5 ms·

Sure, then they relax things, spam explodes, and people are going to complain that they're not doing enough to fight spam or actively enabling it.

by alar44 4y ago

throw10920 4y ago
Google has more than adequate capabilities to handle spam, as several comments point out above. Also, Hashcash[1], which is a virtual silver bullet for email spam, especially when combined with existing trust mechanisms (i.e. the less reputation you have, the harder the Hashcash challenge). The problem is not that the level of strictness that Google is applying is necessary to reduce spam; the problem is that Google doesn't care and is in fact incentivized to not accept email from non-Google domains. [1] https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash
- Avamander 4y ago
  > Google has more than adequate capabilities to handle spam, as several comments point out above. Yes, and sender reputation is part of it :D that's why they can handle it. > Also, Hashcash[1], which is a virtual silver bullet for email spam, especially when combined with existing trust mechanisms Who do you think has to and can spend more compute or money, well-trusted Google or a small player? Far from a silver bullet. > i.e. the less reputation you have, the harder the Hashcash challenge Who do you think will have better reputation? I won't even start at how different people define spam. Though, I can promise you that on average SpamChimp would get to send a lot of spam for much less "HashCash" than a small player. > is in fact incentivized to not accept email from non-Google domains. Everyone is.
  - BenjiWiebe 4y ago
    The thing with hashcash is that a small player doesn't need much compute power, cause they aren't sending a million emails a minute.
    - Avamander 4y ago
      Oh, so it's ineffectual against spam, got it. Either botnet devices can send tens if not hundreds of letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both.
      - dns_snek 4y ago
        Let me try to explain. If I'm a legitimate small sender of email, then Gmail requiring that my email server solves a cryptographic challenge (Hashcash or a more modern version of it) that takes a minute to compute isn't a big deal if I only send 5 emails per day. All of my outgoing emails are going to be delayed by a minute which won't affect me at all, even though it's computationally slow. On the other hand, spammers are likely sending hundreds of emails per minute per server, so limiting them to 1 email per minute would have significant consequences for them. I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? We use exactly the same idea for secure password storage. Password verification is slow, really slow, on purpose. This makes it "slow for legitimate password verifier" (the website you're logging into), but it also makes password cracking on a large scale completely infeasible.
        Avamander 4y ago
        > I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? Yes, in a scenario where you're a legitimate sender that sends very few letters compared to a bulk spammer. Apples to oranges. You unfortunately ignored both the low-rate spammers and the high-rate legitimate senders. The former is barely hindered and the latter is PoW-walled into inconvinience. If you now bring in reputation schemes, then those can be played by adversaries, you'll end up at step zero but you have made a large climate impact. > but it also makes password cracking on a large scale completely infeasible. But this is not the current scenario. Intentionally complex password hashing is not really PoW we're talking about.
        4y ago
  - sigstoat 4y ago
    > Who do you think has to and can spend more compute or money, well-trusted Google or a small player? Far from a silver bullet. i'm not even a big fan of hashcash, but i don't think you understand it, or how it could fit in as a component of a broader spam mitigation system. (for better or worse) google wouldn't need to compute hashcash for their outgoing emails, because they have DKIM and a solid reputation. nor is its computational power somehow at odds with that of smaller players.
    - Avamander 4y ago
      > i don't think you understand it, or how it could fit in as a component of a broader spam mitigation system. It's not that I don't understand, I know how it won't. > google wouldn't need to compute hashcash for their outgoing emails, because they have DKIM and a solid reputation. Great, so what's the point? Small players would have to pay Google to deliver mail :D > computational power somehow at odds with that of smaller players. As I said in my other comment, either botnet devices can send tens if not hundreds of spam letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both.
      - throw10920 4y ago
        > It's not that I don't understand, I know how it won't. You really don't understand it, because you're unable to provide counterarguments to specific explanations of how it would fit in with a larger anti-spam system, and because you say things that are clearly false to someone who does understand it. > Great, so what's the point? Small players would have to pay Google to deliver mail :D ...such as this, which is false. Nobody's paying anybody anything - Hashcash is a computational proof-of-work challenge with zero money transferred. If you're talking about a metaphorical "payment" of the smaller players having to do some kind of work - that's a feature, not a bug, because it allows the smaller players to invest effort into convincing Google that they're legitimate, and if coupled with a well-designed spam system that then takes that reputation and associates it with DKIM signatures/IP addresses, then the smaller players burn n cycles and then stop having to do so because they now have reputation with Google, while spammers burn n cycles continually for every message that they send because they keep getting flagged as spam. > As I said in my other comment, either botnet devices can send tens if not hundreds of spam letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both. Yes, you really can, because you don't understand how anti-spam systems work. A system with Hashcash would start out assigning most IP addresses+hostnames/DKIM signatures with a reputation of 0, and in order to accept a message, would require the sender solve a Hashcash challenge inversely proportional to their reputation. If the message is marked as spam, the reputation takes a hit - if it's not, the reputation increases slightly (along with all of the other factors that an anti-spam system uses). The legitimate servers quickly build up reputation and stop having to solve challenges, while the spammers pay the computational tax until the end of time, making it unprofitable for them to send most spam to most targets. The end.
