matter if we are contractually allowed to run them or not. The dynamic IPs of consumer ISPs are all blacklisted by the spam blockers. So, you could receive mail, but no-one would ever receive yours.

> hey jawns, great question. I'm Giri Sreenivas, co-founder and CEO of Helm. To answer your question, ISPs block port 25 and email service providers typically reject emails coming from residential IP blocks.

> To build a plug and play solution, we knew that our server could not require listening for inbound connections on a residential internet connection. So we set about looking into how we could route traffic to and from a home server but we needed to do this in a way that prevented us from being able to spy on traffic. We investigated solutions like sshuttle and eventually settled on the combination of a simple iptables configuration combined with a VPN connection. Helm establishes an outbound VPN connection to a dedicated EC2 instance with an iptables configuration that routes packets to and from the connected Helm server. The EC2 instance also has a static IP address associated with it.

> It's important to stop here and explain that the only way this architecture is viable while adhering to our design tenet of knowing as little about our customers as possible is because of the Let's Encrypt project. Every Helm server has a unique domain associated with it and trusted certificates for that domain are fetched from Let's Encrypt. We strive to ensure that all inbound and outbound traffic routed through the EC2 instance is using TLS with these certificates from Let's Encrypt. This way, our EC2 instance is effectively just an extra hop on the Internet.

> I hope that answers your question, let me know!

This doesn't seme to address the question of whether this violates the ToS, regardless of whether this is technically feasible.

Gray area IMHO. Isn't Dropcam basically a server streaming video to my phone?

Ha, but that's "okay" because it's a big company. They never have problems with being used for spam - of course I'm being sarcastic.

I'm pretty sure that video feed is actually sent to your phone through a Dropcam cloud server. Your Dropcam is a client which connects to the cloud server, as is your phone.

Arguably that's the exact same architecture Helm are describing. The EC2 instance your Helm box VPNs into is (arguably) "the server" - in that it's the "public service" endpoint. A good lawyer could eloquently argue that the Helm device on your residential internet connection is no more "running as a server" than the Dropbox or Google Drive apps on your laptop or phone...

(Note: I've been doing a similar home-rolled version of this, where I have a mail server under my couch that opens a reverse ssh tunnel and forwards port 25 and 465 from whichever transient EC2/Azure/DigitalOcean/Hertzner/CloudAtCost VPS Ive got listed as my MX records. A little bit of Route53 API automation, some Ansible to set up the ssh tunnelling, and some "canary" gmail and live.com email addresses to check outbound deliverability when I go to switch VPSs... It's been running pretty much untouched since 2014 or so...)

If I host a Quake 3 server I’m in violation of the TOS.

It can be argued that using a browser or any other client violates that language by sending responses to requests.

The ISP won’t do squat if it’s encrypted; they have no idea who is being connected to and what’s being sent.

A TOS is as broad and vague as they can make it. A good lawyer could undermine such language if it went to court.

Ultimately the TOS exists so the provider can discontinue your service, so it doesn't have to be super tight legally.

We don't believe it does. ISPs will only see encrypted traffic (a VPN tunnel to the gateway) so it's unclear how they will figure it's associated with a server.

Whether or not ISPs can figure it out is completely orthogonal to whether or not it's allowed.

Outgoing email from EC2 nodes isn't trusted by recipient domains either. That's why AWS wants you to use SES instead.

Amazon invests in ensuring their Elastic IPs are not on blacklists. Less than 2% of IPs we get through AWS are ever on a blacklist and when they are, we cycle through until we get one that isn't.

I'm not sure how they can invest in that.

I've seen amazon ec2 ips being used for ddos attacks and I blacklist the entire range for many of my websites/projects. The vast majority of visitors we get from there are abusive.

But you pay for this EC2 instance, and all traffic flows through it.

Honest question: What stops a malicious employee on your end sshing to this server and dumping plaintext messages from memory? What stops a court from ordering you to do that?

Even if you disable remote access, what stops someone from adding a new LaunchConfiguation that enables it silently on the next instance rotation in spite of whatever configuration is in place today?

