3 ms·

Nobody in the email world considers ARC to be a bulletproof way to bypass spam filtering at a major receiver. The DEFCON presenter was ill-equipped to make that

by ttul 3y ago

Nobody in the email world considers ARC to be a bulletproof way to bypass spam filtering at a major receiver. The DEFCON presenter was ill-equipped to make that determination.

bhaney 3y ago
> bulletproof way to bypass spam filtering Yeah that's definitely not what I meant or what the presenter seems to be implying. If it helps spam scores even a little bit, that's very interesting and potentially worth implementing in private hosts that often get dinged by larger hosts just for not being well-known. It doesn't need to get anywhere near turning actual spam into non-spam.
- ttul 3y ago
  I've worked in anti-spam since 2003. I am skeptical that his claims about ARC work at scale. Google does not have a rules-based spam filtering system. It is entirely driven by a massive machine learning model that adjusts its weights in response to user interaction. You can't beat that model.
  - inetknght 3y ago
    > It is entirely driven by a massive machine learning model that adjusts its weights in response to user interaction. You can't beat that model. Why not? Spammers do. I get spam to my gmail all the time.
    - vinay_ys 3y ago
      Yep, I see phishing style spam (email from random domain that claims to be my bank) in my gmail in the past few weeks.
  - iamacyborg 3y ago
    > You can't beat that model. Sign up for a google apps account and send outbound cold sales spam via gmail. Seems to work exceedingly well judging by my inbox.
    - ttul 3y ago
      … I should have carved out a space for cold prospecting. I’m using GPT-3.5 to detect it in my own inbox because bulk spam filters don’t seem to have the requisite power to deal with such highly customized messages at scale.
      - iamacyborg 3y ago
        They’ll be detecting based on spam received from the sending domain soon enough.
  - baobabKoodaa 3y ago
    > I've worked in anti-spam since 2003. By that you mean 2003 was the first year this vulnerability was reported to you, and every year since you've been auto-replying "nothing to see here" when people kept reporting this vulnerability to you?

by ttul 3y ago

Nobody in the email world considers ARC to be a bulletproof way to bypass spam filtering at a major receiver. The DEFCON presenter was ill-equipped to make that determination.

bhaney 3y ago

> bulletproof way to bypass spam filtering Yeah that's definitely not what I meant or what the presenter seems to be implying. If it helps spam scores even a little bit, that's very interesting and potentially worth implementing in private hosts that often get dinged by larger hosts just for not being well-known. It doesn't need to get anywhere near turning actual spam into non-spam.

ttul 3y ago
I've worked in anti-spam since 2003. I am skeptical that his claims about ARC work at scale. Google does not have a rules-based spam filtering system. It is entirely driven by a massive machine learning model that adjusts its weights in response to user interaction. You can't beat that model.
- inetknght 3y ago
  > It is entirely driven by a massive machine learning model that adjusts its weights in response to user interaction. You can't beat that model. Why not? Spammers do. I get spam to my gmail all the time.
  - vinay_ys 3y ago
    Yep, I see phishing style spam (email from random domain that claims to be my bank) in my gmail in the past few weeks.
- iamacyborg 3y ago
  > You can't beat that model. Sign up for a google apps account and send outbound cold sales spam via gmail. Seems to work exceedingly well judging by my inbox.
  - ttul 3y ago
    … I should have carved out a space for cold prospecting. I’m using GPT-3.5 to detect it in my own inbox because bulk spam filters don’t seem to have the requisite power to deal with such highly customized messages at scale.
    - iamacyborg 3y ago
      They’ll be detecting based on spam received from the sending domain soon enough.
- baobabKoodaa 3y ago
  > I've worked in anti-spam since 2003. By that you mean 2003 was the first year this vulnerability was reported to you, and every year since you've been auto-replying "nothing to see here" when people kept reporting this vulnerability to you?