  - tzs 4y ago
    > Yes, and sender reputation is part of it :D that's why they can handle it. They aren't doing a very good job of using sender reputation. If you have a domain with a several year record of no spamming whatsoever, and with every outgoing message using DKIM, they will still start blocking you if other senders who just happen to have an IP address close to yours start spamming. IP block reputation should only be used to set the default when dealing with new senders. If they have seen enough DKIM signed messages from a sender to know that the sender has a good reputation, IP block reputation should have weight 0 when receiving mail from that sender. Google could do this without any increase whatsoever in the amount of spam that shows up in their customers' inboxes. All that would change is that their false positive rate would go down.
    - Avamander 4y ago
      > They aren't doing a very good job of using sender reputation. That's your limited perspecive, sorry. > they will still start blocking you if other senders who just happen to have an IP address close to yours start spamming. Absolutely, how would they know how that provider assigns those IP's? A lot of spammers use entire /24's. > If they have seen enough DKIM signed messages from a sender to know that the sender has a good reputation A lot of spammers have DKIM, it's not a good reason to allow mail from a suspicious subnet. Pick a provider that deals with their spam complaints. That's the harsh truth.
      - tzs 4y ago
        > A lot of spammers have DKIM, it's not a good reason to allow mail from a suspicious subnet. You keep missing the point. Nobody is suggesting that mail be allowed merely because a domain is using DKIM. What is being suggested is that if a domain has a proven history of not sending spam then blocking the domain's mail just because there are spammers in the same subnet results in blocking non-spam. Not blocking the domain does not increase the amount of spam that gets through because the domain is not sending spam. Where DKIM comes in is that it allows receiving sites to distinguish between mail that is really from domain X and mail that is forged to appear to come from X. The latter can safely be automatically classified as spam. The former can be used to build an accurate history for the domain to determine if it sends spam or not.
  - throw10920 4y ago
    > Yes, and sender reputation is part of it Sender reputation where you block smaller email providers indiscriminately without weighting DKIM signatures or identity (or just blocking based on IP) is not a way of "handling" it. Your comment is akin to someone saying "the government can handle poverty" and you saying "yes, by killing all of the poor people" - it's very clearly a non-solution. > Who do you think has to and can spend more compute or money, well-trusted Google or a small player? I don't think that you understand how Hashcash is supposed to work, or what it's supposed to solve. The computational cost is imposed on non-Google players - both smaller email servers without a reputation (until they build one up, obviously), and spammers. I mean, sure, if everyone implemented the protocol, then non-Gmail servers could technically request that Gmail do Hashcash challenges in order to receive email, but nobody's going to do that, because nobody believes that Google is going to send spam mail. > Though, I can promise you that on average SpamChimp would get to send a lot of spam for much less "HashCash" than a small player. No, you really can't promise me this, unless you're literally in control of Gmail servers and intentionally adjust the difficulty settings to fulfill this condition. > > is in fact incentivized to not accept email from non-Google domains. > Everyone is. I don't see what your point is here. The fact that Google is incentivized to not accept email from non-Google domains is not a good thing - it's a bad thing. And, really, the above is false - everyone is incentivized to accept legitimate, non-spam email from all of their customers, which is not the same as what you said.
    - Avamander 4y ago
      > Sender reputation where you block smaller email providers indiscriminately without weighting DKIM signatures or identity That's not true. > because nobody believes that Google is going to send spam mail. This sentence indicates you don't know much about who sends spam or not. > The computational cost is imposed on non-Google players You're going in circles. Do you not see how that especially is unfair to the smaller players? Spammers have just as much compute, it will just impose an additional burden on the legitimate senders. So in your scenario a small startup has to wait tens of minutes (bunch of letters in the queue already) to send email confirmation letters. The spammer on the other hand does the same, it'll infect a few more devices, they've exeeded the startup's sending rate. Alternatively, both the spammer and the hypothetical startup build reputation first. They'll warm up the domain, both get to send more in the same timeframe. So... we're at the beginning again, everyone warms up their domains and IP's like they do right now. PoW hasn't improved the sitation. > I don't see what your point is here. Because you haven't seen enough spam. On average everyone is incentivised not to accept mail from new or unknown domains. > everyone is incentivized to accept legitimate, non-spam email from all of their customers No shit, but also not the topic. Received mail is not perfect, that's what's the actual topic.

