4 ms·

When it comes to email delivery, you can't ignore spam. It's the bane of existence of every email sending service and the number one business challenge in that

by ttul 6mo ago

When it comes to email delivery, you can't ignore spam. It's the bane of existence of every email sending service and the number one business challenge in that segment. After all, orchestrating delivery over SMTP is not rocket science. But getting that email to not be rejected totally IS rocket science and it's simultaneously an art form known only to a handful of email nerds working at the core of the big email sending services...

embedding-shape 6mo ago
Ok, but what about as a CDN/website-proxy/WAF? I know we don't have the same automated reputation-propagation as with email, but same thing supposedly happens there, where eventually you get turned off if you don't act on lawful requests, which is exactly why Cloudflare is unavailable in Spain during La Liga matches, because Cloudflare don't take piracy streams down. In theory, Cloudflare should take those down, when requested by legal means, but that doesn't matter. How sure are we that they'll act differently for email, instead of trying to get rid of the reputation system instead? > getting that email to not be rejected totally IS rocket science and it's simultaneously an art form known only to a handful of email nerds working at the core of the big email sending services It really isn't, you need a clean IP and a clean domain, send handful of emails and you're pretty much whitelisted on most services out there. Maybe you'd say I'm one of the handful, but I personally know more than a handful others who also run their own email services, just like me, and besides the usual hassle of running your own service, as long as you don't spam, your emails will arrive as usual.
- ttul 6mo ago
  I run an email sending service at scale (billions of messages per month, tens of millions of end users, thousands of customers). Most of our software development and operational effort revolves around abuse mitigation. That has been the case for 15 years. It's a cat-and-mouse game with two different mice: the senders, who are constantly trying to figure out how to get you to deliver their garbage; and the receivers, who are constantly trying to figure out how to block it. We're stuck in the middle. It's hard to appreciate how difficult this battle is when running at scale.
  - pbronez 6mo ago
    What structural changes could we make to improve the situation?
    - edoceo 6mo ago
      Signed senders?
    - jgalt212 6mo ago
      Hashcash, or BTC.
      - ttul 6mo ago
        I always loved the hashcash concept and actually raised our original funding because of it (our Microsoft angels loved the idea of making spamming more expensive, and our Series A concept was tar-pitting to dissuade botnets). In the context of email sending services, we have a modern version of hashcash that we might at some point turn to. If someone can figure out how to tokenize sending at scale, then senders could pay recipients to open their emails by attaching a "tip" to each message. If even a small fraction of legitimate email recipients altered their mail client settings to route "tipped" messages to their inbox, that would probably suffice to get senders to participate in the scheme. Senders are starved for high quality engagement data. Meanwhile, anything we can do to make spam less likely - on a relative scale - to reach the inbox in comparison to "legitimate" traffic, is a win.
        drumdance 6mo ago
        Wow, this brings back memories. Way back in the 2000 I worked on a concept to charge “postage“ to big senders and remit payments to receivers (hosts, not end users). I also looked at hashcash. I ultimately abandoned the project because I realized I would be spending all my time convincing big senders why they should pay and I knew I would hate that job. Previously I was the spam cop for a big sender and saw up close all the ways our clients would try to weasel around it.
    - 6mo ago
- pocksuppet 6mo ago
  Cloudflare acts on lawful requests during LaLiga matches. The problem is that the Spanish government doesn't want to bother doing things the lawful way because that takes too long. They want piracy to magically disappear and they'll randomly shut down more parts of the internet until it does. Actual illegal sports streams are not impacted by Cloudflare being down, and Cloudflare is not the only impacted network.
  - embedding-shape 6mo ago
    > problem is that the Spanish government doesn't want to bother doing things the lawful way because that takes too long In Spain, what they are doing, is the "lawful way", it's literally happening via the courts and judges. Do you think ISPs are blocking Cloudflare specifically just for fun, out of their own accord? > Actual illegal sports streams are not impacted by Cloudflare being down, and Cloudflare is not the only impacted network. Some are, many aren't. Cloudflare is indeed the only impacted network, at least for me. Which other networks are being blocked for you during the La Liga matches?
    - Dylan16807 6mo ago
      The specific blocks don't go through courts and judges.
      - embedding-shape 6mo ago
        Yes, the specific block of blocking Cloudflare in Spain during La Liga matches literally has gone through a court and been ordered by a judge, I'm not sure how you could have missed this. Judges have also dismissed the requests from Cloudflare and others to remove the "dynamic block" as there is collateral damage.
        Dylan16807 6mo ago
        My understanding was that cloudflare was being blocked by the same IP blocking list as everything else. And while that system went through courts, the list didn't. There are also direct actions against cloudflare, but that's not what's taking everything down, is it? Did I misunderstand something?

