3 ms·

This is a good idea, but there are already puzzles they have to solve (by design) that are disabled. This will sound silly, but FCrDNS was accepted almost unan

This is a good idea, but there are already puzzles they have to solve (by design) that are disabled. This will sound silly, but FCrDNS was accepted almost unanimously in 2013 when a draft IETF document was created, but never ratified, that caused all the ISP's to add generic reverse DNS for everything. This turned every home PC into a malware magnet over night. Fast forwards a little bit and a gentleman in Japan created a concept to utilize this called "S25R" [1] which is a simple regex methodology to block generic devices from sending email. Problem is, very few people implemented it and instead people opted for throwing a lot of money and anti-spam companies. Multi-billion dollar businesses were created and people like money! So anyway, the mechanism is there already to stop most of the spam, but people choose to not use it. The way it can work is that using 7 or a few more simple regex rules, almost all generic devices are blocked from sending email. This limits the sending devices to those that control forward-reverse DNS. Some anti-spam companies make use of this, but only for flagging things as spam. This method when used correctly makes RBL/RSL databases effective again and forces spammers to rent servers. If a VPS or server rental provider allows abuse, their AS number gets blocked. [2] In short, if people won't use the simple mechanisms that already exist, they probably won't add a new mechanism or make use of it. One argument against the existing method is friction or false positives, but really it just forces people to update DNS correctly. To add a math puzzle to email servers, you would also need to update every MTA and email server to understand this concept. All the major providers, all MTA's, etc... All the smtp libraries in all the programming languages would also need to understand this concept. java, golang, python, php, perl, C, C++, C#, etc... [1] - http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html [2] - http://www.uceprotect.net/en/index.php http://www.uceprotect.net/en/index.php

tboyd47 6y ago
Sounds like the previous ideas were all flawed, and the trend (which is all that it is— a trend) towards internet centralization stalled progress after that.
- LinuxBender 6y ago
  Everything has flaws, but this was more about friction and marketing. People like the least path of resistance or friction and buying an anti-spam service was easiest so it won. The methods I described have some friction and require people to set things up correctly. Its a trade-off of human cost vs outsourcing cost and outsourcing often wins.
  - tboyd47 6y ago
    Yeah, but tech is not a zero-sum game, and the path of history is not linear. Email is becoming a pay to play system where you’re spam if you’re not one the approved senders, and this seems like an elegant idea to correct that.
    - LinuxBender 6y ago
      It is an interesting idea. I am looking forward to how it plays out. I think the first challenge will be getting adoption from MTA's, smtp libraries and major email providers. This can't be done in a silo (server only) because smtp takes two to tango. Both the sender and the receiver have to implement this concept to utilize it. There will for sure be a handful of spammers that can't get their malware updated right away so you would at least have a window of less spam.
- sumtechguy 6y ago
  Even proof of work has a flaw. It underestimates some of the drive of these people to make make a few bucks. How much would say 200 raspberry PI's cost to network up? For proof of work to 'work' you need to get past the cost they would make on it. All you are doing is slowing them down which they can make up in volume of cheap devices. It does not 'solve' it. I have seen them setup rooms of low end Android devices to do things. This is not out of the realm of possibility.
  - LinuxBender 6y ago
    To add to this, you don't need any raspi's. Most spam today comes from malware running on PC's not owned by the spammer. All they need is a software library that does this math and 100% of the CPU cost is on the malware victim. The software library would have to already exist and be available to everyone or this concept would never be adopted, which means that the spammer gets this for free. They just have to plug the library into their malware. The only cost that would be forced onto spammers would be if the PoW used signed individual keys that could be revoked if abused.
sean_pedersen 6y ago
Not every server needs to understand it. Only the ones wanting to participate. If you choose to filter by PoW and a server does not provide PoW, you will still receive all of its emails just flagged as spam. So email PoW roll out can work iteratively.
- LinuxBender 6y ago
  True, but then a spammer need only implement PoW in their malware framework. Most spam today comes from malware infected PC's and rented VM's. CPU and network resources are free. The biggest challenge for the spammer will be getting updated malware deployed to support PoW, assuming their existing malware can't update itself via a command and control server. Unless you are selling crypto keys that are used in this PoW that can be revoked when abused, the malware need only know how to solve the puzzle.
  - sean_pedersen 6y ago
    If they add PoW to their malware, it will slow them down or even alert users / admins because of the high CPU usage it will cause.
    - LinuxBender 6y ago
      If all the spam came from a tiny set of hosts this would for sure be true. This for sure used to be the case. These days spam comes from millions of infected PC's and VM's. You will almost never see more than a few dozen connections come from the same host in a day, with exception to rented VM's because they have more resources. Spammers can control how much is sent from which classes of infected hosts. This also applies to the logic in their malware for things like brute forcing ssh/https/mysql connections. The victim rarely notice the malware any more, as it runs at lower CPU priority. Some of the malware is even polite enough to use a single core. Even telling ISP's and VPS providers a host is infected can take weeks or months to get someone to look into it.

