> We should also not gloss over that with a bloom filter can't rule out false positives, and it's really not feasible to figure out which they are. Nothing say

> We should also not gloss over that with a bloom filter can't rule out false positives, and it's really not feasible to figure out which they are. Nothing says a bloom filter has to be the only data structure you use. It's a performance optimization; even if 1% of the time you have to consult a more expensive data structure to confirm your result, it can still save you a lot of computation in the long run. > Finding just one hash collision in a wide hash is computationally stupidly hard. But bloom filters don't use wide hashes; the domain of the hash function is the number of bits in the filter. > Domains cost quite a lot of money so that is still pretty unrealistic. In the case of malware, the cost of buying domains isn't that relevant, because you can compromise existing domains using automated attacks.