At the end of the day it seems like you -can- spy on the traffic just as easily as you could if you were running the smtp services on an ec2 instance directly.

Given that, what is the value proposition here?

(Or if I am totally wrong, by all means call me out accordingly)

Well the E-Mail server still runs locally. While they could intercept traffic on their VPN endpoint, the traffic should be encrypted (TLS). However, I am not to sure if all e-mail servers speak TLS to each other.

Well if it does VPN first, then initiates the SMTP connection with TLS on the local smtp server all the way to the RX mail server, then this works out fine.

A lot of mail servers don't support this though, so it would be on the client to also be able to ensure it will not relay mail except to TLS endpoints verified by a well known CA.

In my experience this is rarely the case, but if it is and Helm is willing to tell end users "sorry I can't safely send mail to this endpoint" then I could see some value to this approach.

Yes - we initiate a VPN connection first to the gateway, then inbound/outbound connections are over TLS. Over 92% of email traffic is over TLS and we will be exposing an option in the future where customers can require it or reject emails.

In all honesty, couldn't this be a question to Amazon for anything that ever runs on any EC2 instance? What makes you not distrust any cloud vendor when they manage every bit of your information including keys.

Although, if they have to route stuff through EC2 instances anyway, I could just start jedieaston's homegrown EC2 email service, let customers pay me $100 a year to get them a domain name and spin up a email server in a EC2 instance and give them a login, then they don't have to have a box at their house which is liable to ISP and power outages. And you get the same amount of privacy that you get with this box (so about as much as you trust Amazon).

I -do- distrust all cloud vendors. My keys all reside in physically controlled HSMs.

Because traffic to and from the server will be over TLS, there won't be plaintext messages in memory on the gateway. We specifically designed to avoid the problems you have outlined.

I believe you will be more successful if you establish two things, first your own ASIN with a couple of class C IPV4 blocks and an IPV6 block.

Then you create an infrastructure for relaying the mail from your boxes to the Internet. Then you work with the various spam agencies to create both a way to respond to spam complaints and to detect and throttle or cut off spam senders. You'll find that spammers will offer to pay you a premium to "look the other way" but don't take it, many good companies died going down that road. Without the spammers it will be harder to make your numbers but concentrate on keeping your efficiency high and ultimately you will be better off.

You don't talk a lot about data protection on site for things like disk failure. What do you do in that regard to keep people from losing all of their mail if the disk goes tits up?

and to detect and throttle or cut off spam senders

Isn't throttling outbound email count/day from the start the only real solution?

In my experience you can't know what is 'normal' until you have seen it, so fixing the rate at the start would be unduly onerous.

People have lives which can sometimes look spammy, like you are made the coordinator of the school potluck and suddenly you're sending email to 150 parents asking them to volunteer to bring food. But after that event you go back to your regular rate.

Because this isn't a "PC" in the sense that it is more difficult to be overtaken by a virus and start sending spam without your knowledge, and as a mail service provider you know that email originating from the device has to come from a specific domain, you have a lot more tools to detect that someone is being a bad actor or not.

No, the way the big boys get around this is outbound email filtering. Limits yes, session and connection heuristics, reading your outbound email to see if you're selling dick pills.

That EC2 instance is going to need whitelisting and constant vigilance that you're not sending commercial email or they'll block that port too. What prevents me from deploying a few hundred Helms to send spam?

commercial means spam? I can't use this for my non-spam business? MyStartup.com? A few 100 helms would cost a lot (500*200 = 100k), no one will spend that much for spam farm, you'd do it on the cheap.

if your company folds and the cloud service goes offline, does that render my helm useless? that wouldn't make me feel like i "own [my] email".

Two things: we will run the service in perpetuity as long as there are subscribers and we will be open sourcing what is required to run the service on your own.

I would first try using port 587 and only afterwards route through Amazon or something.

What VPN solution are you using? Wireguard or something else?

Do you have a plan to help make email security features easy to consume: SPF, DMARC, MTA-STS etc.?

Is there a way to opt out on the information that is collected?

