18 ms·

Indirectly. More directly: spammers are killing independent email. Email's peer-node-trust story is so "version 1.0 Internet" that webmasters are left basicall

Indirectly. More directly: spammers are killing independent email. Email's peer-node-trust story is so "version 1.0 Internet" that webmasters are left basically using heuristsics, shared models, and tea-leaves to determine whether arbitrary incoming messages should be trustworthy or not, and "they should not" is a good first-pass guess! So Google (as the thousand-pound gorilla) is serving as a lightning-rod for a larger network-effect problem, which is "Users generally consider themselves better served if most unsolicited email they receive with no strong trust priors drops into a black hole." But that makes it very hard to be a newcomer who wants to establish trust priors.

gibolt 4y ago
Spam is killing tons of services beyond just Email. YouTube, Twitter, Facebook, Craigslist, ... Nearly anything public is bombarded with spam. The big players are far better suited to deal with it than any newcomers, and even they can barely manage it on their own platforms.
- foobarian 4y ago
  Makes me want to found a vigilante spam elimination society. Legal methods don't seem to work /mutter
  - warning26 4y ago
    How would that work? Track down spammers and murder them? Could make for an interesting movie plot.
    - bregma 4y ago
      [flagged]
    - mattkevan 4y ago
      Check out Rule 34 by Charlie Stross, which is based on exactly that idea. Spoilers, but the basic gist is that an advanced anti-spam AI decides to tackle the problem at the source, so to speak. Recommended reading.
    - tyingq 4y ago
      There's plenty of collateral damage in existing efforts. Makes the false positive black list entries a little more high-stakes.
    - hutzlibu 4y ago
      "Could make for an interesting movie plot." One that probably leads very quickly to WW3, as the protagonists will find out, that most of the scammers are in countries not on friendly terms with the west (and therefore they tolerate cybercrime against the west). There are also plenty of scammer operating from the west, though, so that anti spam foundation would not run out of work even if they just limit their activities to the west.
    - dehrmann 4y ago
      Imagine the penalty for murdering a Nigerian price.
    - Cyphase 4y ago
      This was a minor plot point in Freedom™, the sequel to Daemon by Daniel Suarez: https://en.wikipedia.org/wiki/Freedom%E2%84%A2 https://en.wikipedia.org/wiki/Freedom%E2%84%A2
  - LinuxBender 4y ago
    There are middle grounds. I have a myriad of servers that accept email for any domain as fast as the spam bots can send it, meaning the bots will detect them as open relays. Some bots use tracking codes back to themselves to confirm the relay is indeed open but many do not. The SMTP prompt even says not to use it. Some spammers eventually catch on and start trying poorly to attack my nodes which leads me to believe most of the spammers are not very technical.
  - twiddling 4y ago
    Start with the green card lawyers that kicked it off...
- Groxx 4y ago
  They also have no real incentive to make it easier to combat, because that's part of their competitive advantage over self-hosting. As long as it works well enough that people realize the benefit they are providing (note that this does not mean that it's best for it to work perfectly, as that would be invisible), doing more risks worsening their position.
- yafbum 4y ago
  And it's not even limited to online or free. My snail mail is 90% spam even though people have to pay for it to be printed and delivered physically to my door. I wish I had spam filtering for USPS.
  - rootusrootus 4y ago
    You can reduce some of that. Try this advice: https://consumer.ftc.gov/articles/how-stop-junk-mail https://consumer.ftc.gov/articles/how-stop-junk-mail
    - Our_Benefactors 4y ago
      Wow, PAY them to stop sending junk mail, what a brilliant scam.
      - rootusrootus 4y ago
        I'd guess that the value they normally get from junk mail over 10 years is more than the $4 processing fee, so I don't think it's a brilliant scam.
        Our_Benefactors 4y ago
        It is brilliant. Create a nuisance, then charge to remove the artificial nuisance.
  - celim307 4y ago
    Something something junk mail funds a large part of usps
    - burkaman 4y ago
      Fortunately there's no need for the USPS to be profitable, so we don't need to worry about this
- treeman79 4y ago
  Twitter now requires a paid subscription to show up in your feed. Anything else is a losing battle. https://www.cbsnews.com/amp/miami/news/change-coming-only-paid-subscribers-will-show-up-in-your-twitter-feed/ https://www.cbsnews.com/amp/miami/news/change-coming-only-pa...
  - bmarquez 4y ago
    The algorithmic "for you" section requires a paid subscription to be included, unless the user is already following an account. Following someone on Twitter is now the email equivalent of "double opt-in" for mailing lists.
- edgyquant 4y ago
  Bots have also made using nearly any dating app a chore. All apps are ruined by it, what we need is some regulations and jail (or some equivalent) to end this.
- sandworm101 4y ago
  >> Nearly anything public is bombarded with spam. The death throes of a doomed industry. Be it steel, horseshoes or advertisements, as profit margins drop production rates will increase to compensate. Then as the machine is running as fast an as efficiently as it ever has, suddenly the margin becomes zero and there isn't any more room to optimize. The entire industry suddenly stops overnight. I await that day.
  - gibolt 4y ago
    That is a slightly different issue. This would be like counterfeit steel being sold as of it were the real thing. Or direct-to-consumer horseshoes that will never arrive. Much of this spam is actively out to trick you, as opposed to legitimate players who have no margin left to give.
  - jollyllama 4y ago
    Spam's been a huge industry for twenty years. Those are some long death throes.
    - sandworm101 4y ago
      Thanks. Yet another thing I hate about my work machine: window edge spellcheck. It autocorrects without asking me. So I don't notice that I have misspelled something. It just gets corrected to some other word.
- kitsunesoba 4y ago
  For automatically dealing with the type of spam that is frequently seen in YouTube comments, I can't help but wonder if perhaps a continuously trained LLM would be well suited. Youtube spam comments tend to have highly atypical patterns, using things like unicode characters to avoid triggering keyword and URL filters. Something along the lines of GPT should pick up on these things pretty easily, and could similarly pick up on the actions these comments are requesting of users "message me on telegram", etc. It could also probably detect when spammers are trying to impersonate youtubers. It's not really the kind of thing that spammers can use LLMs themselves to work around, either. Any attempt to get past the anti-spam LLM is going to look quite unusual compared to the typical comment which would tip it off. Strangely Google seems reticent to try something in this vein though…
  - schrodinger 4y ago
