6 ms·

While I am happy for you that you have found a solution, the solution you found is symptomatic of a very dangerous situation: it is increasingly impossible for

While I am happy for you that you have found a solution, the solution you found is symptomatic of a very dangerous situation: it is increasingly impossible for individuals or SMEs to use essential online facilities like sending messages or transferring money reliably unless they use a broker service as an intermediary. We are allowing small numbers of tech firms to take control of vital functionality that should be using open, standardised protocols in a decentralised way. This leaves everyone who isn't big enough to run their own implementation that others can't afford to ignore beholden to those brokers and subject to arbitrary charges and/or denial of service.

YPCrumble 5y ago
I agree completely with this, but the one problem is that you haven’t addressed how we control spam without these “trusted” intermediaries. “Trusted” here meaning that they aren’t spammers.
- netr0ute 5y ago
  The solution is to eliminate spam filters because that is the only good choice.
  - uoaei 5y ago
    No one is free until we are all free to send spam.
- Silhouette 5y ago
  Spam has largely been a solved problem for decades IME. You don't need some big-data-crunching mega-mail-host to block it successfully. For my personal mail, I use a small provider that isn't configured to block anything automatically and the built-in tools in my mail software. For my businesses, we have a pretty standard SpamAssassin-style setup. Either way, I see hardly any spam in my inbox despite receiving mail to multiple published contact addresses for those businesses, and I also can't remember the last time a false positive resulted in missing a legitimate mail. Meanwhile I've seen people miss events because $BIG_MAIL_PROVIDER decided the invitation was spam, I've seen recruitment go wrong because a CV from an excellent candidate was blocked on its way to the designated email address for applications, and countless other examples where bad spam blocking was throwing baby out with bathwater.
  - Karrot_Kream 5y ago
    Sure for you, but all of these other mailservers still obviously find value in applying spam filters or they wouldn't keep filtering. The problem is that it's much easier to send email than it is to receive it. This puts the onus of spam filtering on the recipient. I'm sad that HashCash or some other PoW scheme was never adopted as a way to force rate limiting of mailers.
    - Silhouette 5y ago
      Sure for you, but all of these other mailservers still obviously find value in applying spam filters or they wouldn't keep filtering. But since they have no accountability, their incentive is to eliminate anything potentially hostile regardless of the collateral damage from false positives. What are their users going to do? Take their business to another big provider that will probably be doing the same, and in the process lose access to a bunch of online services they like because their accounts on those services are tied to the old address? Move to a small provider, which is being forced out of the network by the giants so can't deliver mail reliably? We are rapidly heading for a world where email is no longer a reliable communications medium for genuine messages between friends, family, work colleagues, etc. The giants are killing email through death by 1,000 cuts instead of a shotgun to the face but the end result is the same.
  - vintermann 5y ago
    You must be living in a different world than me. I regularly get spam even from large corporations, that I know I never signed up for anything for. I know it is actually them, because it's DKIM signed with their domain certificates. Walmart (which doesn't exist in my country), Unilever and tons or their brands. Even a national division of Microsoft got hands on my email and decided to sign me up for invites to developer events (I know I hadn't signed up for it, because they didn't even use my name in the mails, which they certainly would have known if they had gotten it through any legitimate source). I assume it's bullshit KPIs, or signup schemes. Some poor seller at Microsoft or Walmart who's ranked according to how many people sign up to the opt-out company promotions, and buys harvested addresses to juice their numbers. I even got some very obvious fraud spam ("Your [expensive product] is waiting for you!", trying to get you to sign up as a "product tester" only paying $$$ per month) with full DKIM signatures from a site hosted at a Danish hosting provider, and Danish business info. You'd think this sort of thing gets shut down quickly, but nope. The only times I've tried to address this sort of thing through the proper channels (domain registrar's abuse accounts, etc.), I've only gotten markedly more spam. At least DKIM signatures makes it easy to autodelete mail. No need to even go into the spam folder, I'm happy to forbid Walmart from communicating with me by mail forever.
SturgeonsLaw 5y ago
This is the real value of cryptocurrencies. Yes, I know HN doesn't like them, yes there's a bunch of get-rich-quick bros and scammers out there, please try and separate the grift from the tech and consider how vital it is that people are able to control their finances without a third party having the ultimate say as to whether a transaction takes place or not.
- walrus01 5y ago
