3 ms·

I know the enforcement of this would be problematic and require some tinkering and the establishment of probably a whole department of the .gov and a lot of tin

I know the enforcement of this would be problematic and require some tinkering and the establishment of probably a whole department of the .gov and a lot of tinkering by well informed people, but it is just wild to me that all entities, not even just registrars, but every entity in every step of the process, from registrars, to ISPs, to cloud service providers, to email providers, to hosting providers, everyone involved in a scammers' operation profits from the scamming, and none of them* are even slightly culpable. Like how are you selling amaz0n.us and NOT figuring out that someone is up to shady shit? How are you approving thousands of emails with Amazon in the subject line and not realizing you are not Amazon's provider? How are you hosting pages clearly duplicated off legitimate websites that this one IS ABSOLUTELY NOT and just shrugging your shoulders? I'm not even saying we need continuous monitoring on all these fronts but like, if you get an inordinate number of spam reports on a client, maybe take a freaking look? Maybe take a look at what your hosting servers are publicly serving? Maybe give the mildest of a shit about promoting a healthier Internet, considering you're selling the tools people use to build it?

whatshisface 3y ago
One problem is that if they start policing spam, they might have to answer to Congress' opinions about content that is "as bad as spam" or worse like so-called misinformation. That is one reason (constitutional protection of freedom of speech) that the USPS ships so much junk mail around even when they could from an operational perspective (but again, not a constitutional perspective) decline it. I am not saying that the constitution protects phishing emails, but I am saying that claims of the technology not being developed yet for policing online content are one major reason the recent age verification push in Australia did not go into effect. It is not an unmitigated good for control at that level of granularity to be possible.
- manfre 3y ago
  The USPS is paid to deliver the bulk rate mail spam. That is one of their strongest reasons to not block it.
- ToucanLoucan 3y ago
  Two counter points: 1) The Freedom of Speech and of the press by extension at the time it was created was working under the assumptions of the printing press and carriage mail. I think it's long past time for a re-evaluation on this in the modern age, not only when bulk mailing can done at a scale that would make a press-printer's head spin today with modern machinery, but also and especially with regard to email, which is basically free minus the trivial cost of electricity to send a truly mind bending amount of spam messages. 2) I think it's beyond ridiculous that so many people will bring up that "well having any standard of information (to prevent misinformation) can be used by bad actors, so it's better to not have the mechanism at all to review the content of things." On subjective matters of opinion, it is certainly much, much harder to determine bad-faith or say with certainty that something is misinformation. But tons and I do mean actual tons of spam can be easily flagged as misinformation: be they advertising products that are flagrantly fraudulent in nature, be they advertising 419 scams that are... scams, be they fake amazon alerts about missed shipments, etc. etc. I would go so far as to say a majority in fact of spam email can be objectively determined to be misinformation of one kind or another, even if you totally discount political things from that system which I can see the logic of even if I don't necessarily agree with it. And if you agree with that assessment, then why in the world are we permitting this communication to occur? Why have we just thrown up our hands and said "nothing to do about it" as spammers have basically ruined an entire medium of communication?
  - whatshisface 3y ago
    My best answer to both is that humanity has not advanced to the stage where the government or (worse) un-appointed mail carriers, electronic or otherwise, who were not selected by the market for their moderation skills or evenhandedness, can be given that kind of power. Instead, we make smaller forums and voluntarily submit ourselves to small scale powers like dang directly on the basis of their fairness and effectiveness. Could AT&T pull a dang out of their inner workings? Probably not... and definitely not the several thousand that would be necessary to limit spam.
autoexec 3y ago
ISPs and mail admins have some incentive to limit the amount of abuse because if they don't other networks will just drop their traffic. The problem is that this trick only works until you reach a certain size. Google can host malware all day and they're responsible for massive amounts of spam, but nobody is going to blacklist everything from @gmail.com so they don't have to care. When AOL was the largest ISP in the world the situation was similar. They'd aggressively blacklist other networks while not acting on abuse originating from their own. We either need laws that penalize irresponsible internet companies or we need an origination like ICANN to enforce polices that cut off bad actors. If ARIN pulled the IP space from networks that didn't clean up their mess, or stopped letting lazy domain registrars sell domains things would improve pretty quickly. Instead we're making whois increasingly worthless and a growing number of sites and services don't even have a working abuse@ address to report problems to.
- deleted 3y ago
  [deleted]
- saagarjha 3y ago
  Oh, people do try doing that. SORBS does this a lot and it basically means you cannot use Gmail with them.
AnthonyMouse 3y ago
> Like how are you selling amaz0n.us and NOT figuring out that someone is up to shady shit? They sell millions of domains and there is no human being looking at any of them. You also have no idea what someone is going to use a domain for when they register it. How is the registrar supposed to know if amaz0n.us is intended to be a scam or some US citizen's advocacy site to protect the Amazon Rainforest, which they had to settle for because amazon.us was registered by some unrelated conglomerate in 2002? If someone is sending a lot of emails with Amazon in the subject line, maybe they're just a normal seller on Amazon communicating with their customers? Or the same advocacy group mailing people about the rainforest. The only way to even attempt it is algorithmically, but algorithms have so many false positives that anyone who attempts it will quickly lose their legitimate customers to the horror stories of some unaccountable algorithm shutting down their sole source of income or their incredibly sympathetic charity organization. > I'm not even saying we need continuous monitoring on all these fronts but like, if you get an inordinate number of spam reports on a client, maybe take a freaking look? The scam sites do get shut down. The scammers just make new ones. What you need is for the police to put the scammers in prison where they can't make any more websites.
quags 3y ago
Like spam email these phishing scams evolve. Something like amaz0n generally comes from amazon in the domain being blocked since not all domains can realistically be checked during the order. The phishing check need to continually evolve and there will always be false positives blocking legitimate sites. Bank is a common one that gets blocked so a domain like embankment - or you want to block cialis because of pharmaceutical and it blocks specialist - these may not pass phishing checks and be order stopping. Godaddy probably can do more and be closer to other country level registrars that more closely require some type of id or business registration to complete the order but fraudsters will still try and some will succeed in getting phishing domains created.

