4 ms·

Oh, so it's ineffectual against spam, got it. Either botnet devices can send tens if not hundreds of letters, or it's going to be slow and/or expensive for all

Oh, so it's ineffectual against spam, got it. Either botnet devices can send tens if not hundreds of letters, or it's going to be slow and/or expensive for all the legitimate small senders. You really can't have both.

dns_snek 4y ago
Let me try to explain. If I'm a legitimate small sender of email, then Gmail requiring that my email server solves a cryptographic challenge (Hashcash or a more modern version of it) that takes a minute to compute isn't a big deal if I only send 5 emails per day. All of my outgoing emails are going to be delayed by a minute which won't affect me at all, even though it's computationally slow. On the other hand, spammers are likely sending hundreds of emails per minute per server, so limiting them to 1 email per minute would have significant consequences for them. I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? We use exactly the same idea for secure password storage. Password verification is slow, really slow, on purpose. This makes it "slow for legitimate password verifier" (the website you're logging into), but it also makes password cracking on a large scale completely infeasible.
- Avamander 4y ago
  > I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? Yes, in a scenario where you're a legitimate sender that sends very few letters compared to a bulk spammer. Apples to oranges. You unfortunately ignored both the low-rate spammers and the high-rate legitimate senders. The former is barely hindered and the latter is PoW-walled into inconvinience. If you now bring in reputation schemes, then those can be played by adversaries, you'll end up at step zero but you have made a large climate impact. > but it also makes password cracking on a large scale completely infeasible. But this is not the current scenario. Intentionally complex password hashing is not really PoW we're talking about.
  - dns_snek 4y ago
    > You unfortunately ignored both the low-rate spammers and the high-rate legitimate senders. Both of these seem like imaginary edge cases that don't really exist. I'm going to gloss over the oxymoron of low-rate spammers. > If you now bring in reputation schemes, then those can be played by adversaries, you'll end up at step zero but you have made a large climate impact. How do they do that? If we focus on the current state of things, high rate legitimate senders already have an established reputation so they don't need to change how they handle outgoing emails. The only thing that would change is how large email providers such as Gmail handle incoming emails from small/unknown senders, by accepting a sufficiently complex PoW as an indication that the email is not spam. Over time this should increase the sender's reputation to a point where PoW is no longer required. TLDR: Nothing would change for the big players, small senders are given an opportunity to prove they are legitimate, and spammers remain locked out.
    - Avamander 4y ago
      > Both of these seem like imaginary edge cases that don't really exist. I'm going to gloss over the oxymoron of low-rate spammers. I'm sorry? Both of those cases are very real and happen often, you don't get to just ignore them because of your lack of experience. > How do they do that? Many ways. Sending legitimate mail for example. You're acting like it's hard to show good behaviour for a while. It's one of the telltale ways I catch those fucks, they're doing it already. But they also use their own inboxes to build up volume, hijack accounts, abuse SPF policies and DKIM misconfigurations. There probably are more ways to get a "trusted" domain I can't recall this instant. Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! You have demonstrated repeatedly how you have little knowledge of spammers' and others' behaviour, you handwave away all "edge cases" and say it will work. No, it won't. All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others.
      - throw10920 4y ago
        > Both of those cases are very real and happen often "Often" but as a tiny fraction of all sender cases, something that anyone who's actually worked with email spam would know, so you either dishonestly withheld that fact or you don't know what you're talking about. Also, low-volume spammers are quite clearly an oxymoron - the definition of "spam" includes high volume. It's literally high-volume by definition: "unsolicited usually commercial messages (such as emails, text messages, or Internet postings) sent to a large number of recipients or posted in a large number of places"[1] And, the vast majority of individuals do not send high volumes of email. This is a fact. It is an edge case. > because of your lack of experience You seem to be making a lot of arguments from authority, yet you don't even have the credentials to back them up. > You're acting like it's hard to show good behaviour for a while. They're definitely not. It's crystal clear that the usefulness of Hashcash is not dependent on it being hard to show good behavior for a while, and in fact its most effective in the long term. > But they also use their own inboxes to build up volume Something that Hashcash solves, because they'll have to spend a lot of cycles solving challenges to send non-spam email to build up reputation repeatedly, because for each "clean" IP/server they'll have to repeat the "reputation ramp-up" that every legitimate sender only has to do once. > hijack accounts Literally no anti-spam situation protects against this, so it's irrelevant, and I don't know why you're bringing it up. > abuse SPF policies and DKIM misconfigurations Then these need to be fixed. Google indiscriminately blocking smaller senders isn't a fix. > Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! Exactly - that's what Hashcash does, is force spammers to spend more effort on the things that regular people do, because spammers do it at scale far more often than regular people do, and so it introduces a disproportionate cost on them. > All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others. This conclusively illustrates that you have no idea what you're talking about. Spammers do not get resources for free - they have to either spend time to acquire botnets and hijacked domains themselves, or pay money for someone to do it for them. This is pretty clear to even people who aren't in the industry. Spamming only happens if its profitable, and the reason why its still profitable is because the cost of sending a spam email is currently low enough. Hashcash directly increases the cost of spending spam email by making it compute-bound on top of needing to acquire domains, IP addresses, and machines, and spending time establishing a good sender record, while (if combined with a reputation system) barely penalizing normal users in the long run. Let me state it again: every new sender has to go through a reputation ramp-up process, but spammers are uniquely penalized by Hashcash because they have to repeatedly because after they start sending spam mail, they lose their reputation and have to start that process again. Normal users do not have to do this - they start a new server, solve a bunch of challenges, and then they don't have to do that again because they don't regularly burn their acquired reputation. The fact that you can't actually counter these arguments about Hashcash sounds almost like a spammer who's worried about the deployment of an effective system based on Hashcash. [1] https://www.merriam-webster.com/dictionary/spam https://www.merriam-webster.com/dictionary/spam

dns_snek 4y ago

Let me try to explain. If I'm a legitimate small sender of email, then Gmail requiring that my email server solves a cryptographic challenge (Hashcash or a more modern version of it) that takes a minute to compute isn't a big deal if I only send 5 emails per day. All of my outgoing emails are going to be delayed by a minute which won't affect me at all, even though it's computationally slow. On the other hand, spammers are likely sending hundreds of emails per minute per server, so limiting them to 1 email per minute would have significant consequences for them. I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? We use exactly the same idea for secure password storage. Password verification is slow, really slow, on purpose. This makes it "slow for legitimate password verifier" (the website you're logging into), but it also makes password cracking on a large scale completely infeasible.

