3 ms·

Is it strictly-true that anti-spam algorithms must be hidden to be effective? It would seem that initially, spammers would have the upper hand, but in the long

by ISL 5y ago

Is it strictly-true that anti-spam algorithms must be hidden to be effective? It would seem that initially, spammers would have the upper hand, but in the long run, coordinated and open effort against spammers has the potential to pay off. Furthermore, to have a closed algorithm that cuts off the ability for people to communicate opens the door to institutionalized censorship -- designating a political opponent's communication as spam could limit their ability to be heard.

zimpenfish 5y ago
> Is it strictly-true that anti-spam algorithms must be hidden to be effective? Can't answer that but there were, for a long time, services that would run your "targeted emails" through spamassassin et al for you and give you advice on how to tweak them to lower the resultant score.
Arnt 5y ago
I've fought spam in other contexts and found that to be true. A change stopped spam until spammers learned what the change was, which made them adapt. The adaption might not be perfect, but it would happen, so prolonging the blocked period was essential. If one can do something that's effective and that the spammers don't understand for months, that's great. If they can spam for days and then blocked for a longer period and that repeats, they'll go away and attack an easier target instead (well, some of them will look back later). Let me try an argument other than "it's been my experience", though. Suppose that it's not true. In that case, the anti-spam filter provides a publicly visible definition of spam in its code, and it's one that isn't grounded in the recipients' opinions. If the filter is to be effective, spammers must not be able to adapt their behaviour in a way that users consider spam but isn't according to the definition. Many people have tried to provide such a definition since 1995 and AIUI all have failed. I think the persisten failure indicates that it's extremely unlikely that one can be found, and therefore it's extremely unlikely that a publicly visible spam filter can be as effective as one that can be updated in secret.
- correct_horse 5y ago
  Do you think an eventually open style spam filter could work? One where the implemntation is released say 2 years after it was first written (including modifications)
  - Arnt 5y ago
    I don't see what "work" means in that case. The delayed release is supposed to achieve something, which it can succeed at, or not. I don't see what that is. The delayed release may also have an impact on the the software's and database's function as a spam filter. I don't have a good intuition for that impact either. Sorry.
pornel 5y ago
Depends how high is your bar for "effective". For example there's nothing secret in rate limiting and IP bans, and these are fundamental techniques. However, there are plenty of opportunities to catch spammers when they make stupid mistakes. I've worked with web bot spam. I could catch a very popular bot brand by observing that it sent Accept header with content that was implausible for the User-Agent it sent. If the code was public, spammers could see `if (browser == safari && accept != safari-like) { spam }` and fix their header in minutes. There's also a middle ground where the algorithm is public, but it's powered by secret data: blacklists, databases for classifiers, ML models. From accountability point of view data being secret is as problematic as secret code.
teawrecks 5y ago
It's the same as anti-cheat in a game. Given how easy it is to create a cheat for open source code, it's just way more cost effective to keep it closed. The rule is not to RELY on security by obscurity. It shouldn't be the last line of defense. But by all means, use it where the ROI makes sense.
xboxnolifes 5y ago
> Is it strictly-true that anti-spam algorithms must be hidden to be effective? No. But that "no" is missing some qualifiers. It's not strictly true since you can implement some out-in-open options such as paying money, requiring a phone number, validating your physical identity, delays of use on new account creation, etc, that will make the barrier of entry for spamming much higher. There will still be spam, but it'll become more manageable to manually monitor and take action against. The downsides I feel are obvious based on the service we are talking about. But I would say it is strictly true that you cannot have a free, anonymous, low barrier to entry service without hiding your anti-spam algorithms. There is fundamentally no difference in such an environment to differentiate a bot from a human besides the message content and patterns in who they message. If bots know what content they can't send or what patterns in messaging to avoid, they can still spam.

by ISL 5y ago

zimpenfish 5y ago

> Is it strictly-true that anti-spam algorithms must be hidden to be effective? Can't answer that but there were, for a long time, services that would run your "targeted emails" through spamassassin et al for you and give you advice on how to tweak them to lower the resultant score.

Arnt 5y ago

I've fought spam in other contexts and found that to be true. A change stopped spam until spammers learned what the change was, which made them adapt. The adaption might not be perfect, but it would happen, so prolonging the blocked period was essential. If one can do something that's effective and that the spammers don't understand for months, that's great. If they can spam for days and then blocked for a longer period and that repeats, they'll go away and attack an easier target instead (well, some of them will look back later). Let me try an argument other than "it's been my experience", though. Suppose that it's not true. In that case, the anti-spam filter provides a publicly visible definition of spam in its code, and it's one that isn't grounded in the recipients' opinions. If the filter is to be effective, spammers must not be able to adapt their behaviour in a way that users consider spam but isn't according to the definition. Many people have tried to provide such a definition since 1995 and AIUI all have failed. I think the persisten failure indicates that it's extremely unlikely that one can be found, and therefore it's extremely unlikely that a publicly visible spam filter can be as effective as one that can be updated in secret.

correct_horse 5y ago
Do you think an eventually open style spam filter could work? One where the implemntation is released say 2 years after it was first written (including modifications)
- Arnt 5y ago
  I don't see what "work" means in that case. The delayed release is supposed to achieve something, which it can succeed at, or not. I don't see what that is. The delayed release may also have an impact on the the software's and database's function as a spam filter. I don't have a good intuition for that impact either. Sorry.

pornel 5y ago

Depends how high is your bar for "effective". For example there's nothing secret in rate limiting and IP bans, and these are fundamental techniques. However, there are plenty of opportunities to catch spammers when they make stupid mistakes. I've worked with web bot spam. I could catch a very popular bot brand by observing that it sent Accept header with content that was implausible for the User-Agent it sent. If the code was public, spammers could see `if (browser == safari && accept != safari-like) { spam }` and fix their header in minutes. There's also a middle ground where the algorithm is public, but it's powered by secret data: blacklists, databases for classifiers, ML models. From accountability point of view data being secret is as problematic as secret code.

teawrecks 5y ago

It's the same as anti-cheat in a game. Given how easy it is to create a cheat for open source code, it's just way more cost effective to keep it closed. The rule is not to RELY on security by obscurity. It shouldn't be the last line of defense. But by all means, use it where the ROI makes sense.

xboxnolifes 5y ago

> Is it strictly-true that anti-spam algorithms must be hidden to be effective? No. But that "no" is missing some qualifiers. It's not strictly true since you can implement some out-in-open options such as paying money, requiring a phone number, validating your physical identity, delays of use on new account creation, etc, that will make the barrier of entry for spamming much higher. There will still be spam, but it'll become more manageable to manually monitor and take action against. The downsides I feel are obvious based on the service we are talking about. But I would say it is strictly true that you cannot have a free, anonymous, low barrier to entry service without hiding your anti-spam algorithms. There is fundamentally no difference in such an environment to differentiate a bot from a human besides the message content and patterns in who they message. If bots know what content they can't send or what patterns in messaging to avoid, they can still spam.