3 ms·

> Both of these seem like imaginary edge cases that don't really exist. I'm going to gloss over the oxymoron of low-rate spammers. I'm sorry? Both of those cas

> Both of these seem like imaginary edge cases that don't really exist. I'm going to gloss over the oxymoron of low-rate spammers. I'm sorry? Both of those cases are very real and happen often, you don't get to just ignore them because of your lack of experience. > How do they do that? Many ways. Sending legitimate mail for example. You're acting like it's hard to show good behaviour for a while. It's one of the telltale ways I catch those fucks, they're doing it already. But they also use their own inboxes to build up volume, hijack accounts, abuse SPF policies and DKIM misconfigurations. There probably are more ways to get a "trusted" domain I can't recall this instant. Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! You have demonstrated repeatedly how you have little knowledge of spammers' and others' behaviour, you handwave away all "edge cases" and say it will work. No, it won't. All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others.

throw10920 4y ago
> Both of those cases are very real and happen often "Often" but as a tiny fraction of all sender cases, something that anyone who's actually worked with email spam would know, so you either dishonestly withheld that fact or you don't know what you're talking about. Also, low-volume spammers are quite clearly an oxymoron - the definition of "spam" includes high volume. It's literally high-volume by definition: "unsolicited usually commercial messages (such as emails, text messages, or Internet postings) sent to a large number of recipients or posted in a large number of places"[1] And, the vast majority of individuals do not send high volumes of email. This is a fact. It is an edge case. > because of your lack of experience You seem to be making a lot of arguments from authority, yet you don't even have the credentials to back them up. > You're acting like it's hard to show good behaviour for a while. They're definitely not. It's crystal clear that the usefulness of Hashcash is not dependent on it being hard to show good behavior for a while, and in fact its most effective in the long term. > But they also use their own inboxes to build up volume Something that Hashcash solves, because they'll have to spend a lot of cycles solving challenges to send non-spam email to build up reputation repeatedly, because for each "clean" IP/server they'll have to repeat the "reputation ramp-up" that every legitimate sender only has to do once. > hijack accounts Literally no anti-spam situation protects against this, so it's irrelevant, and I don't know why you're bringing it up. > abuse SPF policies and DKIM misconfigurations Then these need to be fixed. Google indiscriminately blocking smaller senders isn't a fix. > Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! Exactly - that's what Hashcash does, is force spammers to spend more effort on the things that regular people do, because spammers do it at scale far more often than regular people do, and so it introduces a disproportionate cost on them. > All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others. This conclusively illustrates that you have no idea what you're talking about. Spammers do not get resources for free - they have to either spend time to acquire botnets and hijacked domains themselves, or pay money for someone to do it for them. This is pretty clear to even people who aren't in the industry. Spamming only happens if its profitable, and the reason why its still profitable is because the cost of sending a spam email is currently low enough. Hashcash directly increases the cost of spending spam email by making it compute-bound on top of needing to acquire domains, IP addresses, and machines, and spending time establishing a good sender record, while (if combined with a reputation system) barely penalizing normal users in the long run. Let me state it again: every new sender has to go through a reputation ramp-up process, but spammers are uniquely penalized by Hashcash because they have to repeatedly because after they start sending spam mail, they lose their reputation and have to start that process again. Normal users do not have to do this - they start a new server, solve a bunch of challenges, and then they don't have to do that again because they don't regularly burn their acquired reputation. The fact that you can't actually counter these arguments about Hashcash sounds almost like a spammer who's worried about the deployment of an effective system based on Hashcash. [1] https://www.merriam-webster.com/dictionary/spam https://www.merriam-webster.com/dictionary/spam
- Avamander 4y ago
  > "Often" but as a tiny fraction of all sender cases Not really, no. I mentioned and you're dismissing high-rate legitimate senders and low-rate spammers. The former happens for example when companies send bills each month, they hit very high rates compared to their usual baseline. The latter is not the majority volume-wise, but is the most annoying - fairly logical that some spammers choose to fly under the radar and drop a letter or two in a minute. Do that during the night and you've landed a lot of letters in people's inboxes before you get reported. > And, the vast majority of individuals do not send high volumes of email. This is a fact. It is an edge case. It may be an edge case for you, but it must be accounted for. You can't wave it away because then people won't receive their mail. Just one minor example, some less tech-savy users emulate mailing lists with hundreds of people in CC. You can't say there that "oh this is my anti-spam solution but it doesn't account for you because you're an edge case" > Also, low-volume spammers are quite clearly an oxymoron - the definition of "spam" includes high volume. There's a difference between total volume and rate. You confusing the two is your problem. Not to mention that a dictionary definition is not the ground truth neither does it define "high volume". I'd also say unwanted unsolicited advertisement sent to 30 people is still spam, but you do you. > You seem to be making a lot of arguments from authority, yet you don't even have the credentials to back them up. From experience backed up with explanations, and you're dismissing them based on yours with no explanation. > Literally no anti-spam situation protects against this, so it's irrelevant, and I don't know why you're bringing it up. Incorrect. Looking at IP addresses suddenly behaving unusual is a great signal compared to the aggregate of a domain's total. > Then these need to be fixed. Google indiscriminately blocking smaller senders isn't a fix. They absolutely should be, but it's difficult and in the end you're not alone on the internet. Until people will, IP's continue to be used for spam classification. And no, it's not indiscriminate. > Exactly - that's what Hashcash does [...] I think you misunderstood again and let me rephrase. Spammers spend more effort to lower effort spent per unit of spam. So in the end they spend less effort per letter than legitimate small senders. > This conclusively illustrates that you have no idea what you're talking about. Spammers do not get resources for free Your sentence conclusively illustrates you're clutching at straws. Declaring that something stolen hasn't been gotten for free is a shaky foundation to build your argument upon and pedantry at worst. The cost to acquire those resources is there anyways, some extra CPU they have to steal is not that significant. > Hashcash directly increases the cost of spending spam email by making it compute-bound on top of needing to acquire domains, IP addresses, and machines. > Normal users don't have to do that again because they don't regularly burn their acquired reputation. You're going in a loop again. We're comparing relative effort/monetary cost per email here. If one side has lowered the cost of effort by parallelizing things it's unfair to the side that hasn't. Consider the scenario where a new online store owner starts sending email or someone's script is compromising yet another poorly secured blog, IoT device or SMTP account. Now a legitimate sender has built up all the reputation, after a few flags by recipients it was spent in an instant. Everything will become slow and expensive for the actual owner, once again. For spammers it was the tenth one that day. Such a massive extra cost for the spammers. /s That was just one example. Again it all boils down to the fact that regular users can't parallelize their actions in the same way spammers can - PoW would make it *relatively* more expensive (time+effort+money) to legitimate users per email. > The fact that you can't actually counter these arguments about Hashcash sounds almost like a spammer who's worried about the deployment of an effective system based on Hashcash. So many ad hominems, so little substance.
dns_snek 4y ago
I read this entire tree of comments and I really don't understand why you continue to engage in this condescending manner. If you're some kind of subject matter expert on the topic then by all means, please elaborate on the intricate details and challenges of dealing with spam, from start to finish, as well as any proposed solutions to make self-hosting viable when dealing with providers such as Gmail. These patronizing "you obviously know less than I do" type comments that occasionally drop a few bits information aren't adding anything to the conversation.
- Avamander 4y ago
  > I read this entire tree of comments and I really don't understand why you continue to engage in this condescending manner. If you haven't noticed, I heavily copy phrases from the people I reply to. If you don't like your tone being matched, unfortunate. > Please elaborate on the intricate details and challenges of dealing with spam, from start to finish, as well as any proposed solutions to make self-hosting viable when dealing with providers such as Gmail. I have, and you included have ignored it as "edge cases" and alike. What can I more explain when someone has taken the stance of being dismissive?