Avamander 4y ago
> I hope this demonstrates the disproportionate effect Hashcash (or modern equivalent) would have on spammers when compared to legitimate senders? Yes, in a scenario where you're a legitimate sender that sends very few letters compared to a bulk spammer. Apples to oranges. You unfortunately ignored both the low-rate spammers and the high-rate legitimate senders. The former is barely hindered and the latter is PoW-walled into inconvinience. If you now bring in reputation schemes, then those can be played by adversaries, you'll end up at step zero but you have made a large climate impact. > but it also makes password cracking on a large scale completely infeasible. But this is not the current scenario. Intentionally complex password hashing is not really PoW we're talking about.
- dns_snek 4y ago
  > You unfortunately ignored both the low-rate spammers and the high-rate legitimate senders. Both of these seem like imaginary edge cases that don't really exist. I'm going to gloss over the oxymoron of low-rate spammers. > If you now bring in reputation schemes, then those can be played by adversaries, you'll end up at step zero but you have made a large climate impact. How do they do that? If we focus on the current state of things, high rate legitimate senders already have an established reputation so they don't need to change how they handle outgoing emails. The only thing that would change is how large email providers such as Gmail handle incoming emails from small/unknown senders, by accepting a sufficiently complex PoW as an indication that the email is not spam. Over time this should increase the sender's reputation to a point where PoW is no longer required. TLDR: Nothing would change for the big players, small senders are given an opportunity to prove they are legitimate, and spammers remain locked out.
  - Avamander 4y ago
    > Both of these seem like imaginary edge cases that don't really exist. I'm going to gloss over the oxymoron of low-rate spammers. I'm sorry? Both of those cases are very real and happen often, you don't get to just ignore them because of your lack of experience. > How do they do that? Many ways. Sending legitimate mail for example. You're acting like it's hard to show good behaviour for a while. It's one of the telltale ways I catch those fucks, they're doing it already. But they also use their own inboxes to build up volume, hijack accounts, abuse SPF policies and DKIM misconfigurations. There probably are more ways to get a "trusted" domain I can't recall this instant. Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! You have demonstrated repeatedly how you have little knowledge of spammers' and others' behaviour, you handwave away all "edge cases" and say it will work. No, it won't. All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others.
    - throw10920 4y ago
      > Both of those cases are very real and happen often "Often" but as a tiny fraction of all sender cases, something that anyone who's actually worked with email spam would know, so you either dishonestly withheld that fact or you don't know what you're talking about. Also, low-volume spammers are quite clearly an oxymoron - the definition of "spam" includes high volume. It's literally high-volume by definition: "unsolicited usually commercial messages (such as emails, text messages, or Internet postings) sent to a large number of recipients or posted in a large number of places"[1] And, the vast majority of individuals do not send high volumes of email. This is a fact. It is an edge case. > because of your lack of experience You seem to be making a lot of arguments from authority, yet you don't even have the credentials to back them up. > You're acting like it's hard to show good behaviour for a while. They're definitely not. It's crystal clear that the usefulness of Hashcash is not dependent on it being hard to show good behavior for a while, and in fact its most effective in the long term. > But they also use their own inboxes to build up volume Something that Hashcash solves, because they'll have to spend a lot of cycles solving challenges to send non-spam email to build up reputation repeatedly, because for each "clean" IP/server they'll have to repeat the "reputation ramp-up" that every legitimate sender only has to do once. > hijack accounts Literally no anti-spam situation protects against this, so it's irrelevant, and I don't know why you're bringing it up. > abuse SPF policies and DKIM misconfigurations Then these need to be fixed. Google indiscriminately blocking smaller senders isn't a fix. > Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! Exactly - that's what Hashcash does, is force spammers to spend more effort on the things that regular people do, because spammers do it at scale far more often than regular people do, and so it introduces a disproportionate cost on them. > All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others. This conclusively illustrates that you have no idea what you're talking about. Spammers do not get resources for free - they have to either spend time to acquire botnets and hijacked domains themselves, or pay money for someone to do it for them. This is pretty clear to even people who aren't in the industry. Spamming only happens if its profitable, and the reason why its still profitable is because the cost of sending a spam email is currently low enough. Hashcash directly increases the cost of spending spam email by making it compute-bound on top of needing to acquire domains, IP addresses, and machines, and spending time establishing a good sender record, while (if combined with a reputation system) barely penalizing normal users in the long run. Let me state it again: every new sender has to go through a reputation ramp-up process, but spammers are uniquely penalized by Hashcash because they have to repeatedly because after they start sending spam mail, they lose their reputation and have to start that process again. Normal users do not have to do this - they start a new server, solve a bunch of challenges, and then they don't have to do that again because they don't regularly burn their acquired reputation. The fact that you can't actually counter these arguments about Hashcash sounds almost like a spammer who's worried about the deployment of an effective system based on Hashcash. [1] https://www.merriam-webster.com/dictionary/spam https://www.merriam-webster.com/dictionary/spam