    Spammers will just use LLMs to write spam, an eventual arms race!
    - moonchrome 4y ago
      You're overestimating spammers, if it raises the floor.
    - NavinF 4y ago
      https://xkcd.com/810/ https://xkcd.com/810/
    - ThunderSizzle 4y ago
      I already believe most of reddit are LLM bots created by reddit I especially in the highly political/moderated boards.
      - kitsunesoba 4y ago
        I'd be curious to hear what gives you this impression. I've read that shadowbanned users on Reddit get banished to a sort of "heaven" echo chamber where they can see only bots replying to and agreeing with them, but I've not seen anything suggesting that happens for unbanned users. There are loads of comment-copier/remixer karma farmer bots but reddit users are becoming better at recognizing and flagging those.
- soupfordummies 4y ago
  And of course the phone call.
- rootusrootus 4y ago
  I can imagine a situation where someone creates a walled garden that people will willingly pay to be part of. Costs money, involves actual proof of identity (but you could still be broadly anonymous within the garden), with the value proposition being an elimination of all advertising. Web ads, spam, all of it. There is probably some critical mass where this would work. Some people would pay to be able to just not have to do combat with the whole world simply to enjoy the Internet.
  - ryan29 4y ago
    I would like to see this done using domain validated identities. It might not work for everything, but, if I can prove I own a domain, it's a globally unique handle that can be used to build online reputation and trust. It would also make is possible for larger companies to attest to purchases made and / or the quality of participation within their community. Imagine a scenario where I donate $50 to an open source project using GitHub Sponsors with my domain as the identity and GitHub attests to me spending that $50. Over time, it would be possible to demonstrate a significant "investment" in your domain validated identity and it would be done by spending money online like you normally would without any additional cost. The attestation that you spent the money is simply a side effect of something you're already doing, but it's a really good indicator (over time) that you're a normal participant. At the very least, I think having a domain as a globally usable handle would help to reduce impersonation which is a serious, difficult to solve problem right now.
    - dotancohen 4y ago
      Domains can be lost - this idea would exacerbate that problem. In fact, it would give yet another reason to hijack a domain.
  - dotancohen 4y ago
    Figure out how to keep sites hosted off the platform available without advertising, say by a monetary agreement with either them or their ad platform, and I'll be the first in line.
  - contravariant 4y ago
- simplotek 4y ago
  > Spam is killing tons of services beyond just Email. Google Drive is infamous for its spam problem.
- EVa5I7bHFq9mnYK 4y ago
  Add Google search and Amazon listings to the list. Maybe spammers have superpowers, nothing can stop them.
- emodendroket 4y ago
  I notice that as operations like Twitter and Facebook attempt to get leaner and meaner the spam problem gets worse. I've never seen so many spambots on Twitter advertising porn and guns, and every third comment I get on Facebook gets replies from a supposed scantily clad woman who wants me to DM her.
  - ZhadruOmjar 4y ago
    I run a business Instagram account and my routine is: Make a post, add hashtags, refresh page, delete the spam comments. Its always similar accounts with similar messages and they don't seem to follow the post after it is initially shared.
- usefulcat 4y ago
  > YouTube Meh. I've watched in the hundreds of hours of YouTube videos without ever seeing or receiving any spam. I guess you must be referring to the comments? If so, perhaps I'm missing out but I've never gone to YouTube for the comments.
  - dehrmann 4y ago
    That was my thought, unless they meant that the "spam" is 10-minute videos conveying 30 seconds of information.
- thwarted 4y ago
  Tragedy of the Commons Ruins Everything Around Me.
yamtaddle 4y ago
Tighter integration between browsers, phones, and email could help with this quite a bit, I think. Default-allow every domain you give an email to, default-allow every specific address in your contact book (and maybe everyone you know on social networks?), default-deny everything else. A decent first-pass solution to part of this might be to just have email allow every domain in my password manager. I think the data's there to make this work a lot better, it's just that all the parts aren't talking to one another.
- mike_hearn 4y ago
  Gmail whitelists contacts and has done for a very long time.
- bluefirebrand 4y ago
  The thing is that humans might actually use Email to talk to humans that they have never met before and that should be a legitimate use case of email, but because spam has made it impossible to keep up with the volumes we are bombarded with that is no longer the case.
- shadowgovt 4y ago
  You're correct, but this is one of the reasons the megacorps dominate this space; they have the resources to do that integration. In contrast, what would it look like for an independent operator to roll out or maintain such an ecosystem?
kolinko 4y ago
This. Google has the best spam filters so far. I wonder though, with the advent of new LLM models, it should now be trivially possible to build a zero-shot spam-filtering bot that is self hosted.
- cycomanic 4y ago
  It used to have, but I would say it's been getting worse. The number of false positives is definetly going up and I would argue that that already gives us an indication of how important Google sees email. If they would consider email a channel that carries imporrtant information they would optimise to reduce false positives not minimise false negatives.
- Semaphor 4y ago
  Having an old Gmail account and a current fastmail one, i disagree.
  - pixelesque 4y ago
    Are they the same target email address though? If not, surely that's not a fair test if the gmail account has been around for 10+ years or so? (I have the same situation, an 18-year old gmail account and a 6 year old fastmail account, but the reason I don't get ANY spam at all in the fastmail account is I only use it for certain things and it's much newer, so I'd argue at least in my case, that's not a fair comparison).
  - massaman_yams 4y ago
    Gmail is subject to specific targeting by spammers in a way that fastmail is not. The returns for spending weeks or months finding a niche way through Gmail's filters are justified by the number of gmail addresses that can be targeted, which is probably 3 orders of magnitude larger than the total number of fastmail subscribers.
    - Semaphor 4y ago
      Good point, though it's still in favor of fastmail (which, as a paid service, will always be several magnitudes lower in users)
fuzzy2 4y ago
But spam is mostly from GMail nowadays. In the last seven days, 8 out of 10 spam mails I received (that didn’t get rejected outright) came from GMail.
- NoZebra120vClip 4y ago
  Is it from GMail servers, or is it from spoofed GMail accounts?