throw10920 4y ago

> Both of those cases are very real and happen often "Often" but as a tiny fraction of all sender cases, something that anyone who's actually worked with email spam would know, so you either dishonestly withheld that fact or you don't know what you're talking about. Also, low-volume spammers are quite clearly an oxymoron - the definition of "spam" includes high volume. It's literally high-volume by definition: "unsolicited usually commercial messages (such as emails, text messages, or Internet postings) sent to a large number of recipients or posted in a large number of places"[1] And, the vast majority of individuals do not send high volumes of email. This is a fact. It is an edge case. > because of your lack of experience You seem to be making a lot of arguments from authority, yet you don't even have the credentials to back them up. > You're acting like it's hard to show good behaviour for a while. They're definitely not. It's crystal clear that the usefulness of Hashcash is not dependent on it being hard to show good behavior for a while, and in fact its most effective in the long term. > But they also use their own inboxes to build up volume Something that Hashcash solves, because they'll have to spend a lot of cycles solving challenges to send non-spam email to build up reputation repeatedly, because for each "clean" IP/server they'll have to repeat the "reputation ramp-up" that every legitimate sender only has to do once. > hijack accounts Literally no anti-spam situation protects against this, so it's irrelevant, and I don't know why you're bringing it up. > abuse SPF policies and DKIM misconfigurations Then these need to be fixed. Google indiscriminately blocking smaller senders isn't a fix. > Things regular senders can do, spammers can do, but they'll spend more effort to do it at scale! Exactly - that's what Hashcash does, is force spammers to spend more effort on the things that regular people do, because spammers do it at scale far more often than regular people do, and so it introduces a disproportionate cost on them. > All you'd add is wasted compute resource and time. Compute and time that especially spammers get for free by abusing others. This conclusively illustrates that you have no idea what you're talking about. Spammers do not get resources for free - they have to either spend time to acquire botnets and hijacked domains themselves, or pay money for someone to do it for them. This is pretty clear to even people who aren't in the industry. Spamming only happens if its profitable, and the reason why its still profitable is because the cost of sending a spam email is currently low enough. Hashcash directly increases the cost of spending spam email by making it compute-bound on top of needing to acquire domains, IP addresses, and machines, and spending time establishing a good sender record, while (if combined with a reputation system) barely penalizing normal users in the long run. Let me state it again: every new sender has to go through a reputation ramp-up process, but spammers are uniquely penalized by Hashcash because they have to repeatedly because after they start sending spam mail, they lose their reputation and have to start that process again. Normal users do not have to do this - they start a new server, solve a bunch of challenges, and then they don't have to do that again because they don't regularly burn their acquired reputation. The fact that you can't actually counter these arguments about Hashcash sounds almost like a spammer who's worried about the deployment of an effective system based on Hashcash. [1] https://www.merriam-webster.com/dictionary/spam https://www.merriam-webster.com/dictionary/spam

