5 ms·

The "unintended side effect of filtering spam" explanation makes no sense. How likely is it that the same company which builds bleeding-edge machine-learning s

by cs702 14y ago

The "unintended side effect of filtering spam" explanation makes no sense. How likely is it that the same company which builds bleeding-edge machine-learning systems to track and predict our behavior online, and which uses these AI predictions constantly to maximize their ad revenue, somehow cannot find a better way to filter out spam invites? How likely is it that the same company that houses the likes of Hinton, Norvig and Kurzweil under the same roof can't find a better way? Google is packed with experts at solving the "spam filtering" (i.e., pattern recognition) problem. It appears this was done on purpose[1], driven by a corporate culture that no longer cares as much about openness. [Please read jholman's responses below. He's right, I went too far with this last sentence.] -- [1] http://mail.jabber.org/pipermail/operators/2013-February/001571.html http://mail.jabber.org/pipermail/operators/2013-February/001... -- Edits: added "it appears" at the end, to tone down the language. Also, reworded and added sentences to make my point clearer, and corrected text to refer to invites, not messages (thanks for pointing that out, mdc!) and point out that this was indeed done on purpose.

cma 14y ago
Maybe Hinton didn't make any progress on it yesterday so they decided to call it quits? It does suck that they did this. I have been hit with many spam requests through Google Talk recently though. You should at least be able to whitelist people in your address book or something. Yeah, you can still send them an invite, but what if the third party's service adopted the same policy as Google? They should at least let you opt in to requests.
onemorepassword 14y ago
I have spam-filtered email addresses through 3 different email providers, one of them being Google. Only Google manages to constantly produce falls positives (including mail from, sweet irony, Google services like Analytics) and regularly allow spam and phishing mails through. The other two, ran by relatively small providers, are nearly perfect. Don't overestimate Google. (The same "intelligent" Google also seems to be unable to figure out which language I use, despite me telling them on a regular basis.)
- kbd 14y ago
  What other e-mail providers do you use, if you don't mind? A primary reason I use Google Apps mail is for the spam filtering.
  - claudius 14y ago
    Spam filtering by now is pretty trivial if you don’t mind being an ass about standards - require valid HELOs, valid hostnames, valid PTR records and valid A/AAAA records for these PTR records and hostnames listing the connecting IP and you will hardly get any spam. Add to this ‘temporary addresses’[0] and train your spam filter on everything send to invalid such addresses and basically nothing gets through. [0] I use a scheme where my website and mailing list addresses are of the form claudius_YYMM@example.com. Mails to these addresses are marked as spam after the 15th of MM+1 and before the 15th of MM-1. Obviously only works for mailing lists if they’re open to non-subscribers as well.
    - jrockway 14y ago
      I've found this to be untrue in my experience filtering spam. Being a hard ass drops a lot of legitimate email, and a lot of spammers follow the RFCs beautifully now.
      - claudius 14y ago
        Surely YMMV, but so I only observed two problems: Daily wikipedia articles when delivered via IPv6 (IPv4 worked) and StackExchange while on the west coast due to one of these nice hurricanes.
- eridius 14y ago
  How many spammy emails do you get at each address? You seem to be measuring the absolute rate of false negatives/positives, but not measuring the relative rate.
  - onemorepassword 14y ago
mdc 14y ago
The article mentions blocking invites, not messages themselves, so there's not really any content to use as a basis for spam filtering.
- claudius 14y ago
  A good starting point for that would be to allow invites from people you have already added to your contact list, i.e. X@example.com authorised Y@gmail.com to get status updates and Y added them to their contact list, but authorisation requests from X to Y still appear to be dropped.
  - naiquevin 14y ago
    This makes perfect sense to me. Chat is an important part of a service that my company provides to our users. We received great response after launching "gtalk integration" for chat until some new users started reporting problems due to this issue. We tried the other way around ie. having them send an invite to us but sadly that doesn't work as well. Hope google comes up with a better solution soon.
- jeza 14y ago
  You could allow invites, then use subsequent content to determine spam vs non-spam. Block content when its spam and notify the user, blacklist the JID where it came from and eventually domains where there is a high proportion of spam. Also allow users to report spammers. You could possibly even get clever and learn to recognise patterns in the JIDs and domains chosen by spammers, but this is bound to block legitimate content as well. You could perhaps increase the requirements for sending invites, such as having the recipients server send a CAPTCHA, although spammers seem to be able to get around CAPTCHAs anyway. Perhaps there would be some other solutions that I haven't thought of.
jholman 14y ago
I don't know what's going on, and I prefer to trust the FSF, but I notice that they are wilfully misrepresenting the statement by pergu@google on the operators@xmpp list, and so are you, cs702. Per said, a month ago, "is there anything you can do about it in that case, otherwise we will have to institute very tight limits of invites per day being sent from federated domains", speaking about specific domains, and speculating about a possible future strategy. FSF says (paraphrasing): "we have this symptom, we're convinced it's for this technical cause... " (so far so good) " ... "and this email thread says that Google is doing it on purpose". Bullshit, that thread says nothing of the kind. Stick to what you know.
- cs702 14y ago
  jholman: could you imagine Google doing the same thing for email? ("We will have to institute very tight limits of emails per day being sent from external domains.")
  - jholman 14y ago
    Please go back and read my comment again. My point is not that this is okay [0]. My point is that FSF is claiming "Google is doing this on purpose and this link says so", and YOU said "this link says so", and that's not what that links says. So stop making shit up. Stick to what you know, and/or to your opinions. FSF could have avoided my complaint by changing "According to this thread, Google is doing this on purpose" to "Based on this thread we're guessing Google may be doing this on purpose". You could have avoided my complaint by leaving your whole last sentence off. [0] Supposing that this IS what's happening, I'm not defending it (nor opposing it, I'm not forming an opinion). But as a side note, my understanding is that nearly all email providers DO do this thing for email; if a given domain is spamming hard enough, eventually email providers start dropping mail silently. Don't they?
    - magicalist 14y ago
      It also says that they were considering limiting invites per domain per day, which is quite a different thing than blocking all external invites, and it actually isn't all that different from what is done with email from domains that tend to send out a lot of spam. However, the problems with this solution are a) that it doesn't discriminate between domains with a lot of traffic and domains with a lot of spammy traffic (though, again, that's just speculation and maybe they do have that data), and b) there's no message to the user that is being ignored. I don't know if jabber supports rejection messages, but it would be much better if they could get a message that let them know why they were being turned down so they could pressure their chat server operator to reign in the spam accounts. It appears from the FSF post that they've actually tested invite requests, though, so presumably they are rejecting all invites, which makes the earlier email even less relevant as evidence of what is going on now. Surely the FSF has a contact at Google?
RivieraKid 14y ago
> How likely is it that the same company which builds bleeding-edge machine-learning systems to track and predict our behavior online, and which uses these AI predictions constantly to maximize their ad revenue, somehow cannot find a better way to filter out spam invites? Spam detection algorithms, even Google's, are rarely perfect. They probably came to conclusion that blocking foreign invites is a good tradeoff. We don't have enough information to evaluate if it was a good tradeoff. I think it was. I was recently getting lot of spammy chat invites (chat bots that tried to convince me to do an online payment for something), it was quite annoying.
eurleif 14y ago
So if it's not about spam, what is it about? Trying to get everyone to use Google Talk? Do enough people use other Jabber servers to have the tiniest effect on Google's business?
mst 14y ago
Honestly, it makes perfect sense to me - most of the spam I get through non-google instant messenger accounts is in the form of invite spam, and if they're seeing a massive spike of that then temporarily blocking them isn't entirely unreasonable. So long as it's temporary (and given you can request whitelisting in the meantime), I don't really see the problem.