  - tedunangst 4y ago
    From mail.google.com servers, dkim signed and all.
  - fuzzy2 4y ago
    No, it's actually truly sent using GMail. Otherwise, it could not benefit from GMail's reputation.
- nanidin 4y ago
  I use some publicly available spam IP blocklists and my server started rejecting mail from gmail.com because they ended up on one of the lists for sending spam. I thought it was funny. When this happens, gmail informs the sender that the mail wasn’t delivered and they try a few more times before telling the user that no more attempts will be made.
  - account42 4y ago
    > When this happens, gmail informs the sender that the mail wasn’t delivered and they try a few more times before telling the user that no more attempts will be made. That depends entirely on how the receiving server rejects the mail. If it just drops it into the spam folder or /dev/null Gmail won't be able to know. If it responds with a non-transient error code then Gmail will (correctly) NOT try again and inform the user of that.
upofadown 4y ago
>Users generally consider themselves better served if most unsolicited email they receive with no strong trust priors drops into a black hole. If users really want that then they can just dump all email from addresses not in their address book. Some already do that. It turns out that most people actually want to be able to get email from entities they do not yet know.
- RestlessMind 4y ago
  > most people actually want to be able to get email from entities they do not yet know. citation needed for "most". "some" people want emails from unknown entities. I am not sure about how big that fraction is.
- alistairSH 4y ago
  There are unsolicited emails and emails from unknown senders. The two aren’t the same. I email a car dealer. I expect a response. But I don’t know if it’ll be from Bob or Larry. And I definitely don’t want to be added to thirty two different email lists they manage.
pseudalopex 4y ago
> "Users generally consider themselves better served if most unsolicited email they receive with no strong trust priors drops into a black hole." What is the evidence for this claim? Not Microsoft or Google acknowledge they drop email.
- shadowgovt 4y ago
  Extrapolated from "Nearly 85% of all email is spam." At that volume, if your spam filter started with a random coin-toss you're more likely going to serve the user's interest than not. https://dataprot.net/statistics/spam-statistics/ https://dataprot.net/statistics/spam-statistics/
  - pseudalopex 4y ago
    Conservative filters identify most spam. Rejecting email serves users' interests better than dropping it into a black hole.
    - shadowgovt 4y ago
      Rejecting email takes more than zero bytes back over the wire. When the other party in the transaction is assumed hostile, the principle is to provide them as little information as possible.
      - pseudalopex 4y ago
        The number of bytes transmitted back is not material to users' interests. Hostile parties can observe non delivery with accounts of their own.
  - account42 4y ago
    That only follows if the cost of false positives and false negatives are the same, which they are not.
- nottorp 4y ago
  The fact that they don't acknowledge it doesn't mean they don't drop it. I've had to set up someone's mail server last year. All mails sent to gmail were silently dropped until we set up all the current buzzwords for the domain/email server. Then they magically started to show up. Possibly we were lucky that "just" setting up SPF DKIM etc fixed it.
alberth 4y ago
> version 1.0 Internet, that webmasters “Webmaster” isn’t a title I’ve heard in about 20-years.
nullc 4y ago
Gmail's spam filtering has lots of monopoly hardening convenient limitations. Like the fact that sending out to or not-spamming a DKIM authenticated non-gmail sender once isn't sufficient to prevent their future DKIM authenticated messages from going to spam. Of course, spammers have significantly moved to using gmail and it just streams right through.
deleted 4y ago
[deleted]
3np 4y ago
I don't buy it. If Alice contacts Bob first, and Alice replies directly to Bob, that reply shouldn't get dropped as spam. And yet it does.
- simplotek 4y ago
  > I don't buy it. If a potential customer contacts a business first, and the business sends unsolicited messages to the customer, that reply shouldn't get dropped as spam. And yet it does.
  - 3np 4y ago
    You mean a scenario where the customer contacts the business over e-mail, and the business then starts spamming from the exact same address? Does this actually happen to a meaningful extent?
singularity2001 4y ago
Google is Directly killing e-mail: my friends can no longer receive emails from our server even if they have me whitelisted, in their contacts and repeatedly marked as not spam.
- redundantly 4y ago
  Look into services like sendgrid. I think AWS offers a free tier for mail delivery.
  - djbusby 4y ago
    Sendgrid is not an independent email server.
    - redundantly 4y ago
      > Sendgrid is not an independent email server. Nor is any mail server that interacts with other mail servers. Using an email delivery service to ensure mail gets delivered is probably the easiest fix for singularity2001's issue. Otherwise they're looking at changing their hosting, changing their IP, or fighting the nearly impossible battle with Google to get their mail to be accepted by its system.
WalterBright 4y ago
Spam email would likely be reduced 99% if it cost the sender a penny to send each email. To implement, establish an email header field for a token. The tokens are one-time use, and can be purchased from some token selling authority. The recipient can check with the selling authority if it is valid. If it is missing or invalid, it goes to the junk folder.
- 3np 4y ago
  This thinking is behind the introduction of Proof-of-Work, later popularized through Bitcoin. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash
  - Gigachad 4y ago
    Problem with this is that it absolutely melts your phone to send a picture while a spammer with a GPU farm can blast out spam in bulk.
    - Avamander 4y ago
      Also melts a small operator's mailing list server while the spammer is toasting some IP cameras and insecure IoT without care.
- mdale 4y ago
  I don't know .. we do have ads on the Internet and these do cost money to run. Can't you pay less than a penny a user to run ads in Gmail today ? The idea is fair though I don't think it's far from where we landed with how the large email broker systems operate with the large email system providers.
- thatguy0900 4y ago
  Would it? Somehow it makes financial sense to mail spam out physically, which I assume costs about that much. Is the conversion rate that much better for physical spam?
  - 4y ago
lisper 4y ago
