Hacker News Reader

>I'm sorry but that's just very naive.

It would be fair(er) to explain why.

The issue is that domains are cheap and plentiful, and a spammer can easily claim to be sending mailflow on behalf of let's say, 1000 users, each sending 5-10 emails a day, and thus, a single IP "forwarding" (sending) mailflow "on behalf" of 10k domains, with 1k users each, with each user sending just 10 emails a day - would result in a pretty nice batch of spam making it through.

As things currently stand, the only "expensive" resource that is hard to acquire or fake somehow is source IPs with good reputation. Fair? I'm not saying it is. It's just effective.

The cost of a domain looks conveniently close to the cost of keeping track of some entity's reputation to me.

A domain is relatively cheap. Accepting some 20 messages before you are sure it's spammy is also cheap. You will have to filter out the malicious domain registers, but that's a quite immutable set, as becoming a register is a bureaucratic process with a non-trivial cost.

The statement is just really quite absolute. The most trivial example would be an IP address being used by an abuser behind bulletproof hosting. Someone trying to deliver 200 000 spam letters in a minute and you rejecting each one is a significant amount of load - best case it still reduces your logs' SNR.

Reply on news.ycombinator.com