by cs702 14y ago

cma 14y ago

Maybe Hinton didn't make any progress on it yesterday so they decided to call it quits? It does suck that they did this. I have been hit with many spam requests through Google Talk recently though. You should at least be able to whitelist people in your address book or something. Yeah, you can still send them an invite, but what if the third party's service adopted the same policy as Google? They should at least let you opt in to requests.

onemorepassword 14y ago

I have spam-filtered email addresses through 3 different email providers, one of them being Google. Only Google manages to constantly produce falls positives (including mail from, sweet irony, Google services like Analytics) and regularly allow spam and phishing mails through. The other two, ran by relatively small providers, are nearly perfect. Don't overestimate Google. (The same "intelligent" Google also seems to be unable to figure out which language I use, despite me telling them on a regular basis.)

kbd 14y ago
What other e-mail providers do you use, if you don't mind? A primary reason I use Google Apps mail is for the spam filtering.
- claudius 14y ago
  Spam filtering by now is pretty trivial if you don’t mind being an ass about standards - require valid HELOs, valid hostnames, valid PTR records and valid A/AAAA records for these PTR records and hostnames listing the connecting IP and you will hardly get any spam. Add to this ‘temporary addresses’[0] and train your spam filter on everything send to invalid such addresses and basically nothing gets through. [0] I use a scheme where my website and mailing list addresses are of the form claudius_YYMM@example.com. Mails to these addresses are marked as spam after the 15th of MM+1 and before the 15th of MM-1. Obviously only works for mailing lists if they’re open to non-subscribers as well.
  - jrockway 14y ago
    I've found this to be untrue in my experience filtering spam. Being a hard ass drops a lot of legitimate email, and a lot of spammers follow the RFCs beautifully now.
    - claudius 14y ago
      Surely YMMV, but so I only observed two problems: Daily wikipedia articles when delivered via IPv6 (IPv4 worked) and StackExchange while on the west coast due to one of these nice hurricanes.
eridius 14y ago
How many spammy emails do you get at each address? You seem to be measuring the absolute rate of false negatives/positives, but not measuring the relative rate.
- onemorepassword 14y ago

mdc 14y ago

The article mentions blocking invites, not messages themselves, so there's not really any content to use as a basis for spam filtering.