tboyd47 6y ago

Sounds like the previous ideas were all flawed, and the trend (which is all that it is— a trend) towards internet centralization stalled progress after that.

LinuxBender 6y ago
Everything has flaws, but this was more about friction and marketing. People like the least path of resistance or friction and buying an anti-spam service was easiest so it won. The methods I described have some friction and require people to set things up correctly. Its a trade-off of human cost vs outsourcing cost and outsourcing often wins.
- tboyd47 6y ago
  Yeah, but tech is not a zero-sum game, and the path of history is not linear. Email is becoming a pay to play system where you’re spam if you’re not one the approved senders, and this seems like an elegant idea to correct that.
  - LinuxBender 6y ago
    It is an interesting idea. I am looking forward to how it plays out. I think the first challenge will be getting adoption from MTA's, smtp libraries and major email providers. This can't be done in a silo (server only) because smtp takes two to tango. Both the sender and the receiver have to implement this concept to utilize it. There will for sure be a handful of spammers that can't get their malware updated right away so you would at least have a window of less spam.
sumtechguy 6y ago
Even proof of work has a flaw. It underestimates some of the drive of these people to make make a few bucks. How much would say 200 raspberry PI's cost to network up? For proof of work to 'work' you need to get past the cost they would make on it. All you are doing is slowing them down which they can make up in volume of cheap devices. It does not 'solve' it. I have seen them setup rooms of low end Android devices to do things. This is not out of the realm of possibility.
- LinuxBender 6y ago
  To add to this, you don't need any raspi's. Most spam today comes from malware running on PC's not owned by the spammer. All they need is a software library that does this math and 100% of the CPU cost is on the malware victim. The software library would have to already exist and be available to everyone or this concept would never be adopted, which means that the spammer gets this for free. They just have to plug the library into their malware. The only cost that would be forced onto spammers would be if the PoW used signed individual keys that could be revoked if abused.

sean_pedersen 6y ago

Not every server needs to understand it. Only the ones wanting to participate. If you choose to filter by PoW and a server does not provide PoW, you will still receive all of its emails just flagged as spam. So email PoW roll out can work iteratively.

LinuxBender 6y ago
True, but then a spammer need only implement PoW in their malware framework. Most spam today comes from malware infected PC's and rented VM's. CPU and network resources are free. The biggest challenge for the spammer will be getting updated malware deployed to support PoW, assuming their existing malware can't update itself via a command and control server. Unless you are selling crypto keys that are used in this PoW that can be revoked when abused, the malware need only know how to solve the puzzle.
- sean_pedersen 6y ago
  If they add PoW to their malware, it will slow them down or even alert users / admins because of the high CPU usage it will cause.
  - LinuxBender 6y ago
    If all the spam came from a tiny set of hosts this would for sure be true. This for sure used to be the case. These days spam comes from millions of infected PC's and VM's. You will almost never see more than a few dozen connections come from the same host in a day, with exception to rented VM's because they have more resources. Spammers can control how much is sent from which classes of infected hosts. This also applies to the logic in their malware for things like brute forcing ssh/https/mysql connections. The victim rarely notice the malware any more, as it runs at lower CPU priority. Some of the malware is even polite enough to use a single core. Even telling ISP's and VPS providers a host is infected can take weeks or months to get someone to look into it.