I looked on your site but it does not show a logical architecture which might be useful for some of us.

We are using StrongSwan right now. We've taken a close look at WireGuard but have not yet completed our evaluation.

We automatically configure SPF, DKIM and DMARC for our customers. We are also investigating MTA-STS.

Device diagnostics are opt-in by default so they are not collected. Customer data like shipping and billing information is not opt-out unfortunately as we need to be able to process payments, ship the unit and track warranty coverage.

Appreciate the feedback on wanting more architectural details. This will be coming in a series of technical posts explaining how we designed and built the product. Stay tuned and thanks for your questions!

Holy crap, US ISPs are completely absurd. This definitely isn't a thing (or at least not enforced in any way) in Canada; most of my friends run on-prem web services out of their basements or closets.

In the US it's standard that residential accounts don't get to do that, but business accounts (which are usually double the price for the same speed but come with better/quicker support, particularly when physical lines are down, and an open connection) are allowed to run on-prem. And usually with a residential account you don't get a static IP as an option, but if you're lucky you can pay extra for one.

> And usually with a residential account you don't get a static IP as an option, but if you're lucky you can pay extra for one.

I use a VPS as a proxy. SSH with AutoSSH. I use a VPS ($15/yr), map the ports from the VPS to the server at home.

For example, when you hit 80/443 on the VPS, it's routed to a reverse proxy in the apartment, then to the correct service.

Not a bad setup.

I tried to get a business account once at Comcast, and they wouldn't give me one that terminated at an apartment. : /

That's weird, I honestly wouldn't have expected that. They gave me a little resistance with one terminating at a home but ultimately they did it. They probably start to weigh the pros/cons (ie the money) of business level service to large residential buildings and decide it isn't worth it. Maybe too many variables once the line enters the building?

Maybe the building part. But I've never had any issue - at three homes - with Comcast Business being run into my home garage.

It's not enforced. I've had HTTP and SSH available on Comcast and Verizon lines for... decades, I guess. No one cares.

SMTP is more problematic because of spam: outbound traffic on port 25 is blocked, so a true home mail server won't work without a reachable gateway mail server somewhere else. That's basically what the linked product is: they manage the protocol side of the service on your behalf, and forward all the content to your local device which connects to them via some internal protocol.

AT&T in the midwest US just blocked port 25 a few months ago. My nightly e-mails for system updates stopped coming in, and now I either have to shuttle them through an authenticated submission port or pump them over a VPN to my e-mail server. :-/

An ISP I worked for blocked port 25 in 2009, but it was easily reenabled by the customer checking a box in their online portal.

Considering how easily it is to setup authenticated SMTP and how effective it is at reducng spam for the ISP, I'm Surprised it took AT&T this long.

You can pay $50 and they will open it once again for you. I only know that after much trial and error troubleshooting why my public NTP service doesn’t work (port 123 also blocked).

Can the normal customer service do that? And is it $50 a month or a one time fee? Were you able to unlock outgoing port 25? (Fellow AT&T user here)

It’s a $50 one time fee. You need to call their “premium” service. Not sure if they do it per port or what, but I asked them to open all my ports and verified 25 is accessible (123 udp inbound still blocked for unexplained reasons).

They’re still clueless. I tried to explain that it’s being blocked by AT&T and not my router but eventually I just gave up. Their process involves a logmein session where they take control and mess with your router. Gahd it’s awful.

They also randomly added my “device” (home server) to the DMZ so all of its ports were exposed. Be very careful.

>123 udp inbound still blocked for unexplained reasons

NTP was part of a massive DRDoS not too long ago. It's possible they pruned it somewhere much further up the network under the (not insane) assumption that most customers don't need to run their own time servers that answer public queries.

Assuming you control both sides, which sounds like you do, just run it on a different port in addition to 25.

Ironically it doesn’t look like they restrict sending mail in the above quote, only serving it. If that’s a violation, so would be using your browser.

In Ontario, Canada I know that Bell, Rogers, and Teksavvy all block outbound TCP 25 for their residential service. I can't comment on inbound TCP port 25 though.

