Hacker News Reader

Comment by throwawayboise | Hacker News Reader

In the ISP's defense, 99% of the time an SMTP sender in their residential address space is going to be a compromised device sending spam. It's pretty understandable that they would just decide that pissing off the relatively very few customers who want to run their own mail servers is a cost they are willing to accept.

View on HN

I bet it’s more than 99% too. Even amongst the tech savvy, there’s special level of dedication to run your own mail infrastructure. It’s like one in 10-25K.

There’s running your own mail, then there’s running your own mail from residential. The dozens of us who do the former mostly don’t do the latter, thanks to the obvious vicious cycle.

Though I belong to the former, I do use my residential ip as a failover server for when my primary server is down, to not lose incoming emails.

What’s the benefit of this over a cheap VPS? Privacy?

Just cheaper. I mean again I do pay for a server in a datacentre as my primary server. I have a home server too anyway, so using it as a mail failover adds redundancy for free.

Also I am using windows (smartermail) so even a cheap vps isn’t that cheap.

No special level of dedication needed. I'm one of the many who run my own email infrastructure and it is very little work. Nearly none, really, aside from initial setup.

However, I don't run it from home over residential ISP connection.

Still, it’s not trivial to set up, particularly if you want TLS connections, monitoring brute force attacks, etc.

Not the poster you are replying to, but as a self-hoster (on a static residential IP though) I don't necessarily care about brute forcing that doesn't completely kill off my connection (I've actually got two residential connections used as fail-over: 1Gbit/200Mbit + 500Mbit/50Mbit, though set up as round-robin on the incoming domains [same priority]).

I mostly run the mail for my family and myself, so the attack surface is reasonably small.

My network mostly only dies when one of the ISP-provided modems slows down too much without actually killing off the actual connection (so pings seem to keep working from my OpenWRT router to detect dead connections), which requires resetting that modem (happens only every few months, rare enough for me to bother debugging it: it's usually my dad who pings me early the next morning that his email is not working :)).

Sorry, I didn't mean brute force as in DDOS, but as in brute forcing passwords. Particularly if you run it for your family, you are at the mercy of one having a weak password, and as soon as a bot has access to one of your mail accounts, it will send spam and you can kiss goodbye your IP/domain reputation.

Yeah, I got that, and while I am mildly worried about that, it hasn't been an issue in the last almost 20 years.

I am only mentioning bandwidth because someone could easily saturate my internet connections by extensively brute forcing, and that's another mild concern (perhaps those are things that kill my modems?).

In practice, biggest issue is that Gmail in particular will never rank your server as trusted because you are sending too low a volume (how's that for an anti spam measure?), and 1/3rd of recepients report emails ending up in spam folders. Curiously, only Gmail does that.

> Sorry, I didn't mean brute force as in DDOS, but as in brute forcing passwords.

That's super easy to avoid. Use strong passwords.

Heat death of the universe will arrive before anything brute forces a 30 character password generated off /dev/random

I don't have any of my users (just family) set their email passwords, those are generated to be strong. These are not passwords that need to be seen or remembered by anyone, they just go into the IMAP client config.

I remembered finding some mails originating from my laptop in my gmail spam folder around the time I switched to mac from linux around 2012. I was tinkering with an instance of wordpress in that laptop and turns out sendmail in OSX was capable of sending out email to gmail out of the box without any configuration from my part (I don't remember configuring sendmail in that machine). The wordpress instance was simply used php's sendmail support and happily blasting emails without my knowledge (thankfully only to my own's address). I wonder if recent version of mac still ships with sendmail.

Yeah, but we’re talking about inbound port 25.

I guess the argument for inbound blocking is that its way too easy to configure an open relay which is then used to send spam.

But the outbound block would prevent the relay from sending any mail over port 25, so there's no real point to block inbound connections.

I'm thinking the ISP in upstate New York misunderstood the situation in a way similar to the comment above you.

I've no argument beyond that. You're right.

> In the ISP's defense, 99% of the time an SMTP sender in their residential address space is going to be a compromised device sending spam

99% of people don't use their home computer to write programs. Some people who write computer programs at home cause trouble. Should we therefore ban programming languages for individuals?

Most ISPs do not outright ban it. They just default to blocking outgoing port 25 packets. Usually it's a support request away from opening it for a customer, especially with a static IP address (I've done that for the last ~19 years with a Serbian ISP).

Of course, how well your support requests are handled is another matter.

Reply on news.ycombinator.com