Sure, then they relax things, spam explodes, and people are going to complain that they're not doing enough to fight spam or actively enabling it.

by alar44 4y ago

Sure, then they relax things, spam explodes, and people are going to complain that they're not doing enough to fight spam or actively enabling it.

throw10920 4y ago

Google has more than adequate capabilities to handle spam, as several comments point out above. Also, Hashcash[1], which is a virtual silver bullet for email spam, especially when combined with existing trust mechanisms (i.e. the less reputation you have, the harder the Hashcash challenge). The problem is not that the level of strictness that Google is applying is necessary to reduce spam; the problem is that Google doesn't care and is in fact incentivized to not accept email from non-Google domains. [1] https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash

Avamander 4y ago
> Google has more than adequate capabilities to handle spam, as several comments point out above. Yes, and sender reputation is part of it :D that's why they can handle it. > Also, Hashcash[1], which is a virtual silver bullet for email spam, especially when combined with existing trust mechanisms Who do you think has to and can spend more compute or money, well-trusted Google or a small player? Far from a silver bullet. > i.e. the less reputation you have, the harder the Hashcash challenge Who do you think will have better reputation? I won't even start at how different people define spam. Though, I can promise you that on average SpamChimp would get to send a lot of spam for much less "HashCash" than a small player. > is in fact incentivized to not accept email from non-Google domains. Everyone is.
- BenjiWiebe 4y ago
  The thing with hashcash is that a small player doesn't need much compute power, cause they aren't sending a million emails a minute.
  - Avamander 4y ago
    Oh, so it's ineffectual against spam, got it. Either botnet devices can send tens if not hundreds of letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both.
    - dns_snek 4y ago
      Let me try to explain. If I'm a legitimate small sender of email, then Gmail requiring that my email server solves a cryptographic challenge (Hashcash or a more modern version of it) that takes a minute to compute isn't a big deal if I only send 5 emails per day. All of my outgoing emails are going to be delayed by a minute which won't affect me at all, even though it's computationally slow. On the other hand, spammers are likely sending hundreds of emails per minute per server, so limiting them to 1 email per minute would have significant consequences for them. I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? We use exactly the same idea for secure password storage. Password verification is slow, really slow, on purpose. This makes it "slow for legitimate password verifier" (the website you're logging into), but it also makes password cracking on a large scale completely infeasible.
      - Avamander 4y ago
        > I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? Yes, in a scenario where you're a legitimate sender that sends very few letters compared to a bulk spammer. Apples to oranges. You unfortunately ignored both the low-rate spammers and the high-rate legitimate senders. The former is barely hindered and the latter is PoW-walled into inconvinience. If you now bring in reputation schemes, then those can be played by adversaries, you'll end up at step zero but you have made a large climate impact. > but it also makes password cracking on a large scale completely infeasible. But this is not the current scenario. Intentionally complex password hashing is not really PoW we're talking about.
        4y ago
- sigstoat 4y ago
  > Who do you think has to and can spend more compute or money, well-trusted Google or a small player? Far from a silver bullet. i'm not even a big fan of hashcash, but i don't think you understand it, or how it could fit in as a component of a broader spam mitigation system. (for better or worse) google wouldn't need to compute hashcash for their outgoing emails, because they have DKIM and a solid reputation. nor is its computational power somehow at odds with that of smaller players.
  - Avamander 4y ago
    > i don't think you understand it, or how it could fit in as a component of a broader spam mitigation system. It's not that I don't understand, I know how it won't. > google wouldn't need to compute hashcash for their outgoing emails, because they have DKIM and a solid reputation. Great, so what's the point? Small players would have to pay Google to deliver mail :D > computational power somehow at odds with that of smaller players. As I said in my other comment, either botnet devices can send tens if not hundreds of spam letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both.
    - throw10920 4y ago
      > It's not that I don't understand, I know how it won't. You really don't understand it, because you're unable to provide counterarguments to specific explanations of how it would fit in with a larger anti-spam system, and because you say things that are clearly false to someone who does understand it. > Great, so what's the point? Small players would have to pay Google to deliver mail :D ...such as this, which is false. Nobody's paying anybody anything - Hashcash is a computational proof-of-work challenge with zero money transferred. If you're talking about a metaphorical "payment" of the smaller players having to do some kind of work - that's a feature, not a bug, because it allows the smaller players to invest effort into convincing Google that they're legitimate, and if coupled with a well-designed spam system that then takes that reputation and associates it with DKIM signatures/IP addresses, then the smaller players burn n cycles and then stop having to do so because they now have reputation with Google, while spammers burn n cycles continually for every message that they send because they keep getting flagged as spam. > As I said in my other comment, either botnet devices can send tens if not hundreds of spam letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both. Yes, you really can, because you don't understand how anti-spam systems work. A system with Hashcash would start out assigning most IP addresses+hostnames/DKIM signatures with a reputation of 0, and in order to accept a message, would require the sender solve a Hashcash challenge inversely proportional to their reputation. If the message is marked as spam, the reputation takes a hit - if it's not, the reputation increases slightly (along with all of the other factors that an anti-spam system uses). The legitimate servers quickly build up reputation and stop having to solve challenges, while the spammers pay the computational tax until the end of time, making it unprofitable for them to send most spam to most targets. The end.