Read your terms of service. The same section is definitely present for all Canadian ISPs as well.

"The residential Shaw Services are designed for personal Internet use. You may not use the residential Shaw Services for commercial purposes. You may not run a server in connection with the Shaw Services nor may you provide network services to others via the Shaw Services. Examples of prohibited servers and services include but are not limited to mail, http, ftp, irc, dhcp servers, and multi-user interactive forums. Some business services may be exempt from these limitations."

https://www.shaw.ca/uploadedFiles/Terms_of_Use/Acceptable_Us...

I'm so glad to be living in Europe.

When it comes to consumer internet services, the US is a 3rd world country, which is kinda odd considering most of the western world does their business there.

I just checked the terms on my 300/300 fiber connection, as well as my (backup, company paid) 25/5 ADSL.

They're almost identical:

* no spamming. * no racism/unethical behavior. * no portscanning. * no illegal downloads/uploads.

Besides that i can use it for whatever i like. They block port 25 though, and you can only get it opened by purchasing a commercial connection. It has a dynamic IP address that only changes when i reboot my modem, which happens once every 2 years or so, so practically static IP :)

The ADSL has all ports open and a staic IP.

>no racism/unethical behavior

That seems to have potential for abuse.

I don't think any ISP has any control (or terms) about it. It's just that law enforcement agencies can ask them for logs on that basis. Whether or not hate speech laws can/are abused is a different thing. But it's a general legislation problem, not a net neutrality one.

I know a lot of ISPs in europe who block SMTP ports to prevent SPAM.

It's true but at least mine (free.fr) lets you enable it through the administration interface for no additional fee. It's disabled by default though, and it's probably better that way.

> They block port 25 though

They don't explicitly disallow it in their TOS, they just make it impossible by disabling the underlying tech.

And this > no racism/unethical behavior. * no portscanning. * no illegal downloads/uploads

"unethical" behavior is the most arbitrary, un-objective clause one can ever have. Your ISP may find your hosting an email server "unethical", and this clause allows them to ban you.

Europe is NOT superior in any way

unethical behavior is my (bad) translation. The original Danish wording is restricted to hate speech.

They also specifically disallow distribution/downloading of child pornography and leaks like "fappening", which i translated to "illegal downloads/uploads".

The list of things that are disallowed is very specifically worded in Danish, as legalese usually is. Furthermore it is also customary in Denmark to allow all traffic. in or outbound.

All "metadata" is logged for 5 years, mandated by law, so every IP i connect to is there along with port, duration, protocol (if available).

I'm so glad to be living in Europe.

Germany's third biggest city, I can only get 50/10 Mbit, maybe 100/20 - no fiber in sight. No static IP and no guarantees anyone will accept mail from this dialup subnet.

I guess, you are glad leaving in Germany. A country with a bad state in terms of Internet.

In Germany, with Unitymedia Buisness, I get symmetric 100Mbit/sec over coax (even in mid-size cities), a static IPv4 adresse and excellent customer service. Price tag: 35EUR/month.

In US, I have access to the same plan at same price point. But I have a semetric 1000Mbps for 85 USD. I can get a static IP but I see no need with DNS. Not sure how the customer service is, I haven't called in 2.5 years that I've had the link.

Seems like a similar price I saw on AT&T FTTP plans and Comcast’s cable internet plans for 100mbit.

Static IP might cost extra.

I pay AT&T $80 a month for symmetrical 1Gb FTTP with no data cap.

Italy (Milan): 1Gbps/200Mbps FTTH. About 30€/month.

I just checked, it's not available :P

From my experience, at least in Munich it's hit or miss which of the 2 cable company services your building - it's not even on the street level.

Also I'm not really complaining. Say what you will about Deutsche Telekom, but I've been a happy customer since 1998. Everytime I had a different ISP (mainly M-Net) I had more problems than uptime. This is more expensive, but I'm having less than one noticeable downtime every 2 years...

Canada. 100$/month for 150down/12 up residential. Never seen more than 50 down. Regular outages (for 30min every few days). If the US is third-world in terms of service, canada is an uncontacted amazon tribe.