I run my own email server in part so I could implement a spam filtering strategy that had access to my outgoing mail. Anything received from someone I sent mail to is assumed non-spam, and that is the anchor for the rest of the filtering. I was planning to build a pretty sophisticated bayesian filter on top of that but it turned out to be unnecessary. The strategy I ended up with, which has served me well for many years now, is: 1. Block a small number of extremely spammy TLDs. There are about a dozen of these, including .biz, .casa, etc. 2. Anything received from someone I've sent mail to, or a sender I've previously marked as good, is assumed good. 3. Anything received from an address whose name contains an English word on a relatively short list of spammy words (discount, offer, etc.) is assumed spam. 4. Anything received from an address that I have received email from before and not marked as good is assumed spam. That leaves emails from addresses that are sending me email for the first time. These are overwhelmingly spam, but after the four filters above there are few enough of these that I just scan them manually once a day or so. The real key here is treating the first email from any given address as essentially a "contact request" with the default action being "deny in the future". That just turns out empirically to work incredibly well. More than 90% of my spam is from repeat offenders.
- deleted 4y ago
  [deleted]
- Dalewyn 4y ago
  >1. Block a small number of extremely spammy TLDs. There are about a dozen of these, including .biz, .casa, etc. Honest question: Is there any reason to not just blacklist all emails from TLDs that aren't the Big Four (.com, .net, .org, .gov) and country TLDs (eg: .co.uk, .jp, etc.)? I can't recall ever needing, let alone wanting, email from the later TLDs like .biz or any of the bloody stupid new TLDs that comprise entire words.
  - yieldcrv 4y ago
    as someone that’s never needed SEO perks of a .com since none of my customers would use a search engine to find me (they’ll click thru from posts and ads on social media and group chats) I typically register both a new TLD and a .com, and I use the .com for the email campaigns and reply-to if it gets flagged that doesnt affect my more official one-to-one emails from the actual domain so I would say, maybe? because I’m not allergic to “bloody stupid” TLD’s and have already adapted to what you’re wondering about
takeda 4y ago
I think spammers are just excuse that Google hides behind. I had static IP address for a decade, never used it to send spam (I filered SMTP ports from NATed clients), made sure I'm not blacklisted on any RBLs, configured SPF and DKIM. Yet suddenly my emails go to spam in gmail. Now, there's no way for me to do anything, because I'm nobody. As for spam, my bayesian filter works just fine, so if I can successfully filter spammers out, I think Google can as well. I feel like Google is doing this purposefully to make people like me to simply give up, and observing responses, it is successful.
- Gigachad 4y ago
  >so if I can successfully filter spammers out, I think Google can as well. This is absurd. The problems Google face are orders of magnitude more complex than your individual mail server. Your server benefits from the fact that no one cares about it. No one will develop a custom spam technique to send you spam. They will for Google. There will be whole offices in India dedicated to working out exactly what slips through Gmail. You benefit from a kind of herd immunity where no one even sends the kind of spam that would reach you because it's blocked by Gmail so not worth sending.
  - takeda 4y ago
    The spammers don't attack mail servers, but individual mailboxes. Your personal gmail account has the same risk of receiving spam as mine, but Google has much more tools available to detect spam. For example they can easily see somebody is spamming, when large gmail accounts are receiving the same message. They can easily see which hosts are compromised proxies as they receive tons of mail, and seeing large number of e-mails sent from questionable hosts should be easy to spot. They didn't really improve spam detection much for for a decade, because blocking small hobbyist mail servers is more likely increase their user base. Those special farms you're mentioning, wouldn't work, if filtering would be individual per user, as it should be, because each person's mailbox is different and each person has different definition what spam is.
zackees 4y ago
I wrote a very good spam filter using chat gpt that was way better for whatever excuse big tech is using for their “spam filters”. We need to stop buying the narrative that they are doing this to fight spam and are doing it as a gate keeping exercise.
jjav 4y ago
> More directly: spammers are killing independent email. Disagree. In the early 00s, spam was killing email. I was getting thousands of spams per minute to my personal email domain (same one I still have and have had since the mid 90s). It was real bad back then. Doing aggressive sanity checking on incoming email back then was problematic since nearly all legitimate senders also has badly misconfigured email servers. Those days are gone. Legitimate senders have well-configured email now, one can do a lot of sanity checking on the SMTP connection and that alone cuts out most of the would-be spam before it is ever sent and none of the real email is impacted. Sprinkle a bit of bayesian filtering on what remains and spam is mostly a non-issue anymore. So what it the problem these days? Part of it is a legacy cultural problem. A lot of email admins wear so many scars from the early 00s that they still operate on a mental model that they are willing to throw away a lot of legitimate email just to prevent even one in a million spam to go through. That's highly counterproductive and causes a lot of harm to interoperability. The other big factor of course is that the very deep pocket email providers (gmail, microsoft) have a strong vested interest in strenghtening their monopoly even further so they are happy to go along anything that decreases interoperability. That all said, I strongly encourage everyone who can to run their own email. Interoperability can only be saved by exercising it as much as possible. And it still works fine despite the naysayers. I've been running my email infrastructure for a long time and have no deliverability problems anywhere that I've run into.
- ymolodtsov 4y ago
  The article literally says that setting up proper records is easy and spammers do it as well. So there's no simple solutions.
  - megous 4y ago
    I assume badly misconfigured servers meant something like open relay setup. Not DMARC and dependent technologies, which are not protection against spam at all, anyway. They are protection against various kinds of spoofing. And I concur with the original commenter. I do zero filtering on my SMTP server (no reverse DNS lookups, no blacklists, no nothing), in order to be sure I receive every single email, and SPAM looks like it would not be an issue even if I disabled the bayes classification client side, these days. I mostly rely on providing unique random addresses to each service. My oldest 18 year old address gets quite a bit of spam so I blocked it and switched to different one, but newer addresses that I use for the last 5 years didn't accumulate much spam, despite being public and crawlable on the web.
account42 4y ago
People put up with millions of ads everywhere but a handful of spam mails a day and everyone looses their minds. Meh, I'd rather have the spam then be beholden to centralized gatekeepers.