- tzs 4y ago
  > Yes, and sender reputation is part of it :D that's why they can handle it. They aren't doing a very good job of using sender reputation. If you have a domain with a several year record of no spamming whatsoever, and with every outgoing message using DKIM, they will still start blocking you if other senders who just happen to have an IP address close to yours start spamming. IP block reputation should only be used to set the default when dealing with new senders. If they have seen enough DKIM signed messages from a sender to know that the sender has a good reputation, IP block reputation should have weight 0 when receiving mail from that sender. Google could do this without any increase whatsoever in the amount of spam that shows up in their customers' inboxes. All that would change is that their false positive rate would go down.
  - Avamander 4y ago
    > They aren't doing a very good job of using sender reputation. That's your limited perspecive, sorry. > they will still start blocking you if other senders who just happen to have an IP address close to yours start spamming. Absolutely, how would they know how that provider assigns those IP's? A lot of spammers use entire /24's. > If they have seen enough DKIM signed messages from a sender to know that the sender has a good reputation A lot of spammers have DKIM, it's not a good reason to allow mail from a suspicious subnet. Pick a provider that deals with their spam complaints. That's the harsh truth.
    - tzs 4y ago
      > A lot of spammers have DKIM, it's not a good reason to allow mail from a suspicious subnet. You keep missing the point. Nobody is suggesting that mail be allowed merely because a domain is using DKIM. What is being suggested is that if a domain has a proven history of not sending spam then blocking the domain's mail just because there are spammers in the same subnet results in blocking non-spam. Not blocking the domain does not increase the amount of spam that gets through because the domain is not sending spam. Where DKIM comes in is that it allows receiving sites to distinguish between mail that is really from domain X and mail that is forged to appear to come from X. The latter can safely be automatically classified as spam. The former can be used to build an accurate history for the domain to determine if it sends spam or not.
- throw10920 4y ago
  > Yes, and sender reputation is part of it Sender reputation where you block smaller email providers indiscriminately without weighting DKIM signatures or identity (or just blocking based on IP) is not a way of "handling" it. Your comment is akin to someone saying "the government can handle poverty" and you saying "yes, by killing all of the poor people" - it's very clearly a non-solution. > Who do you think has to and can spend more compute or money, well-trusted Google or a small player? I don't think that you understand how Hashcash is supposed to work, or what it's supposed to solve. The computational cost is imposed on non-Google players - both smaller email servers without a reputation (until they build one up, obviously), and spammers. I mean, sure, if everyone implemented the protocol, then non-Gmail servers could technically request that Gmail do Hashcash challenges in order to receive email, but nobody's going to do that, because nobody believes that Google is going to send spam mail. > Though, I can promise you that on average SpamChimp would get to send a lot of spam for much less "HashCash" than a small player. No, you really can't promise me this, unless you're literally in control of Gmail servers and intentionally adjust the difficulty settings to fulfill this condition. > > is in fact incentivized to not accept email from non-Google domains. > Everyone is. I don't see what your point is here. The fact that Google is incentivized to not accept email from non-Google domains is not a good thing - it's a bad thing. And, really, the above is false - everyone is incentivized to accept legitimate, non-spam email from all of their customers, which is not the same as what you said.
  - Avamander 4y ago
    > Sender reputation where you block smaller email providers indiscriminately without weighting DKIM signatures or identity That's not true. > because nobody believes that Google is going to send spam mail. This sentence indicates you don't know much about who sends spam or not. > The computational cost is imposed on non-Google players You're going in circles. Do you not see how that especially is unfair to the smaller players? Spammers have just as much compute, it will just impose an additional burden on the legitimate senders. So in your scenario a small startup has to wait tens of minutes (bunch of letters in the queue already) to send email confirmation letters. The spammer on the other hand does the same, it'll infect a few more devices, they've exeeded the startup's sending rate. Alternatively, both the spammer and the hypothetical startup build reputation first. They'll warm up the domain, both get to send more in the same timeframe. So... we're at the beginning again, everyone warms up their domains and IP's like they do right now. PoW hasn't improved the sitation. > I don't see what your point is here. Because you haven't seen enough spam. On average everyone is incentivised not to accept mail from new or unknown domains. > everyone is incentivized to accept legitimate, non-spam email from all of their customers No shit, but also not the topic. Received mail is not perfect, that's what's the actual topic.