In Canada. 100 CAD/month. 150 both up and down.

If you are in a major city, it might be time to check the other ISP in town. I'm glad I did.

I'm on Vancouver island. The provincial capital. There is only the one cable provider (shaw). No other landline options in my neighborhood.

Vermont. 60/6 for $100/mo. And I’m a lucky one. I have friends with 3mbit dsl and there are pockets of dialup

Not available, in Berlin.

No static IP is a good default for private customers, I think, due to privacy concerns. Static IP opt-in would be nice.

I don't know what the rest of the country looks like, but I have home Comcast in the US and have been self-hosting a server on port 80 with a similar more-or-less static IP as you've described for well-over a decade. Many of my friends have the same setup. It never even occurred to me that Comcast cared. All ports are open (maybe not 25, I haven't checked.)

I guess the terms of service allows them to shut someone down if they felt like it, but I wouldn't really worry about it. If you have a site that generates so much traffic they even took notice, I presume you'd want to be on a real hosted environment anyway.

This is no different than the US. No one has 25 open, and the server clause is only enforced if you try to do something in the 'unethical behavior/illigal file transfer' department. But in America, a 35$ internet connection needs a leagal contract to help mitigate the lawsuits and grey areas.

The telcos only enforce the server rule if you are causing problems like doing something illegal, torrenting, or maxing out your bandwidth 24/7. I’ve had multiple servers running over the years and never had any issues with Comcast or AT&T.

Generally they don’t care if it’s for personal use. I’ve heard of them shutting people down for something they saw as business related. They didn’t really get shut down, it was more like a friendly “We see what you’re doing and a business plan would allow you to do it for $30 more a month”.

With AT&T, I was able to call and get port 25 opened up so I could send email. to me it seems like they do it to prevent malware spamming from people's homes.

What ISP do you have that you can get upgrade to a business account with the same speeds for only $30 extra a month? AT&T would charge me $300/mo for the same speeds that I currently pay $80/mo for.

You are comparing the most expensive plan. This was probably 8 years ago so I’m thinking 10-15mbit. The business plan was the entry level one.

Emphasis added:

> provide network content or any other services to anyone outside of your Premises local area network

I'm not sure if Verizon has the same intention, but if they take their own wording exceptionally strict, you would be in the wrong whenever you play a multiplayer game and end up being the host.

Generally in my own experience they don't want you hosting a service opened to the general public running all the time. I think running an open mail relay would get you banned very quick. It seems like this product is intended to be used purely for yourself.

I’ve talked both Verizon and Frontier about servers and both have basically said the same thing, if it’s private and locked off it’s fine. Meaning as long as it’s not public.

Now the terms still would give them an out if they decided they didn’t want you, but honestly as long as you’re not hurting the network they’d rather take your money.

I've run my own email server out of att, comcast home, comcast business, and centurylink. All I've ever had to do was call them up and ask them to open the ports.

Presumably there's a legal argument that you aren't providing a public service. Helm is tunneling SMTP connections from their cloud-based servers to your device over an encrypted connection, so you could claim you're really consuming their service, not providing your own. But I wonder how much VC money you need to outlast Comcast in court...

My suggestion is to run an email server inside your home that connects to a single server on the internet (like a VPS) that routes your mail for you. It's a bit more complex to setup but much more secure and reliable and almost certainly won't violate ISP rules as long as you keep it secure.

You are misleading us by editing out the rest of the sentence. What you stated is for dial-up service.

AT&T terms: >• with respect to dial-up accounts, using any software or device designed to defeat system time-out limits or to allow Customer's account to stay logged on while Customer is not actively using the IP Services or using such account for the purpose of operating a server of any type;

I have many servers on att internet, including email.

This is pretty important distinction.

First, anyone who has talked with me for any length of time will have no doubt heard my rant that data belongs at the edge :-) so I'm a big fan.

And yes, the no servers clause is an issue, it was raised initially by people doing peer to peer torrenting, and some folks running servers.

