Hacker News Reader

Comment by pmlnr | Hacker News Reader

> Email only is simply not reliable enough.

That is because implementations, especially gmail, ignore the specifications: (EDIT) there are specific error codes and messages should be sent back to the originator. The reasons to ignore it is, in theory, not to give spammers ideas how to avoid it.

Email is incredibly reliable, it can tolerate outages, configuration errors, delays, etc, by specification, but ever since "modern" spam filtering, gmail (and those who follow their practices) it became a nightmare, because everyone ignores how it _should_ work. It was done in a time when connections were slow and prone to errors; it had to be flexible.

Yes, I know spam was bad I was there. But I'd rather have spam, than actually important mails getting dropped because of false positive, paranoid spamfilters.

View on HN

When there’s too much spam, your important mails are effectively dropped as they’re buried in the noise. Modern spam filtering is what saved email. Without it, you’d never see those important messages, because new spam would come in faster than you could delete it.

I don't have any content-based spam filtering (but I do use the spamhaus sbl-xbl list).

It doesn't take very long to manually delete spam from the inbox. And if your spam filter is putting legitimate emails in your spam folder, you need to manually filter them anyway.

At the peak of my spam experience, I was getting hundreds a day. That was ages ago when the internet was much slower and more expensive than it is today, and bad people online were much less sophisticated. I wouldn’t be surprised if a totally open email system today generated enough spam that even deleting one message per second you’d fall behind.

I haven’t checked my spam folder on a routine basis in many years.

What I'm saying is that "modern spam filtering" (by which I assume we mean GMail-style highly-aggressive spam filtering that puts lots of legitimate email in the spam folder) is not what saved email. Rudimentary spam filtering saved email. There's no need to ever have a legitimate email go to the spam folder.

Spam filtering is an arms race. Spammers know how to download all the existing spam filtering software and tweak their emails to make sure it gets past it.

My experience matches jstanley's: with basic ISP filtering and disabling as much filtering as they let me disable my ISP reports blocking 181 messages in the past month mostly via some list (they don't say which one). I see a few spam messages per day and generally get half a dozen or more copies the first time I see a new one, conveniently making them easy to delete (and very few have confusing subjects). I'm fairly sure I see less than half as many as the ISP blocks. This is with an address that has been public for over a decade. It doesn't seem like much of an arms race to me and it is a trivial effort to delete them.

The only things I can think of that I do differently than many people that might make a difference is that I have my mail client set up to not show remote images ever and I never dirctly click any link from email no matter the source. Possibly things might be much worse otherwise, but from my perspective it doesn't seem like spam is a huge issue these days with basic filtering.

You're still benefitting from everybody else's more sophisticated spam filtering. The fact that most users have good filtering means that the cost/benefit ratio of sending spam is much worse than it otherwise would be. This naturally decreases the activity significantly. Saying that you get by with just basic blocking is the e-mail equivalent of saying that you don't need a measles vaccine. It may be true but it doesn't tell us much about what the world would look like without those measures.

Where is the evidence that this is true? It doesn't seem that likely to me that so few people are not using gmail-style spam filtering that spammers couldn't figure out how to target those of us who aren't (the filtering that I could have used but turned off is more random than helpful and I would guess this is the case on many non-Google mail providers). Even with Google running a huge portion of all email there are still a huge number of people with email not provided by Google.

An alternative narrative is that previously email servers were supposed to accept almost anything from everyone and spammers took advantage of this. From this perspective it is the relatively recent requirement of sender verification that made the key difference and allows Spamhaus to work (obviously they need to do something to determine who to block). This perspective seems to match what I am seeing.

Rudimentary spam filtering saved email long ago when spams were focused on a few niches like pharmaceutical or Nigerian scam.

It wouldn't be efficient today with spam being more more diverse and often hardly distinguishable from legitimate emails. A lot of spam nowadays is like forced advertising, by opposition to plain scam and dodgy stuff.

The definition of spam changed. Originally, it was scattershot bulk email, where the sender would just send to any address they had ever acquired for any reason.

Now spam means "anything the user doesn't want to receive". Even if the user previously deliberately created a relationship with the sender. Gmail successfully trained users into clicking the spam button for anything such. People just click Gmail's magic make-it-go-away button for things as legitimate as a mailing list they deliberately signed up for and are simply too lazy to properly unsubscribe.

Legitimacy isn't a binary either-or, it's a continuum. You bought from a merchant ten years ago and they email you again, is that spam? How about the company that acquired that merchant which is now trying to sell you a completely different line of business? You donated to a politician and now their successor in the same party emails you, is that spam? That's what modern spam filtering deals with.

'Now spam means "anything the user doesn't want to receive".'

Spam means anything from someone who is indifferent to whether the recipient wants to receive it and doesn't get "sufficient" permission. I think this is consistent with the original type of spam, even if there is no bright line delineating it.

If you're implying that anything with a working unsubscribe link shouldn't be considered spam, then I think this definitional issue relates to the same controversies about what constitutes consent that have been discussed a lot recently.

I mean, I agree with your last paragraph, so far as that goes, but I would suggest rather than the definition of spam changing, ordinary businesses got spammier/sleazier.

> It doesn't take very long to manually delete spam from the inbox.

I have tuned the spam filters for a fairly major email provider for a while and while you are right for a lot of people, there's a significant fraction of them that receives hundreds or even thousands of spam emails per day. For them, it is not practical - and everyone needs to be able to use it.

I have subscribed to more email lists these days than ever before. Why? Because trust in the system has increased. I know that I can easily subscribe/unsubscribe and that decision will be respected (or punished if ignored).

So while gmail has made life harder for people who want to email me, it have made life much easier for me as an email user - which makes me more willing to give out my email.

You’ve just explained why it’s become unreliable. It might have been great once, but fixing it when it’s broken is a complete nightmare now.

Reply on news.ycombinator.com