by ttul 6mo ago

embedding-shape 6mo ago

Ok, but what about as a CDN/website-proxy/WAF? I know we don't have the same automated reputation-propagation as with email, but same thing supposedly happens there, where eventually you get turned off if you don't act on lawful requests, which is exactly why Cloudflare is unavailable in Spain during La Liga matches, because Cloudflare don't take piracy streams down. In theory, Cloudflare should take those down, when requested by legal means, but that doesn't matter. How sure are we that they'll act differently for email, instead of trying to get rid of the reputation system instead? > getting that email to not be rejected totally IS rocket science and it's simultaneously an art form known only to a handful of email nerds working at the core of the big email sending services It really isn't, you need a clean IP and a clean domain, send handful of emails and you're pretty much whitelisted on most services out there. Maybe you'd say I'm one of the handful, but I personally know more than a handful others who also run their own email services, just like me, and besides the usual hassle of running your own service, as long as you don't spam, your emails will arrive as usual.

ttul 6mo ago
I run an email sending service at scale (billions of messages per month, tens of millions of end users, thousands of customers). Most of our software development and operational effort revolves around abuse mitigation. That has been the case for 15 years. It's a cat-and-mouse game with two different mice: the senders, who are constantly trying to figure out how to get you to deliver their garbage; and the receivers, who are constantly trying to figure out how to block it. We're stuck in the middle. It's hard to appreciate how difficult this battle is when running at scale.
- pbronez 6mo ago
  What structural changes could we make to improve the situation?
  - edoceo 6mo ago
    Signed senders?
  - jgalt212 6mo ago
    Hashcash, or BTC.
    - ttul 6mo ago
      I always loved the hashcash concept and actually raised our original funding because of it (our Microsoft angels loved the idea of making spamming more expensive, and our Series A concept was tar-pitting to dissuade botnets). In the context of email sending services, we have a modern version of hashcash that we might at some point turn to. If someone can figure out how to tokenize sending at scale, then senders could pay recipients to open their emails by attaching a "tip" to each message. If even a small fraction of legitimate email recipients altered their mail client settings to route "tipped" messages to their inbox, that would probably suffice to get senders to participate in the scheme. Senders are starved for high quality engagement data. Meanwhile, anything we can do to make spam less likely - on a relative scale - to reach the inbox in comparison to "legitimate" traffic, is a win.
      - drumdance 6mo ago
        Wow, this brings back memories. Way back in the 2000 I worked on a concept to charge “postage“ to big senders and remit payments to receivers (hosts, not end users). I also looked at hashcash. I ultimately abandoned the project because I realized I would be spending all my time convincing big senders why they should pay and I knew I would hate that job. Previously I was the spam cop for a big sender and saw up close all the ways our clients would try to weasel around it.
  - 6mo ago
pocksuppet 6mo ago
Cloudflare acts on lawful requests during LaLiga matches. The problem is that the Spanish government doesn't want to bother doing things the lawful way because that takes too long. They want piracy to magically disappear and they'll randomly shut down more parts of the internet until it does. Actual illegal sports streams are not impacted by Cloudflare being down, and Cloudflare is not the only impacted network.
- embedding-shape 6mo ago
  > problem is that the Spanish government doesn't want to bother doing things the lawful way because that takes too long In Spain, what they are doing, is the "lawful way", it's literally happening via the courts and judges. Do you think ISPs are blocking Cloudflare specifically just for fun, out of their own accord? > Actual illegal sports streams are not impacted by Cloudflare being down, and Cloudflare is not the only impacted network. Some are, many aren't. Cloudflare is indeed the only impacted network, at least for me. Which other networks are being blocked for you during the La Liga matches?
  - Dylan16807 6mo ago
    The specific blocks don't go through courts and judges.
    - embedding-shape 6mo ago
      Yes, the specific block of blocking Cloudflare in Spain during La Liga matches literally has gone through a court and been ordered by a judge, I'm not sure how you could have missed this. Judges have also dismissed the requests from Cloudflare and others to remove the "dynamic block" as there is collateral damage.
      - Dylan16807 6mo ago
        My understanding was that cloudflare was being blocked by the same IP blocking list as everything else. And while that system went through courts, the list didn't. There are also direct actions against cloudflare, but that's not what's taking everything down, is it? Did I misunderstand something?