  cryptocurrencies and not screwing up global implementation of SMTP are completely different things. cryptocurrencies are not in any way going to solve the problem of people centralizing their MX all onto office365 and gsuite.
- dtech 5y ago
  The only currently realistic way to acquire cryptocurrency or for non-tech people to use it is through a 3rd party broker. It's about as difficult as running your own SMTP server I'd say. edit see this current front-page submission about how Bitcoin fails to provide this despite being centralized in exactly the same way as the decentralized SMTP: https://news.ycombinator.com/item?id=30224637 https://news.ycombinator.com/item?id=30224637
  - dane-pgp 5y ago
    > for non-tech people to use it Then it should be only the SMTP server operators who have to handle the crypocurrency side of things, so email users never have to worry about it. As you say, acquiring and using the cryptocurrency would be about as technically difficult as what the SMTP server operators are already doing, and there are a variety of 3rd party brokers they can choose if they want to simplify things and not run a node themselves. The system I'm imagining is one where each newly registered domain has to put up a cryptocurrency bond if the registrant wants to send email from it. Existing domains would be grandfathered in (having already built up their reputation) and new domains would have their bonds burned if some N-of-M stakeholders agreed that they were sending (DKIM-signed) spam. Choosing those stakeholders would be controversial, but hopefully no less controversial than the system we have today where Google can use the threat of a Gmail blacklist to make every SMTP server in the world follow its wishes. Ideally some of the stakeholders would be non-profits like the ISRG and Mozilla Foundation.
kbenson 5y ago
This is just the internet moving to match the real world. In the real world, reputation matters and some people don't want to talk to you unless someone can vouch for you. For areas where the general public needs to interact, third party intermediary services spring up to fill this need. This is why for any store over the size of a mom and pop operation in a neighborhood, you can't just tell the owner who you know by name to put it on your account, and instead for credit purchases you use a credit card company which acts as an intermediary and smooths problems over on both sides, and refuses to work with stores and people that are untrustworthy. This is why there are mailing list (mass email) services and why mail servers allow them. They keep their customers working within the accepted bounds (they ensure removal works and fire clients that abuse), and this allows mass email for accepted reasons while still being able to come down hard in random exploited servers/accounts. This is why big email services are very selective about what servers they talk to. I work at an ISP where our main outbound mail servers are on IPs that we try not to change because they've got decades of reputation attached. Even so, we recently brought up two new servers for email forwards, and shifted a small percentage of our mail queue traffic to them and ramped it up over a couple weeks, and that seemed to work "warming them up" to the likes of Gmail and yahoo, etc. It used to be there were lists of mail operators you could be part of and you could use reputation within that to get them to be lenient with you when you started. These days it's all so centralized in a few very large players that they really likely just talk to each other.
- lytefm 5y ago
  > and that seemed to work "warming them up" to the likes of Gmail and yahoo, etc Yes, warming up a "fresh" IP definely works. If you suddenly send thousands of mails from a new server - sure, you'll be labeled as Spam. If you slowly increase the volume over time, have a good domain and recipients that interact with the email, things should be fine. GMail has quite helpful guidelines [1]. 1: https://support.google.com/mail/answer/81126?hl=en https://support.google.com/mail/answer/81126?hl=en
  - deleted 5y ago
    [deleted]
- 5y ago
jart 5y ago
The open internet is dead. Spammers, fraudsters, and abusers have killed it. I can see how you might hate me, but I only speak the truth. Once upon a time the Internet consisted of a bunch of anonymous university students and u.s. government, Bell, IBM, etc. employees doing unfettered research. Today the Internet consists of anonymous grifters trying to squeeze a buck out of you any way they can.
- RunSet 5y ago
  I hope to see bitmessage supplant email for many use cases. It is decentralized and has built-in mechanisms to fight spam. Also all messages are end-to-end encrypted. Despite the name it has nothing to do with bitcoin or cryptocurrency. https://wiki.bitmessage.org/ https://wiki.bitmessage.org/
- Silhouette 5y ago
  The open internet is dead. Spammers, fraudsters, and abusers have killed it. I don't accept that. Nothing about defending against those threats requires the kind of guilt-by-association spam blocking we have been discussing. There will always be bad people in the world but that doesn't mean we allow some random big business to tell us where we may go, what we may do or who we may talk to because it is in that business's interests and (coincidentally or otherwise) it might make us safer.
- deleted 5y ago
  [deleted]
tinus_hn 5y ago
The flip side is that before, when the rules were lax and everybody could send email, everyone would get at least 10 spam mails every day, more if your address was online somewhere. Where now most people get one a week.