Avamander 4y ago
> "Often" but as a tiny fraction of all sender cases Not really, no. I mentioned and you're dismissing high-rate legitimate senders and low-rate spammers. The former happens for example when companies send bills each month, they hit very high rates compared to their usual baseline. The latter is not the majority volume-wise, but is the most annoying - fairly logical that some spammers choose to fly under the radar and drop a letter or two in a minute. Do that during the night and you've landed a lot of letters in people's inboxes before you get reported. > And, the vast majority of individuals do not send high volumes of email. This is a fact. It is an edge case. It may be an edge case for you, but it must be accounted for. You can't wave it away because then people won't receive their mail. Just one minor example, some less tech-savy users emulate mailing lists with hundreds of people in CC. You can't say there that "oh this is my anti-spam solution but it doesn't account for you because you're an edge case" > Also, low-volume spammers are quite clearly an oxymoron - the definition of "spam" includes high volume. There's a difference between total volume and rate. You confusing the two is your problem. Not to mention that a dictionary definition is not the ground truth neither does it define "high volume". I'd also say unwanted unsolicited advertisement sent to 30 people is still spam, but you do you. > You seem to be making a lot of arguments from authority, yet you don't even have the credentials to back them up. From experience backed up with explanations, and you're dismissing them based on yours with no explanation. > Literally no anti-spam situation protects against this, so it's irrelevant, and I don't know why you're bringing it up. Incorrect. Looking at IP addresses suddenly behaving unusual is a great signal compared to the aggregate of a domain's total. > Then these need to be fixed. Google indiscriminately blocking smaller senders isn't a fix. They absolutely should be, but it's difficult and in the end you're not alone on the internet. Until people will, IP's continue to be used for spam classification. And no, it's not indiscriminate. > Exactly - that's what Hashcash does [...] I think you misunderstood again and let me rephrase. Spammers spend more effort to lower effort spent per unit of spam. So in the end they spend less effort per letter than legitimate small senders. > This conclusively illustrates that you have no idea what you're talking about. Spammers do not get resources for free Your sentence conclusively illustrates you're clutching at straws. Declaring that something stolen hasn't been gotten for free is a shaky foundation to build your argument upon and pedantry at worst. The cost to acquire those resources is there anyways, some extra CPU they have to steal is not that significant. > Hashcash directly increases the cost of spending spam email by making it compute-bound on top of needing to acquire domains, IP addresses, and machines. > Normal users don't have to do that again because they don't regularly burn their acquired reputation. You're going in a loop again. We're comparing relative effort/monetary cost per email here. If one side has lowered the cost of effort by parallelizing things it's unfair to the side that hasn't. Consider the scenario where a new online store owner starts sending email or someone's script is compromising yet another poorly secured blog, IoT device or SMTP account. Now a legitimate sender has built up all the reputation, after a few flags by recipients it was spent in an instant. Everything will become slow and expensive for the actual owner, once again. For spammers it was the tenth one that day. Such a massive extra cost for the spammers. /s That was just one example. Again it all boils down to the fact that regular users can't parallelize their actions in the same way spammers can - PoW would make it *relatively* more expensive (time+effort+money) to legitimate users per email. > The fact that you can't actually counter these arguments about Hashcash sounds almost like a spammer who's worried about the deployment of an effective system based on Hashcash. So many ad hominems, so little substance.

dns_snek 4y ago

I read this entire tree of comments and I really don't understand why you continue to engage in this condescending manner. If you're some kind of subject matter expert on the topic then by all means, please elaborate on the intricate details and challenges of dealing with spam, from start to finish, as well as any proposed solutions to make self-hosting viable when dealing with providers such as Gmail. These patronizing "you obviously know less than I do" type comments that occasionally drop a few bits information aren't adding anything to the conversation.

Avamander 4y ago
> I read this entire tree of comments and I really don't understand why you continue to engage in this condescending manner. If you haven't noticed, I heavily copy phrases from the people I reply to. If you don't like your tone being matched, unfortunate. > Please elaborate on the intricate details and challenges of dealing with spam, from start to finish, as well as any proposed solutions to make self-hosting viable when dealing with providers such as Gmail. I have, and you included have ignored it as "edge cases" and alike. What can I more explain when someone has taken the stance of being dismissive?