gibolt 4y ago

Spam is killing tons of services beyond just Email. YouTube, Twitter, Facebook, Craigslist, ... Nearly anything public is bombarded with spam. The big players are far better suited to deal with it than any newcomers, and even they can barely manage it on their own platforms.

foobarian 4y ago
Makes me want to found a vigilante spam elimination society. Legal methods don't seem to work /mutter
- warning26 4y ago
  How would that work? Track down spammers and murder them? Could make for an interesting movie plot.
  - bregma 4y ago
    [flagged]
  - mattkevan 4y ago
    Check out Rule 34 by Charlie Stross, which is based on exactly that idea. Spoilers, but the basic gist is that an advanced anti-spam AI decides to tackle the problem at the source, so to speak. Recommended reading.
  - tyingq 4y ago
    There's plenty of collateral damage in existing efforts. Makes the false positive black list entries a little more high-stakes.
  - hutzlibu 4y ago
    "Could make for an interesting movie plot." One that probably leads very quickly to WW3, as the protagonists will find out, that most of the scammers are in countries not on friendly terms with the west (and therefore they tolerate cybercrime against the west). There are also plenty of scammer operating from the west, though, so that anti spam foundation would not run out of work even if they just limit their activities to the west.
  - dehrmann 4y ago
    Imagine the penalty for murdering a Nigerian price.
  - Cyphase 4y ago
    This was a minor plot point in Freedom™, the sequel to Daemon by Daniel Suarez: https://en.wikipedia.org/wiki/Freedom%E2%84%A2 https://en.wikipedia.org/wiki/Freedom%E2%84%A2
- LinuxBender 4y ago
  There are middle grounds. I have a myriad of servers that accept email for any domain as fast as the spam bots can send it, meaning the bots will detect them as open relays. Some bots use tracking codes back to themselves to confirm the relay is indeed open but many do not. The SMTP prompt even says not to use it. Some spammers eventually catch on and start trying poorly to attack my nodes which leads me to believe most of the spammers are not very technical.
- twiddling 4y ago
  Start with the green card lawyers that kicked it off...
Groxx 4y ago
They also have no real incentive to make it easier to combat, because that's part of their competitive advantage over self-hosting. As long as it works well enough that people realize the benefit they are providing (note that this does not mean that it's best for it to work perfectly, as that would be invisible), doing more risks worsening their position.
yafbum 4y ago
And it's not even limited to online or free. My snail mail is 90% spam even though people have to pay for it to be printed and delivered physically to my door. I wish I had spam filtering for USPS.
- rootusrootus 4y ago
  You can reduce some of that. Try this advice: https://consumer.ftc.gov/articles/how-stop-junk-mail https://consumer.ftc.gov/articles/how-stop-junk-mail
  - Our_Benefactors 4y ago
    Wow, PAY them to stop sending junk mail, what a brilliant scam.
    - rootusrootus 4y ago
      I'd guess that the value they normally get from junk mail over 10 years is more than the $4 processing fee, so I don't think it's a brilliant scam.
      - Our_Benefactors 4y ago
        It is brilliant. Create a nuisance, then charge to remove the artificial nuisance.
- celim307 4y ago
  Something something junk mail funds a large part of usps
  - burkaman 4y ago
    Fortunately there's no need for the USPS to be profitable, so we don't need to worry about this
treeman79 4y ago
Twitter now requires a paid subscription to show up in your feed. Anything else is a losing battle. https://www.cbsnews.com/amp/miami/news/change-coming-only-paid-subscribers-will-show-up-in-your-twitter-feed/ https://www.cbsnews.com/amp/miami/news/change-coming-only-pa...
- bmarquez 4y ago
  The algorithmic "for you" section requires a paid subscription to be included, unless the user is already following an account. Following someone on Twitter is now the email equivalent of "double opt-in" for mailing lists.
edgyquant 4y ago
Bots have also made using nearly any dating app a chore. All apps are ruined by it, what we need is some regulations and jail (or some equivalent) to end this.
sandworm101 4y ago
>> Nearly anything public is bombarded with spam. The death throes of a doomed industry. Be it steel, horseshoes or advertisements, as profit margins drop production rates will increase to compensate. Then as the machine is running as fast an as efficiently as it ever has, suddenly the margin becomes zero and there isn't any more room to optimize. The entire industry suddenly stops overnight. I await that day.
- gibolt 4y ago
  That is a slightly different issue. This would be like counterfeit steel being sold as of it were the real thing. Or direct-to-consumer horseshoes that will never arrive. Much of this spam is actively out to trick you, as opposed to legitimate players who have no margin left to give.
- jollyllama 4y ago
  Spam's been a huge industry for twenty years. Those are some long death throes.
  - sandworm101 4y ago
    Thanks. Yet another thing I hate about my work machine: window edge spellcheck. It autocorrects without asking me. So I don't notice that I have misspelled something. It just gets corrected to some other word.
kitsunesoba 4y ago
For automatically dealing with the type of spam that is frequently seen in YouTube comments, I can't help but wonder if perhaps a continuously trained LLM would be well suited. Youtube spam comments tend to have highly atypical patterns, using things like unicode characters to avoid triggering keyword and URL filters. Something along the lines of GPT should pick up on these things pretty easily, and could similarly pick up on the actions these comments are requesting of users "message me on telegram", etc. It could also probably detect when spammers are trying to impersonate youtubers. It's not really the kind of thing that spammers can use LLMs themselves to work around, either. Any attempt to get past the anti-spam LLM is going to look quite unusual compared to the typical comment which would tip it off. Strangely Google seems reticent to try something in this vein though…
- schrodinger 4y ago
  Spammers will just use LLMs to write spam, an eventual arms race!
  - moonchrome 4y ago
    You're overestimating spammers, if it raises the floor.
  - NavinF 4y ago
    https://xkcd.com/810/ https://xkcd.com/810/
  - ThunderSizzle 4y ago
    I already believe most of reddit are LLM bots created by reddit I especially in the highly political/moderated boards.
    - kitsunesoba 4y ago
      I'd be curious to hear what gives you this impression. I've read that shadowbanned users on Reddit get banished to a sort of "heaven" echo chamber where they can see only bots replying to and agreeing with them, but I've not seen anything suggesting that happens for unbanned users. There are loads of comment-copier/remixer karma farmer bots but reddit users are becoming better at recognizing and flagging those.
soupfordummies 4y ago
And of course the phone call.
rootusrootus 4y ago
I can imagine a situation where someone creates a walled garden that people will willingly pay to be part of. Costs money, involves actual proof of identity (but you could still be broadly anonymous within the garden), with the value proposition being an elimination of all advertising. Web ads, spam, all of it. There is probably some critical mass where this would work. Some people would pay to be able to just not have to do combat with the whole world simply to enjoy the Internet.
- ryan29 4y ago
  I would like to see this done using domain validated identities. It might not work for everything, but, if I can prove I own a domain, it's a globally unique handle that can be used to build online reputation and trust. It would also make is possible for larger companies to attest to purchases made and / or the quality of participation within their community. Imagine a scenario where I donate $50 to an open source project using GitHub Sponsors with my domain as the identity and GitHub attests to me spending that $50. Over time, it would be possible to demonstrate a significant "investment" in your domain validated identity and it would be done by spending money online like you normally would without any additional cost. The attestation that you spent the money is simply a side effect of something you're already doing, but it's a really good indicator (over time) that you're a normal participant. At the very least, I think having a domain as a globally usable handle would help to reduce impersonation which is a serious, difficult to solve problem right now.
  - dotancohen 4y ago
    Domains can be lost - this idea would exacerbate that problem. In fact, it would give yet another reason to hijack a domain.
- dotancohen 4y ago
  Figure out how to keep sites hosted off the platform available without advertising, say by a monetary agreement with either them or their ad platform, and I'll be the first in line.
- contravariant 4y ago
simplotek 4y ago
> Spam is killing tons of services beyond just Email. Google Drive is infamous for its spam problem.
EVa5I7bHFq9mnYK 4y ago
Add Google search and Amazon listings to the list. Maybe spammers have superpowers, nothing can stop them.
emodendroket 4y ago
I notice that as operations like Twitter and Facebook attempt to get leaner and meaner the spam problem gets worse. I've never seen so many spambots on Twitter advertising porn and guns, and every third comment I get on Facebook gets replies from a supposed scantily clad woman who wants me to DM her.
- ZhadruOmjar 4y ago
  I run a business Instagram account and my routine is: Make a post, add hashtags, refresh page, delete the spam comments. Its always similar accounts with similar messages and they don't seem to follow the post after it is initially shared.
usefulcat 4y ago
> YouTube Meh. I've watched in the hundreds of hours of YouTube videos without ever seeing or receiving any spam. I guess you must be referring to the comments? If so, perhaps I'm missing out but I've never gone to YouTube for the comments.
- dehrmann 4y ago
  That was my thought, unless they meant that the "spam" is 10-minute videos conveying 30 seconds of information.
thwarted 4y ago
Tragedy of the Commons Ruins Everything Around Me.

