4 ms·

I support the author but let me tell you a counterargument I don’t think he devotes enough to: Spam is a real issue. The amount of spam emails which get sent

I support the author but let me tell you a counterargument I don’t think he devotes enough to: Spam is a real issue. The amount of spam emails which get sent are absurd and likely orders of magnitude more than non-spam. And spammers do a lot to mimic real emails, including just hacking legitimate addresses and adding them to botnets. Even on gmail, I still get spam sent to my inbox. Fortunately very rarely, but it still happens. And even if it isn’t bad today, spam has the potential to be much worse in the future with transformer networks and hostile state actors. And even if it really isn’t that bad and never will be, the big companies and those arguing against self-hosting will claim it is. They don’t want to allow a relative few self-hosted email servers in exchange for much more difficult and less effective spam detection. Forget Gmail and Outlook, why not just use Fastmail or Protonmail? If you want a legitimate argument for self-hosted emails you need to address the spam. It may be as simple as registering your official email with some organization sponsored by open-source, and all the big companies can trust that one organization. Then the org has to deal with spam registrations but maybe there won’t be much and it will work out. idk much about self-hosting so this org might already exist. But this article doesn’t mention that org, in fact doesn’t say much at all about spam besides “keep existing spam-prevention because it already works”. But you should at least explain why. Because spam is a legitimate argument for big-co forming an oligarchy that’s not just “so they can make more money”, and it’s the main argument that big-co uses.

Avamander 4y ago
Very well-put. > And even if it isn’t bad today, spam has the potential to be much worse in the future with transformer networks and hostile state actors. > Even on gmail, I still get spam sent to my inbox. Fortunately very rarely, but it still happens. It is as good as it is exactly because of the requirements author finds tedious. > It may be as simple as registering your official email with some organization sponsored by open-source, and all the big companies can trust that one organization. Then the org has to deal with spam registrations but maybe there won’t be much and it will work out. idk much about self-hosting so this org might already exist. They do exist but there are a bunch of problems with that. People have varying definitions of spam, getting paid to whitelist someone creates a perverse incentive or not getting paid will quickly overwhelm the organisation. Things could be better if we could enforce sender authentication (SPF/DKIM). It would assign a direct cost to getting your domain blacklisted. But if nobody is taking away rest of the spammer's domains (or keeps selling them new ones), they'll continue.
KennyBlanken 4y ago
Spam is an issue, but it's not the one that impacts me the most. I rarely get true 'spam' in my inbox. What impacts me the most is a never-ending problem with Gmail classifying messages as spam that were actually important to me. Time sensitive announcements of meetings or events, for example. Many are coming from senders I've been receiving email from for years. Gmail is convinced that almost every technical-related email mailing list I'm on is a spam source, despite my constantly going into my spam folder and telling it dozens of messages from those mailing lists are not actually spam. Meanwhile, what I do get is a barrage of promotional emails - what I consider very much to be spam - from corporations that at some point have had my email address and now email me multiple times a week. Those sail right past the spam filter into my "promotions" folder and accumulate...
pas 4y ago
email spam is not a real issue. big uncooperative gigacorps fucking it up for everyone is. responsibility for spam (and other kinds of abuse) can be delegated via simple reputation scoring for netblocks, sender authentication and a proper feedback mechanism along the chain. when the user clicks "spam" gmail already uses that to train their fancy AI and if you are not a small nobody, then they already alert you that ooops you sent something spammy via a feedback loop [1]. (see also how Mailchimp proudly claims they work with big integration partners like gmail ... https://mailchimp.com/help/how-mailchimp-prevents-and-handles-abuse/ https://mailchimp.com/help/how-mailchimp-prevents-and-handle... ) whitelist clearinghouses exist [2] but they are not terribly useful, because there's most of the signal to use for reputation is hidden :/ [1] https://en.wikipedia.org/wiki/Feedback_loop_(email) https://en.wikipedia.org/wiki/Feedback_loop_(email) [2] https://www.dnswl.org/ https://www.dnswl.org/
- armchairhacker 4y ago
  > responsibility for spam (and other kinds of abuse) can be delegated via simple reputation scoring for netblocks, sender authentication and a proper feedback mechanism along the chain. Are there any real-world examples of this? I know other decentralized networks like Tor and BitTorrent have some sort of reputation and feedback system. What type of "spam" do they deal with and how well do they deal with it? Are there any systems more similar to mail with mechanisms to prevent spam? Spam is a serious issue, not just in email, not just in decentralized systems - it's one of the main issues in technology today. If there's a solution, even a proof-of-concept in a smaller system would be great
  - massaman_yams 4y ago
    As a practitioner, I can tell you that this proposal would be quite a bit behind state of the art for email spam filter accuracy. For example, there's a surprising amount of legitimate mail that gets sent without authentication, and which you don't want to block because your end users will get mad if it goes missing. I may also point out that "reputation scoring for netblocks" is the exact problem the original blog post was complaining about. He was trying to send from residential ISP and VPS netblocks that had poor reputation, and saw delivery problems as a result.