YPCrumble 5y ago

I agree completely with this, but the one problem is that you haven’t addressed how we control spam without these “trusted” intermediaries. “Trusted” here meaning that they aren’t spammers.

netr0ute 5y ago
The solution is to eliminate spam filters because that is the only good choice.
- uoaei 5y ago
  No one is free until we are all free to send spam.
Silhouette 5y ago
Spam has largely been a solved problem for decades IME. You don't need some big-data-crunching mega-mail-host to block it successfully. For my personal mail, I use a small provider that isn't configured to block anything automatically and the built-in tools in my mail software. For my businesses, we have a pretty standard SpamAssassin-style setup. Either way, I see hardly any spam in my inbox despite receiving mail to multiple published contact addresses for those businesses, and I also can't remember the last time a false positive resulted in missing a legitimate mail. Meanwhile I've seen people miss events because $BIG_MAIL_PROVIDER decided the invitation was spam, I've seen recruitment go wrong because a CV from an excellent candidate was blocked on its way to the designated email address for applications, and countless other examples where bad spam blocking was throwing baby out with bathwater.
- Karrot_Kream 5y ago
  Sure for you, but all of these other mailservers still obviously find value in applying spam filters or they wouldn't keep filtering. The problem is that it's much easier to send email than it is to receive it. This puts the onus of spam filtering on the recipient. I'm sad that HashCash or some other PoW scheme was never adopted as a way to force rate limiting of mailers.
  - Silhouette 5y ago
    Sure for you, but all of these other mailservers still obviously find value in applying spam filters or they wouldn't keep filtering. But since they have no accountability, their incentive is to eliminate anything potentially hostile regardless of the collateral damage from false positives. What are their users going to do? Take their business to another big provider that will probably be doing the same, and in the process lose access to a bunch of online services they like because their accounts on those services are tied to the old address? Move to a small provider, which is being forced out of the network by the giants so can't deliver mail reliably? We are rapidly heading for a world where email is no longer a reliable communications medium for genuine messages between friends, family, work colleagues, etc. The giants are killing email through death by 1,000 cuts instead of a shotgun to the face but the end result is the same.
- vintermann 5y ago
  You must be living in a different world than me. I regularly get spam even from large corporations, that I know I never signed up for anything for. I know it is actually them, because it's DKIM signed with their domain certificates. Walmart (which doesn't exist in my country), Unilever and tons or their brands. Even a national division of Microsoft got hands on my email and decided to sign me up for invites to developer events (I know I hadn't signed up for it, because they didn't even use my name in the mails, which they certainly would have known if they had gotten it through any legitimate source). I assume it's bullshit KPIs, or signup schemes. Some poor seller at Microsoft or Walmart who's ranked according to how many people sign up to the opt-out company promotions, and buys harvested addresses to juice their numbers. I even got some very obvious fraud spam ("Your [expensive product] is waiting for you!", trying to get you to sign up as a "product tester" only paying $$$ per month) with full DKIM signatures from a site hosted at a Danish hosting provider, and Danish business info. You'd think this sort of thing gets shut down quickly, but nope. The only times I've tried to address this sort of thing through the proper channels (domain registrar's abuse accounts, etc.), I've only gotten markedly more spam. At least DKIM signatures makes it easy to autodelete mail. No need to even go into the spam folder, I'm happy to forbid Walmart from communicating with me by mail forever.

