5 ms·

> the inability to control spam Actually, I think that could have been fixed. If the originating site signed a message, and the each relaying site signed it,

by wtbob 11y ago

> the inability to control spam Actually, I think that could have been fixed. If the originating site signed a message, and the each relaying site signed it, then one would be able to calculate a reputation score for sites. Spammy originating sites (or originating domains pretending to be relaying sites) would be easily identifiable, and thus blockable.

the8472 11y ago
That would require a central authority to verify signatures. Otherwise intermediate sites could just make up new identities once old ones became tarnished. And a central authority is not really all that decentralized, is it?
- wtbob 11y ago
  > That would require a central authority to verify signatures. Nope. Each site would be its own verifying authority. All I care about as a site is that the sites which feed me are responsible for what they send me; all each of them cares about is the same. If any one site gets bad enough, I'll start to reject their articles.
  - the8472 11y ago
    doesn't work for things like email, especially for people who get lots of previously-unknown senders.
    - wtbob 11y ago
      > doesn't work for things like email Which is why I was writing about Usenet☺ Controlling spam in general is a much tougher problem, but in the directed cyclic graph which is Usenet, it could have been done.
toyg 11y ago
Time to dust off http://craphound.com/spamsolutions.txt http://craphound.com/spamsolutions.txt "Here is why it won't work. (X) Requires immediate total cooperation from everybody at once (X) Anyone could anonymously destroy anyone else's career or business Specifically, your plan fails to account for (X) Lack of centrally controlling authority for email (X) Dishonesty on the part of spammers themselves and the following philosophical objections may also apply: (X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical (X) Blacklists suck (X) Countermeasures must work if phased in gradually (X) Why should we have to trust you and your servers? Furthermore, this is what I think about you: (X) Sorry dude, but I don't think it would work."
- tomjen3 11y ago
  Please don't dust that of. It did way more damage to the web than any spammer ever did. In addition to that you failed to understand what signatures do: there is no way you can have sign a message with anybody else signature. And it doesn't require immediate cooperation if a signed message with a good reputation is used as one of several spam signals. You want to discuss viagra? Well better sign your message with a public key and have a track record of not being a spammer. Blacklists are the de facto solution that we implemented because using that list prevented any consensus of any other method of combating spam.
  - toyg 11y ago
    How is "a list of bad signatures" different from existing blacklists? It isn't. Spammers can just generate new signatures faster than you can mark them as bad... same as IPs, really. And if I manage to get somebody else's private key (which happens so often these days, it's not even funny), I can ruin someone else's career while I push my spam. Unless, of course, you have a closed system everyone cooperates in; which is nothing like current email and cannot be rolled on gradually. Honestly now? That list hurts because it's true, and you know it. You cannot wipe out spam without losing the decentralization element built into current protocols. Your "solution" would just add yet another "signal" to the long list of hacks spammers routinely implement. (Not that I really care: I use gmail, trading my privacy for some of the best antispam systems money can buy, and I'm happy enough. I'm just a bit too old to still believe spam can be fixed, or that "webs of trust" can work at significant scale.)

by wtbob 11y ago

the8472 11y ago

That would require a central authority to verify signatures. Otherwise intermediate sites could just make up new identities once old ones became tarnished. And a central authority is not really all that decentralized, is it?

wtbob 11y ago
> That would require a central authority to verify signatures. Nope. Each site would be its own verifying authority. All I care about as a site is that the sites which feed me are responsible for what they send me; all each of them cares about is the same. If any one site gets bad enough, I'll start to reject their articles.
- the8472 11y ago
  doesn't work for things like email, especially for people who get lots of previously-unknown senders.
  - wtbob 11y ago
    > doesn't work for things like email Which is why I was writing about Usenet☺ Controlling spam in general is a much tougher problem, but in the directed cyclic graph which is Usenet, it could have been done.

toyg 11y ago

Time to dust off http://craphound.com/spamsolutions.txt http://craphound.com/spamsolutions.txt "Here is why it won't work. (X) Requires immediate total cooperation from everybody at once (X) Anyone could anonymously destroy anyone else's career or business Specifically, your plan fails to account for (X) Lack of centrally controlling authority for email (X) Dishonesty on the part of spammers themselves and the following philosophical objections may also apply: (X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical (X) Blacklists suck (X) Countermeasures must work if phased in gradually (X) Why should we have to trust you and your servers? Furthermore, this is what I think about you: (X) Sorry dude, but I don't think it would work."

tomjen3 11y ago
Please don't dust that of. It did way more damage to the web than any spammer ever did. In addition to that you failed to understand what signatures do: there is no way you can have sign a message with anybody else signature. And it doesn't require immediate cooperation if a signed message with a good reputation is used as one of several spam signals. You want to discuss viagra? Well better sign your message with a public key and have a track record of not being a spammer. Blacklists are the de facto solution that we implemented because using that list prevented any consensus of any other method of combating spam.
- toyg 11y ago
  How is "a list of bad signatures" different from existing blacklists? It isn't. Spammers can just generate new signatures faster than you can mark them as bad... same as IPs, really. And if I manage to get somebody else's private key (which happens so often these days, it's not even funny), I can ruin someone else's career while I push my spam. Unless, of course, you have a closed system everyone cooperates in; which is nothing like current email and cannot be rolled on gradually. Honestly now? That list hurts because it's true, and you know it. You cannot wipe out spam without losing the decentralization element built into current protocols. Your "solution" would just add yet another "signal" to the long list of hacks spammers routinely implement. (Not that I really care: I use gmail, trading my privacy for some of the best antispam systems money can buy, and I'm happy enough. I'm just a bit too old to still believe spam can be fixed, or that "webs of trust" can work at significant scale.)