yamtaddle 4y ago

Tighter integration between browsers, phones, and email could help with this quite a bit, I think. Default-allow every domain you give an email to, default-allow every specific address in your contact book (and maybe everyone you know on social networks?), default-deny everything else. A decent first-pass solution to part of this might be to just have email allow every domain in my password manager. I think the data's there to make this work a lot better, it's just that all the parts aren't talking to one another.

mike_hearn 4y ago
Gmail whitelists contacts and has done for a very long time.
bluefirebrand 4y ago
The thing is that humans might actually use Email to talk to humans that they have never met before and that should be a legitimate use case of email, but because spam has made it impossible to keep up with the volumes we are bombarded with that is no longer the case.
shadowgovt 4y ago
You're correct, but this is one of the reasons the megacorps dominate this space; they have the resources to do that integration. In contrast, what would it look like for an independent operator to roll out or maintain such an ecosystem?

kolinko 4y ago

This. Google has the best spam filters so far. I wonder though, with the advent of new LLM models, it should now be trivially possible to build a zero-shot spam-filtering bot that is self hosted.

cycomanic 4y ago
It used to have, but I would say it's been getting worse. The number of false positives is definetly going up and I would argue that that already gives us an indication of how important Google sees email. If they would consider email a channel that carries imporrtant information they would optimise to reduce false positives not minimise false negatives.
Semaphor 4y ago
Having an old Gmail account and a current fastmail one, i disagree.
- pixelesque 4y ago
  Are they the same target email address though? If not, surely that's not a fair test if the gmail account has been around for 10+ years or so? (I have the same situation, an 18-year old gmail account and a 6 year old fastmail account, but the reason I don't get ANY spam at all in the fastmail account is I only use it for certain things and it's much newer, so I'd argue at least in my case, that's not a fair comparison).
- massaman_yams 4y ago
  Gmail is subject to specific targeting by spammers in a way that fastmail is not. The returns for spending weeks or months finding a niche way through Gmail's filters are justified by the number of gmail addresses that can be targeted, which is probably 3 orders of magnitude larger than the total number of fastmail subscribers.
  - Semaphor 4y ago
    Good point, though it's still in favor of fastmail (which, as a paid service, will always be several magnitudes lower in users)

fuzzy2 4y ago

But spam is mostly from GMail nowadays. In the last seven days, 8 out of 10 spam mails I received (that didn’t get rejected outright) came from GMail.