Enforcement is a bit tricky though because folks like Comcast and Verizon get so much value from being able to see all of your Internet traffic that they won't actually cut you off for running a local server but they will be passive aggressive about it. For example, they will start changing your IP every couple of hours (they set the DHCP lease time to be low and force the DHCP server to always give you a different IP).

The common solution is a VPN tunnel which is what Helm is doing, but that tunnel has to end up somewhere so that can be a problem if that 'somewhere' is commonly used by bad actors. (Like say in Ukrainian data centers)

I expect that this restriction will go the way of paid SMS messages eventually but for now it is going to be troublesome.

I've run public-facing servers on residential connections numerous times. (I did once yesterday just so I could watch my 3D printer from remotely.) If you aren't hogging bandwidth or committing crimes, it's unlikely they will care.

Also IANAL but "services to anyone outside" does not sound like it includes un-firewalled, password-protected, services for personal use. The word used is "anyone outside" not "any machine outside". The resident themself would presumably be an insider regardless of their physical or network location.

Also I think a reverse proxy with end-to-end encryption could solve the problem with no public-facing open ports. That doesn't count as a server in my book.

Hmm, the terms for my CenturyLink fiber connection explicitly allow running servers (with some reasonable limitations): "Service may be used to host a server, personal or commercial, as long as such server is used pursuant to the terms and conditions of this Agreement applicable to Service and not for any malicious purposes. Malicious purposes include without limitation Spam, viruses, worms, Trojans, Denial of Service (DoS), etc."[1]

1: http://www.centurylink.com/legal/en/highspeedinternetsubscri...

Came here to say this. Aside from some customer support issues, I've had a very great experience with CenturyLink fiber. I have multiple static IPs and run a plethora of externally available services. I actually moved everything from Linode and digital ocean to my house and bought a APC battery backup and outside me unplugging my stuff to move it around, I've had no downtime at all.

Meanwhile, my ISP's customer service gave me a few pointers on how to get my self-hosted website to work with a dynamic IP address.

My Dutch ISP gives me a static IPv4 address (besides an IPv6 netblock) and allows me to purchase additional IPv4 addresses. They also offer various levels of port filtering, from no filtering to filtering port 53, etc.

(Combined with fiber, it's ideal for a small home server.)

Comcast in the US doesn't give residential accounts a static IP, nor do they give you the option to purchase one. You have to sign up for a business account with a 2 year contract term and a pretty draconian cancellation policy (basically the entire rest of the term is due when you cancel).

To be pedantic, when you provide content to Facebook, you are serving them data, right? When you upload pictures to Dropbox, you are serving, right? Slingbox? Security webcam? Facetime?

I don't think there is a good enough definition of "server" or "serving" for such restrictions to be enforceable except is an arbitrary way.

I have an MUA that retrieves email from a server and sends email to a server. It might run in a browser and interact with GMail. It might be a mobile app or Thunderbird or Outlook. It might be sendmail or postfix or Exchange. Which of these are "servers"? Which are banned and which are ok?

Usually an ISP defines it as something that allows ingress unsolicited connections. i.e. put a stateful firewall in front of it and if it requires ingress allow rules to function, it's a server.

If your ISP doesn't let you run your own mail server, they're not an ISP.

Sure. But good luck getting your mail accepted by other mail servers, coming from a broadband IP address.

I do this all the time. I'm sure some people have issues, but my experience is that this is largely overblown

Comcast doesn't let me run my own mail server, but I think Comcast is still an ISP.

Never heard about that in Kazakhstan. I'm hosting HTTP without any problems (though those are only my personal files, so no significant traffic, but considering that my torrent upload is tens of terabytes/month, probably nobody would notice that). Didn't try E-mail, doesn't make sense without reverse-PTR DNS record, and I don't know how to configure it.

That's not a real Internet.

For AT&T, that restriction is only on dial-up accounts:

> with respect to dial-up accounts, using any software or device designed to defeat system time-out limits or to allow Customer's account to stay logged on while Customer is not actively using the IP Services or using such account for the purpose of operating a server of any type;

AFAIK, AT&T does not prohibit running a server on broadband accounts.