claudius 14y ago
A good starting point for that would be to allow invites from people you have already added to your contact list, i.e. X@example.com authorised Y@gmail.com to get status updates and Y added them to their contact list, but authorisation requests from X to Y still appear to be dropped.
- naiquevin 14y ago
  This makes perfect sense to me. Chat is an important part of a service that my company provides to our users. We received great response after launching "gtalk integration" for chat until some new users started reporting problems due to this issue. We tried the other way around ie. having them send an invite to us but sadly that doesn't work as well. Hope google comes up with a better solution soon.
jeza 14y ago
You could allow invites, then use subsequent content to determine spam vs non-spam. Block content when its spam and notify the user, blacklist the JID where it came from and eventually domains where there is a high proportion of spam. Also allow users to report spammers. You could possibly even get clever and learn to recognise patterns in the JIDs and domains chosen by spammers, but this is bound to block legitimate content as well. You could perhaps increase the requirements for sending invites, such as having the recipients server send a CAPTCHA, although spammers seem to be able to get around CAPTCHAs anyway. Perhaps there would be some other solutions that I haven't thought of.

jholman 14y ago

I don't know what's going on, and I prefer to trust the FSF, but I notice that they are wilfully misrepresenting the statement by pergu@google on the operators@xmpp list, and so are you, cs702. Per said, a month ago, "is there anything you can do about it in that case, otherwise we will have to institute very tight limits of invites per day being sent from federated domains", speaking about specific domains, and speculating about a possible future strategy. FSF says (paraphrasing): "we have this symptom, we're convinced it's for this technical cause... " (so far so good) " ... "and this email thread says that Google is doing it on purpose". Bullshit, that thread says nothing of the kind. Stick to what you know.

cs702 14y ago
jholman: could you imagine Google doing the same thing for email? ("We will have to institute very tight limits of emails per day being sent from external domains.")
- jholman 14y ago
  Please go back and read my comment again. My point is not that this is okay [0]. My point is that FSF is claiming "Google is doing this on purpose and this link says so", and YOU said "this link says so", and that's not what that links says. So stop making shit up. Stick to what you know, and/or to your opinions. FSF could have avoided my complaint by changing "According to this thread, Google is doing this on purpose" to "Based on this thread we're guessing Google may be doing this on purpose". You could have avoided my complaint by leaving your whole last sentence off. [0] Supposing that this IS what's happening, I'm not defending it (nor opposing it, I'm not forming an opinion). But as a side note, my understanding is that nearly all email providers DO do this thing for email; if a given domain is spamming hard enough, eventually email providers start dropping mail silently. Don't they?
  - magicalist 14y ago
    It also says that they were considering limiting invites per domain per day, which is quite a different thing than blocking all external invites, and it actually isn't all that different from what is done with email from domains that tend to send out a lot of spam. However, the problems with this solution are a) that it doesn't discriminate between domains with a lot of traffic and domains with a lot of spammy traffic (though, again, that's just speculation and maybe they do have that data), and b) there's no message to the user that is being ignored. I don't know if jabber supports rejection messages, but it would be much better if they could get a message that let them know why they were being turned down so they could pressure their chat server operator to reign in the spam accounts. It appears from the FSF post that they've actually tested invite requests, though, so presumably they are rejecting all invites, which makes the earlier email even less relevant as evidence of what is going on now. Surely the FSF has a contact at Google?

RivieraKid 14y ago

> How likely is it that the same company which builds bleeding-edge machine-learning systems to track and predict our behavior online, and which uses these AI predictions constantly to maximize their ad revenue, somehow cannot find a better way to filter out spam invites? Spam detection algorithms, even Google's, are rarely perfect. They probably came to conclusion that blocking foreign invites is a good tradeoff. We don't have enough information to evaluate if it was a good tradeoff. I think it was. I was recently getting lot of spammy chat invites (chat bots that tried to convince me to do an online payment for something), it was quite annoying.

eurleif 14y ago

So if it's not about spam, what is it about? Trying to get everyone to use Google Talk? Do enough people use other Jabber servers to have the tiniest effect on Google's business?

mst 14y ago

Honestly, it makes perfect sense to me - most of the spam I get through non-google instant messenger accounts is in the form of invite spam, and if they're seeing a massive spike of that then temporarily blocking them isn't entirely unreasonable. So long as it's temporary (and given you can request whitelisting in the meantime), I don't really see the problem.