NoZebra120vClip 4y ago
Is it from GMail servers, or is it from spoofed GMail accounts?
- tedunangst 4y ago
  From mail.google.com servers, dkim signed and all.
- fuzzy2 4y ago
  No, it's actually truly sent using GMail. Otherwise, it could not benefit from GMail's reputation.
nanidin 4y ago
I use some publicly available spam IP blocklists and my server started rejecting mail from gmail.com because they ended up on one of the lists for sending spam. I thought it was funny. When this happens, gmail informs the sender that the mail wasn’t delivered and they try a few more times before telling the user that no more attempts will be made.
- account42 4y ago
  > When this happens, gmail informs the sender that the mail wasn’t delivered and they try a few more times before telling the user that no more attempts will be made. That depends entirely on how the receiving server rejects the mail. If it just drops it into the spam folder or /dev/null Gmail won't be able to know. If it responds with a non-transient error code then Gmail will (correctly) NOT try again and inform the user of that.

upofadown 4y ago

>Users generally consider themselves better served if most unsolicited email they receive with no strong trust priors drops into a black hole. If users really want that then they can just dump all email from addresses not in their address book. Some already do that. It turns out that most people actually want to be able to get email from entities they do not yet know.

RestlessMind 4y ago
> most people actually want to be able to get email from entities they do not yet know. citation needed for "most". "some" people want emails from unknown entities. I am not sure about how big that fraction is.
alistairSH 4y ago
There are unsolicited emails and emails from unknown senders. The two aren’t the same. I email a car dealer. I expect a response. But I don’t know if it’ll be from Bob or Larry. And I definitely don’t want to be added to thirty two different email lists they manage.

pseudalopex 4y ago

> "Users generally consider themselves better served if most unsolicited email they receive with no strong trust priors drops into a black hole." What is the evidence for this claim? Not Microsoft or Google acknowledge they drop email.

shadowgovt 4y ago
Extrapolated from "Nearly 85% of all email is spam." At that volume, if your spam filter started with a random coin-toss you're more likely going to serve the user's interest than not. https://dataprot.net/statistics/spam-statistics/ https://dataprot.net/statistics/spam-statistics/
- pseudalopex 4y ago
  Conservative filters identify most spam. Rejecting email serves users' interests better than dropping it into a black hole.
  - shadowgovt 4y ago
    Rejecting email takes more than zero bytes back over the wire. When the other party in the transaction is assumed hostile, the principle is to provide them as little information as possible.
    - pseudalopex 4y ago
      The number of bytes transmitted back is not material to users' interests. Hostile parties can observe non delivery with accounts of their own.
- account42 4y ago
  That only follows if the cost of false positives and false negatives are the same, which they are not.
nottorp 4y ago
The fact that they don't acknowledge it doesn't mean they don't drop it. I've had to set up someone's mail server last year. All mails sent to gmail were silently dropped until we set up all the current buzzwords for the domain/email server. Then they magically started to show up. Possibly we were lucky that "just" setting up SPF DKIM etc fixed it.

alberth 4y ago

> version 1.0 Internet, that webmasters “Webmaster” isn’t a title I’ve heard in about 20-years.

nullc 4y ago

Gmail's spam filtering has lots of monopoly hardening convenient limitations. Like the fact that sending out to or not-spamming a DKIM authenticated non-gmail sender once isn't sufficient to prevent their future DKIM authenticated messages from going to spam. Of course, spammers have significantly moved to using gmail and it just streams right through.

deleted 4y ago

[deleted]

3np 4y ago

I don't buy it. If Alice contacts Bob first, and Alice replies directly to Bob, that reply shouldn't get dropped as spam. And yet it does.

simplotek 4y ago
> I don't buy it. If a potential customer contacts a business first, and the business sends unsolicited messages to the customer, that reply shouldn't get dropped as spam. And yet it does.
- 3np 4y ago
  You mean a scenario where the customer contacts the business over e-mail, and the business then starts spamming from the exact same address? Does this actually happen to a meaningful extent?

singularity2001 4y ago

Google is Directly killing e-mail: my friends can no longer receive emails from our server even if they have me whitelisted, in their contacts and repeatedly marked as not spam.

redundantly 4y ago
Look into services like sendgrid. I think AWS offers a free tier for mail delivery.
- djbusby 4y ago
  Sendgrid is not an independent email server.
  - redundantly 4y ago
    > Sendgrid is not an independent email server. Nor is any mail server that interacts with other mail servers. Using an email delivery service to ensure mail gets delivered is probably the easiest fix for singularity2001's issue. Otherwise they're looking at changing their hosting, changing their IP, or fighting the nearly impossible battle with Google to get their mail to be accepted by its system.

WalterBright 4y ago

Spam email would likely be reduced 99% if it cost the sender a penny to send each email. To implement, establish an email header field for a token. The tokens are one-time use, and can be purchased from some token selling authority. The recipient can check with the selling authority if it is valid. If it is missing or invalid, it goes to the junk folder.

3np 4y ago
This thinking is behind the introduction of Proof-of-Work, later popularized through Bitcoin. https://en.wikipedia.org/wiki/Hashcash https://en.wikipedia.org/wiki/Hashcash
- Gigachad 4y ago
  Problem with this is that it absolutely melts your phone to send a picture while a spammer with a GPU farm can blast out spam in bulk.
  - Avamander 4y ago
    Also melts a small operator's mailing list server while the spammer is toasting some IP cameras and insecure IoT without care.
mdale 4y ago
I don't know .. we do have ads on the Internet and these do cost money to run. Can't you pay less than a penny a user to run ads in Gmail today ? The idea is fair though I don't think it's far from where we landed with how the large email broker systems operate with the large email system providers.
thatguy0900 4y ago
Would it? Somehow it makes financial sense to mail spam out physically, which I assume costs about that much. Is the conversion rate that much better for physical spam?
- 4y ago