What's being done by Helm is not much different than using Back to my Mac or Plex or SlingTV.

In any case, these ToS are over-broad and most customers probably violate them every day, especially the copyright provisions. The ToS are not enforced to the letter but allow the ISP to terminate an account if the violations are egregious. I don't think running a Helm server would get you booted.

OK, tangental but concerning. According to that Comcast quote, are you not actually allowed to host a personal website using bandwidth that you pay for? Or is it specifically forbidding "public" web hosting, where "anybody" is allowed to host their own sites?

I think it's the former; you can't host any site that is supposed to be accessed by the general public, only something like a control panel for your NAS or security system or such.

This serves to protect them technically (residential systems are not designed to withstand a large number of inbound requests), legally (you can't sue them for failing to serve your site) and of course to promote their more expensive business lines.

Even if they don't block, if you run an email server on an ISP ip block, a lot of other mail servers will refuse you connections.

If you're going to tin your own mail server, it's paying for a good VPS. Beside the guaranteed static IP, being on an IP block with a good reputation, good VPS provider have redundant power sources and console access over the web, which you are unlikely to have either from home.

I use AT&T and they removed the port 25 block on request. In my experience, they do not enforce any policies regarding self-hosting. I think they have boilerplate that they would use if one were to continuously saturate their upstream, but I've never seen them doing anything to affect my personal services.

It's not necesarily banned, but very often port 25 will be blocked. Additionally it's pretty likely your email will be marked as spam if it comes from a residential IP. They must have thought about this though, so maybe they have their own SMTP servers that emails go through.

Apparently so:

"Helm connects securely to a unique gateway, which is assigned a static IP address so Helm is reachable by other mail servers and secure TLS sessions can be established."

Which I dont see the point of then. That way they are your gatekeeper of your mail/files etc. Not much of an improvement.

Agreed. I don't see how this is any different from a regular email server, with a local client that pulls emails over IMAP and deletes them remotely.

In my country, ISPs block SMTP outbound traffic by default but you can toggle it yourself. I thought it was pretty universal behavior. I mean, if you're using your actual domestic line to send spam, it'll be reported to your ISP pretty fast.

Most games on consoles setup listen servers, which is essentially the same thing.

You are correct. However I think in practice you can get away with it if you keep bandwidth low. I've been running a OwnCloud/NextCloud server from my residential Comcast account for years with no issues.

Meanwhile, I installed backblaze on my home machine, which started backing up around 500gb of my disk, and summarily got a message from my provider that outbound traffic of 30gb is an ‘inconceivable’ amount of traffic during normal use, and if I could please stop, or else (lawyers).

I wonder what happens if nextcloud does a full sync to a new device.

What provider? That behavior deserves a name-and-shame.

As far as what happens with a full sync: it's not really doable outside of the LAN for several reasons. One is I have a data cap from Comcast of 1 TB/month. Another is the upload speed is only 10 Mbps. That's actually one of the reasons I went to self hosting.

> if I could please stop, or else (lawyers).

Lawyers, really? Why wouldn't they just cancel your account?

Yes. Many also block ports, like incoming port 25 (SMTP.) I have a "business" cable internet account and have been hosting my servers for years. It is obviously more expensive.

The AT&T one only has to do with dial-up accounts and is mainly about maintaining a connection with dial-up when not actively using it.

Just another reminder, terms of service are bullshit. Most people here likely violate the terms by using ngrok.

Which totalitarian state do you live in?

One of the reasons you need net neutrality.

Frightening to see this downvoted here.

Even if you could send it, someone has to receive that email on the other end and the residential ips are usually blacklisted.

Plus they tend to block the ports you need to run something like this.

Each Helm gets its own gateway server with static IP address that the Helm establishes a VPN connection with. Port 25 is open on the gateway and the packets are forwarded to the Helm. This is how we work around residential ISPs blocking port 25.

This doesn't necessarily mean you're not violating their ToS.

Reply on news.ycombinator.com