5 ms·

Device attestation doesn't solve the bot problem either as seen on Android. It just annoys browsers and OS with a smaller marketshare to the point that I'm won

Device attestation doesn't solve the bot problem either as seen on Android. It just annoys browsers and OS with a smaller marketshare to the point that I'm wondering if it's even legal with antitrust legislation.

jeroenhd 3y ago
It will, but only on Android recent, locked-down Android devices. The first step in device attestation will probably allow the Android click farms to continue, but once it's in place, restrictions will just become stricter over time.
- realusername 3y ago
  The clickfarms nowadays already use tons of non modified devices built on racks so I really don't see how it's going to make a dent. Devices are way too cheap for an attestation system to work to counter bots
  - Avamander 3y ago
    Not only click farms, these devices are also used for SMS toll fraud and other similar attacks. SafetyNet's attestation only helps to the extent that you can ban a specific model/maker.
    - realusername 3y ago
      Yes that's basically it, you can ban a specific device but that's like removing water from the ocean with a bucket. Betting on device attestation really means betting that computing devices will become more and more expensive in the future since the device cost is the only blocker created by the attestation. And if there's one thing I'm expecting, it's that's not going to happen, device prices will continue to decline.
Etheryte 3y ago
It could, but not in a way any one of us would want it. This specific attested device isn't marked as legit by any of the big players? Into the blocked list you go. This is very similar to what we see today with email providers for example. If you start running a new server, you start with a negative reputation and have to climb out, you don't start from neutral.
- judge2020 3y ago
  > If you start running a new server, you start with a negative reputation and have to climb out, you don't start from neutral. Not really. If you start a new server from an IP range with known bad actors, sure. Many have tried and failed to run their own mail servers from Digitalocean, vultr, or even more dedicated-esque server hosts and pretty quickly see how much of a hassle doing so is. But if you buy a v4 /24 from some reputable or old company and get it assigned to your own AS, you won't have negative reputation and will be fairly successful as long as you have spf/dkim/dmarc set up properly.
  - dns_snek 3y ago
    > But if you buy a v4 /24 from some reputable or old company and get it assigned to your own AS Doesn't that have an extremely high barrier to entry? A legal entity, significant ongoing fees, and some infrastructure? I'm under the impression that this is entirely out of reach for anyone just trying to run an email server at home for personal use. I would love to be wrong!
    - Avamander 3y ago
      Bulk sending (including transactional) indeed is out of reach in that sense, but it's still not too difficult to pull off on a smaller scale.
  - throwaway81523 3y ago
    > if you buy a v4 /24 from some reputable or old company and get it assigned to your own AS, you won't have negative reputation until you give yourself negative reputation by running abuse bots from that range.

jeroenhd 3y ago

It will, but only on Android recent, locked-down Android devices. The first step in device attestation will probably allow the Android click farms to continue, but once it's in place, restrictions will just become stricter over time.

realusername 3y ago
The clickfarms nowadays already use tons of non modified devices built on racks so I really don't see how it's going to make a dent. Devices are way too cheap for an attestation system to work to counter bots
- Avamander 3y ago
  Not only click farms, these devices are also used for SMS toll fraud and other similar attacks. SafetyNet's attestation only helps to the extent that you can ban a specific model/maker.
  - realusername 3y ago
    Yes that's basically it, you can ban a specific device but that's like removing water from the ocean with a bucket. Betting on device attestation really means betting that computing devices will become more and more expensive in the future since the device cost is the only blocker created by the attestation. And if there's one thing I'm expecting, it's that's not going to happen, device prices will continue to decline.

Etheryte 3y ago

It could, but not in a way any one of us would want it. This specific attested device isn't marked as legit by any of the big players? Into the blocked list you go. This is very similar to what we see today with email providers for example. If you start running a new server, you start with a negative reputation and have to climb out, you don't start from neutral.

judge2020 3y ago
> If you start running a new server, you start with a negative reputation and have to climb out, you don't start from neutral. Not really. If you start a new server from an IP range with known bad actors, sure. Many have tried and failed to run their own mail servers from Digitalocean, vultr, or even more dedicated-esque server hosts and pretty quickly see how much of a hassle doing so is. But if you buy a v4 /24 from some reputable or old company and get it assigned to your own AS, you won't have negative reputation and will be fairly successful as long as you have spf/dkim/dmarc set up properly.
- dns_snek 3y ago
  > But if you buy a v4 /24 from some reputable or old company and get it assigned to your own AS Doesn't that have an extremely high barrier to entry? A legal entity, significant ongoing fees, and some infrastructure? I'm under the impression that this is entirely out of reach for anyone just trying to run an email server at home for personal use. I would love to be wrong!
  - Avamander 3y ago
    Bulk sending (including transactional) indeed is out of reach in that sense, but it's still not too difficult to pull off on a smaller scale.
- throwaway81523 3y ago
  > if you buy a v4 /24 from some reputable or old company and get it assigned to your own AS, you won't have negative reputation until you give yourself negative reputation by running abuse bots from that range.