SturgeonsLaw 5y ago

This is the real value of cryptocurrencies. Yes, I know HN doesn't like them, yes there's a bunch of get-rich-quick bros and scammers out there, please try and separate the grift from the tech and consider how vital it is that people are able to control their finances without a third party having the ultimate say as to whether a transaction takes place or not.

walrus01 5y ago
cryptocurrencies and not screwing up global implementation of SMTP are completely different things. cryptocurrencies are not in any way going to solve the problem of people centralizing their MX all onto office365 and gsuite.
dtech 5y ago
The only currently realistic way to acquire cryptocurrency or for non-tech people to use it is through a 3rd party broker. It's about as difficult as running your own SMTP server I'd say. edit see this current front-page submission about how Bitcoin fails to provide this despite being centralized in exactly the same way as the decentralized SMTP: https://news.ycombinator.com/item?id=30224637 https://news.ycombinator.com/item?id=30224637
- dane-pgp 5y ago
  > for non-tech people to use it Then it should be only the SMTP server operators who have to handle the crypocurrency side of things, so email users never have to worry about it. As you say, acquiring and using the cryptocurrency would be about as technically difficult as what the SMTP server operators are already doing, and there are a variety of 3rd party brokers they can choose if they want to simplify things and not run a node themselves. The system I'm imagining is one where each newly registered domain has to put up a cryptocurrency bond if the registrant wants to send email from it. Existing domains would be grandfathered in (having already built up their reputation) and new domains would have their bonds burned if some N-of-M stakeholders agreed that they were sending (DKIM-signed) spam. Choosing those stakeholders would be controversial, but hopefully no less controversial than the system we have today where Google can use the threat of a Gmail blacklist to make every SMTP server in the world follow its wishes. Ideally some of the stakeholders would be non-profits like the ISRG and Mozilla Foundation.

kbenson 5y ago

This is just the internet moving to match the real world. In the real world, reputation matters and some people don't want to talk to you unless someone can vouch for you. For areas where the general public needs to interact, third party intermediary services spring up to fill this need. This is why for any store over the size of a mom and pop operation in a neighborhood, you can't just tell the owner who you know by name to put it on your account, and instead for credit purchases you use a credit card company which acts as an intermediary and smooths problems over on both sides, and refuses to work with stores and people that are untrustworthy. This is why there are mailing list (mass email) services and why mail servers allow them. They keep their customers working within the accepted bounds (they ensure removal works and fire clients that abuse), and this allows mass email for accepted reasons while still being able to come down hard in random exploited servers/accounts. This is why big email services are very selective about what servers they talk to. I work at an ISP where our main outbound mail servers are on IPs that we try not to change because they've got decades of reputation attached. Even so, we recently brought up two new servers for email forwards, and shifted a small percentage of our mail queue traffic to them and ramped it up over a couple weeks, and that seemed to work "warming them up" to the likes of Gmail and yahoo, etc. It used to be there were lists of mail operators you could be part of and you could use reputation within that to get them to be lenient with you when you started. These days it's all so centralized in a few very large players that they really likely just talk to each other.

lytefm 5y ago
> and that seemed to work "warming them up" to the likes of Gmail and yahoo, etc Yes, warming up a "fresh" IP definely works. If you suddenly send thousands of mails from a new server - sure, you'll be labeled as Spam. If you slowly increase the volume over time, have a good domain and recipients that interact with the email, things should be fine. GMail has quite helpful guidelines [1]. 1: https://support.google.com/mail/answer/81126?hl=en https://support.google.com/mail/answer/81126?hl=en
- deleted 5y ago
  [deleted]
5y ago

jart 5y ago

The open internet is dead. Spammers, fraudsters, and abusers have killed it. I can see how you might hate me, but I only speak the truth. Once upon a time the Internet consisted of a bunch of anonymous university students and u.s. government, Bell, IBM, etc. employees doing unfettered research. Today the Internet consists of anonymous grifters trying to squeeze a buck out of you any way they can.

RunSet 5y ago
I hope to see bitmessage supplant email for many use cases. It is decentralized and has built-in mechanisms to fight spam. Also all messages are end-to-end encrypted. Despite the name it has nothing to do with bitcoin or cryptocurrency. https://wiki.bitmessage.org/ https://wiki.bitmessage.org/
Silhouette 5y ago
The open internet is dead. Spammers, fraudsters, and abusers have killed it. I don't accept that. Nothing about defending against those threats requires the kind of guilt-by-association spam blocking we have been discussing. There will always be bad people in the world but that doesn't mean we allow some random big business to tell us where we may go, what we may do or who we may talk to because it is in that business's interests and (coincidentally or otherwise) it might make us safer.
deleted 5y ago
[deleted]

tinus_hn 5y ago

The flip side is that before, when the rules were lax and everybody could send email, everyone would get at least 10 spam mails every day, more if your address was online somewhere. Where now most people get one a week.