Hacker News Reader

Comment by mmanfrin | Hacker News Reader

I think I might be a minority here, but I think this is an okay move. I use gchat exclusively with people within my workplace (also on gchat) and friends who also work at places with Google apps.

However, I've been getting a consistent barrage of requests from spam email accounts to chat; accounts with obscene names like 'sweety+69+for+free@freemail.ru' or something to the sort. The names/domains of each are different every time, so I can't simply block a domains.

I ask: if Google does not block outside requests, what could they do to stop this sort of thing?

View on HN

Great, do you want them to block incoming emails from any domain other than your own, as well?

Obviously not. But anti-spam measures are decades old at this point and well known.

The argument is a "the technology isn't there yet and spammers are running rampant, so the obvious solution is block it, which isn't ideal", not "Google is doing this because they want a monopoly on chat, and broke the protocol to do it".

Personally, I'm not (necessarily) suggesting that "Google is doing this because they want a monopoly on chat, and broke the protocol to do it". But it seems to me that as much experience as Google engineers have dealing with spam in the email world, they could come up with something feasible on XMPP as well.

Doing this strikes me as throwing the baby out with the bathwater.

> it seems to me that as much experience as Google engineers have dealing with spam in the email world, they could come up with something feasible on XMPP as well.

But before they start on this research project, they might want to do something about the spam their users are getting now, right?

By breaking something fundamental about how XMPP chat works? Personally, I vote "no".

I for one vote "yes". I was starting to receive lots of spam requests from within google talk. It was really annoying. Whatever they did it stopped and I'm glad for it.

Great, you lose one minor annoyance, and the rest of us deal with the fallout of a broken Internet. Sounds like a great tradeoff to me.

What is it with modern times, where people are willing to sacrifice fundamental things, like applications that adhere to standard protocols, to gain some minute level of relief from something that's just "annoying"?

That is the whole reason people use google, it's convenient.

They're not stopping anyone running a personal ejabberd server.

They are effectively stopping people from running personal ejabberd servers. What the hell is the point of running your own jabber server if your users can't talk to users on the largest jabber network on the planet?

As if they've only now suddenly realised that there are XMPP chat bots and that they might have an impact on user experience one day...

One of the first things that one thinks of when designing/projecting a large-scale system should be the potential for abuse. Are you trying to convince us that Google didn't take that into account when they chose XMPP as the underlying technology for GTalk?

Yes. They didn't choose XMPP federation as the underlying technology -- that came later. XMPP is a nice protocol, and XMPP federation is a broken disaster with no anti-spam features.

In the email world they have a lot more signals (content of messages, for example) to work with.

The obvious solution is almost always a non-engineered one. What do they want all their engineers for? Just corporate curriculum?

There's not much to go on with chat requests other than the senders address. At least emails have a body that's ripe for analysis.

Imagine spam filtering based only on the purported sender address. It'd probably suck.

The vast majority of spam is rejected before even the sender address is known.

No, but a spam box for chat requests might be interesting.

>I ask: if Google does not block outside requests, what could they do to stop this sort of thing?

Have a separate "spam gchat invite" folder that you could review periodically to look for false positives.

What's it based on? It's just invites.

Right now, it could be a list of all invitations that come from non-google domains. I assume they could do better than that over time, but my point is that "decline and log for review" is an option whenever "decline alone" is. On review, you could whitelist the false positives.

I have had 3 similar requests - ie obviously spam. Here's hoping a reasonable middle ground can be found.

I was getting the same on MSN, and I don't think that was federated.

MSN/Windows Live Messenger (and now Skype) do support federation with Lync Server, which is Microsoft's corporate instant messaging server.

Over the years, Microsoft has tried various attempts at making MSN/WLM interoperable with AIM, XMPP, and ICQ -- albeit with limited success.

Make this filtering optional or do in on the client.

Reply on news.ycombinator.com