Avamander 4y ago

Very well-put. > And even if it isn’t bad today, spam has the potential to be much worse in the future with transformer networks and hostile state actors. > Even on gmail, I still get spam sent to my inbox. Fortunately very rarely, but it still happens. It is as good as it is exactly because of the requirements author finds tedious. > It may be as simple as registering your official email with some organization sponsored by open-source, and all the big companies can trust that one organization. Then the org has to deal with spam registrations but maybe there won’t be much and it will work out. idk much about self-hosting so this org might already exist. They do exist but there are a bunch of problems with that. People have varying definitions of spam, getting paid to whitelist someone creates a perverse incentive or not getting paid will quickly overwhelm the organisation. Things could be better if we could enforce sender authentication (SPF/DKIM). It would assign a direct cost to getting your domain blacklisted. But if nobody is taking away rest of the spammer's domains (or keeps selling them new ones), they'll continue.

KennyBlanken 4y ago

Spam is an issue, but it's not the one that impacts me the most. I rarely get true 'spam' in my inbox. What impacts me the most is a never-ending problem with Gmail classifying messages as spam that were actually important to me. Time sensitive announcements of meetings or events, for example. Many are coming from senders I've been receiving email from for years. Gmail is convinced that almost every technical-related email mailing list I'm on is a spam source, despite my constantly going into my spam folder and telling it dozens of messages from those mailing lists are not actually spam. Meanwhile, what I do get is a barrage of promotional emails - what I consider very much to be spam - from corporations that at some point have had my email address and now email me multiple times a week. Those sail right past the spam filter into my "promotions" folder and accumulate...

pas 4y ago

email spam is not a real issue. big uncooperative gigacorps fucking it up for everyone is. responsibility for spam (and other kinds of abuse) can be delegated via simple reputation scoring for netblocks, sender authentication and a proper feedback mechanism along the chain. when the user clicks "spam" gmail already uses that to train their fancy AI and if you are not a small nobody, then they already alert you that ooops you sent something spammy via a feedback loop [1]. (see also how Mailchimp proudly claims they work with big integration partners like gmail ... https://mailchimp.com/help/how-mailchimp-prevents-and-handles-abuse/ https://mailchimp.com/help/how-mailchimp-prevents-and-handle... ) whitelist clearinghouses exist [2] but they are not terribly useful, because there's most of the signal to use for reputation is hidden :/ [1] https://en.wikipedia.org/wiki/Feedback_loop_(email) https://en.wikipedia.org/wiki/Feedback_loop_(email) [2] https://www.dnswl.org/ https://www.dnswl.org/

armchairhacker 4y ago
> responsibility for spam (and other kinds of abuse) can be delegated via simple reputation scoring for netblocks, sender authentication and a proper feedback mechanism along the chain. Are there any real-world examples of this? I know other decentralized networks like Tor and BitTorrent have some sort of reputation and feedback system. What type of "spam" do they deal with and how well do they deal with it? Are there any systems more similar to mail with mechanisms to prevent spam? Spam is a serious issue, not just in email, not just in decentralized systems - it's one of the main issues in technology today. If there's a solution, even a proof-of-concept in a smaller system would be great
- massaman_yams 4y ago
  As a practitioner, I can tell you that this proposal would be quite a bit behind state of the art for email spam filter accuracy. For example, there's a surprising amount of legitimate mail that gets sent without authentication, and which you don't want to block because your end users will get mad if it goes missing. I may also point out that "reputation scoring for netblocks" is the exact problem the original blog post was complaining about. He was trying to send from residential ISP and VPS netblocks that had poor reputation, and saw delivery problems as a result.