lisper 4y ago

I run my own email server in part so I could implement a spam filtering strategy that had access to my outgoing mail. Anything received from someone I sent mail to is assumed non-spam, and that is the anchor for the rest of the filtering. I was planning to build a pretty sophisticated bayesian filter on top of that but it turned out to be unnecessary. The strategy I ended up with, which has served me well for many years now, is: 1. Block a small number of extremely spammy TLDs. There are about a dozen of these, including .biz, .casa, etc. 2. Anything received from someone I've sent mail to, or a sender I've previously marked as good, is assumed good. 3. Anything received from an address whose name contains an English word on a relatively short list of spammy words (discount, offer, etc.) is assumed spam. 4. Anything received from an address that I have received email from before and not marked as good is assumed spam. That leaves emails from addresses that are sending me email for the first time. These are overwhelmingly spam, but after the four filters above there are few enough of these that I just scan them manually once a day or so. The real key here is treating the first email from any given address as essentially a "contact request" with the default action being "deny in the future". That just turns out empirically to work incredibly well. More than 90% of my spam is from repeat offenders.

deleted 4y ago
[deleted]
Dalewyn 4y ago
>1. Block a small number of extremely spammy TLDs. There are about a dozen of these, including .biz, .casa, etc. Honest question: Is there any reason to not just blacklist all emails from TLDs that aren't the Big Four (.com, .net, .org, .gov) and country TLDs (eg: .co.uk, .jp, etc.)? I can't recall ever needing, let alone wanting, email from the later TLDs like .biz or any of the bloody stupid new TLDs that comprise entire words.
- yieldcrv 4y ago
  as someone that’s never needed SEO perks of a .com since none of my customers would use a search engine to find me (they’ll click thru from posts and ads on social media and group chats) I typically register both a new TLD and a .com, and I use the .com for the email campaigns and reply-to if it gets flagged that doesnt affect my more official one-to-one emails from the actual domain so I would say, maybe? because I’m not allergic to “bloody stupid” TLD’s and have already adapted to what you’re wondering about

takeda 4y ago

I think spammers are just excuse that Google hides behind. I had static IP address for a decade, never used it to send spam (I filered SMTP ports from NATed clients), made sure I'm not blacklisted on any RBLs, configured SPF and DKIM. Yet suddenly my emails go to spam in gmail. Now, there's no way for me to do anything, because I'm nobody. As for spam, my bayesian filter works just fine, so if I can successfully filter spammers out, I think Google can as well. I feel like Google is doing this purposefully to make people like me to simply give up, and observing responses, it is successful.

Gigachad 4y ago
>so if I can successfully filter spammers out, I think Google can as well. This is absurd. The problems Google face are orders of magnitude more complex than your individual mail server. Your server benefits from the fact that no one cares about it. No one will develop a custom spam technique to send you spam. They will for Google. There will be whole offices in India dedicated to working out exactly what slips through Gmail. You benefit from a kind of herd immunity where no one even sends the kind of spam that would reach you because it's blocked by Gmail so not worth sending.
- takeda 4y ago
  The spammers don't attack mail servers, but individual mailboxes. Your personal gmail account has the same risk of receiving spam as mine, but Google has much more tools available to detect spam. For example they can easily see somebody is spamming, when large gmail accounts are receiving the same message. They can easily see which hosts are compromised proxies as they receive tons of mail, and seeing large number of e-mails sent from questionable hosts should be easy to spot. They didn't really improve spam detection much for for a decade, because blocking small hobbyist mail servers is more likely increase their user base. Those special farms you're mentioning, wouldn't work, if filtering would be individual per user, as it should be, because each person's mailbox is different and each person has different definition what spam is.

zackees 4y ago

I wrote a very good spam filter using chat gpt that was way better for whatever excuse big tech is using for their “spam filters”. We need to stop buying the narrative that they are doing this to fight spam and are doing it as a gate keeping exercise.

jjav 4y ago

> More directly: spammers are killing independent email. Disagree. In the early 00s, spam was killing email. I was getting thousands of spams per minute to my personal email domain (same one I still have and have had since the mid 90s). It was real bad back then. Doing aggressive sanity checking on incoming email back then was problematic since nearly all legitimate senders also has badly misconfigured email servers. Those days are gone. Legitimate senders have well-configured email now, one can do a lot of sanity checking on the SMTP connection and that alone cuts out most of the would-be spam before it is ever sent and none of the real email is impacted. Sprinkle a bit of bayesian filtering on what remains and spam is mostly a non-issue anymore. So what it the problem these days? Part of it is a legacy cultural problem. A lot of email admins wear so many scars from the early 00s that they still operate on a mental model that they are willing to throw away a lot of legitimate email just to prevent even one in a million spam to go through. That's highly counterproductive and causes a lot of harm to interoperability. The other big factor of course is that the very deep pocket email providers (gmail, microsoft) have a strong vested interest in strenghtening their monopoly even further so they are happy to go along anything that decreases interoperability. That all said, I strongly encourage everyone who can to run their own email. Interoperability can only be saved by exercising it as much as possible. And it still works fine despite the naysayers. I've been running my email infrastructure for a long time and have no deliverability problems anywhere that I've run into.

ymolodtsov 4y ago
The article literally says that setting up proper records is easy and spammers do it as well. So there's no simple solutions.
- megous 4y ago
  I assume badly misconfigured servers meant something like open relay setup. Not DMARC and dependent technologies, which are not protection against spam at all, anyway. They are protection against various kinds of spoofing. And I concur with the original commenter. I do zero filtering on my SMTP server (no reverse DNS lookups, no blacklists, no nothing), in order to be sure I receive every single email, and SPAM looks like it would not be an issue even if I disabled the bayes classification client side, these days. I mostly rely on providing unique random addresses to each service. My oldest 18 year old address gets quite a bit of spam so I blocked it and switched to different one, but newer addresses that I use for the last 5 years didn't accumulate much spam, despite being public and crawlable on the web.

account42 4y ago

People put up with millions of ads everywhere but a handful of spam mails a day and everyone looses their minds. Meh, I'd rather have the spam then be beholden to centralized gatekeepers.