whatshisface 3y ago

One problem is that if they start policing spam, they might have to answer to Congress' opinions about content that is "as bad as spam" or worse like so-called misinformation. That is one reason (constitutional protection of freedom of speech) that the USPS ships so much junk mail around even when they could from an operational perspective (but again, not a constitutional perspective) decline it. I am not saying that the constitution protects phishing emails, but I am saying that claims of the technology not being developed yet for policing online content are one major reason the recent age verification push in Australia did not go into effect. It is not an unmitigated good for control at that level of granularity to be possible.

manfre 3y ago
The USPS is paid to deliver the bulk rate mail spam. That is one of their strongest reasons to not block it.
ToucanLoucan 3y ago
Two counter points: 1) The Freedom of Speech and of the press by extension at the time it was created was working under the assumptions of the printing press and carriage mail. I think it's long past time for a re-evaluation on this in the modern age, not only when bulk mailing can done at a scale that would make a press-printer's head spin today with modern machinery, but also and especially with regard to email, which is basically free minus the trivial cost of electricity to send a truly mind bending amount of spam messages. 2) I think it's beyond ridiculous that so many people will bring up that "well having any standard of information (to prevent misinformation) can be used by bad actors, so it's better to not have the mechanism at all to review the content of things." On subjective matters of opinion, it is certainly much, much harder to determine bad-faith or say with certainty that something is misinformation. But tons and I do mean actual tons of spam can be easily flagged as misinformation: be they advertising products that are flagrantly fraudulent in nature, be they advertising 419 scams that are... scams, be they fake amazon alerts about missed shipments, etc. etc. I would go so far as to say a majority in fact of spam email can be objectively determined to be misinformation of one kind or another, even if you totally discount political things from that system which I can see the logic of even if I don't necessarily agree with it. And if you agree with that assessment, then why in the world are we permitting this communication to occur? Why have we just thrown up our hands and said "nothing to do about it" as spammers have basically ruined an entire medium of communication?
- whatshisface 3y ago
  My best answer to both is that humanity has not advanced to the stage where the government or (worse) un-appointed mail carriers, electronic or otherwise, who were not selected by the market for their moderation skills or evenhandedness, can be given that kind of power. Instead, we make smaller forums and voluntarily submit ourselves to small scale powers like dang directly on the basis of their fairness and effectiveness. Could AT&T pull a dang out of their inner workings? Probably not... and definitely not the several thousand that would be necessary to limit spam.

autoexec 3y ago

ISPs and mail admins have some incentive to limit the amount of abuse because if they don't other networks will just drop their traffic. The problem is that this trick only works until you reach a certain size. Google can host malware all day and they're responsible for massive amounts of spam, but nobody is going to blacklist everything from @gmail.com so they don't have to care. When AOL was the largest ISP in the world the situation was similar. They'd aggressively blacklist other networks while not acting on abuse originating from their own. We either need laws that penalize irresponsible internet companies or we need an origination like ICANN to enforce polices that cut off bad actors. If ARIN pulled the IP space from networks that didn't clean up their mess, or stopped letting lazy domain registrars sell domains things would improve pretty quickly. Instead we're making whois increasingly worthless and a growing number of sites and services don't even have a working abuse@ address to report problems to.

deleted 3y ago
[deleted]
saagarjha 3y ago
Oh, people do try doing that. SORBS does this a lot and it basically means you cannot use Gmail with them.

AnthonyMouse 3y ago

> Like how are you selling amaz0n.us and NOT figuring out that someone is up to shady shit? They sell millions of domains and there is no human being looking at any of them. You also have no idea what someone is going to use a domain for when they register it. How is the registrar supposed to know if amaz0n.us is intended to be a scam or some US citizen's advocacy site to protect the Amazon Rainforest, which they had to settle for because amazon.us was registered by some unrelated conglomerate in 2002? If someone is sending a lot of emails with Amazon in the subject line, maybe they're just a normal seller on Amazon communicating with their customers? Or the same advocacy group mailing people about the rainforest. The only way to even attempt it is algorithmically, but algorithms have so many false positives that anyone who attempts it will quickly lose their legitimate customers to the horror stories of some unaccountable algorithm shutting down their sole source of income or their incredibly sympathetic charity organization. > I'm not even saying we need continuous monitoring on all these fronts but like, if you get an inordinate number of spam reports on a client, maybe take a freaking look? The scam sites do get shut down. The scammers just make new ones. What you need is for the police to put the scammers in prison where they can't make any more websites.

quags 3y ago

Like spam email these phishing scams evolve. Something like amaz0n generally comes from amazon in the domain being blocked since not all domains can realistically be checked during the order. The phishing check need to continually evolve and there will always be false positives blocking legitimate sites. Bank is a common one that gets blocked so a domain like embankment - or you want to block cialis because of pharmaceutical and it blocks specialist - these may not pass phishing checks and be order stopping. Godaddy probably can do more and be closer to other country level registrars that more closely require some type of id or business registration to complete the order but fraudsters will still try and some will succeed in getting phishing domains created.