This is why so many people absolutely refuse to carry more than a thousand dollar's worth of cash on their person.
2,413 karma · joined July 3, 2015
I always assumed that, if spammers were intent on exploiting mailing lists, they would sign up for the list or crawl the archives to figure out who's on it.
Most of the spam I've seen moderating a web forum seems to be aimed at search engine indexes, and not at the forum users themselves. This is why the spammer would start out by copying questions from a different website*, then start silently injecting their spam links later, after the software stops sending the spammer through the mod queue every time they include a link. They don't even want the forum users to see the link; it's entirely for Googlebot's eyes.
Obviously, this is just as applicable to mailing lists as it is to forums, as long as the mailing list has a public archive. We can assume that if mailing lists aren't receiving as much abuse as forums are, it's because the spammers don't think the ML archive has enough page rank to justify it. A lot of them even use human beings in sweatshops to solve CAPTCHAs, if you're thinking that would help.
Forums have the ability to remove all the bogus posts after someone notices the spam links. But how would you remove them from the locally-stored archives that mailing-list users maintain? I brought up USENET cancel messages for a reason: purpose-built discussion board software has needed this ability since the early 2000's at least. You can't just wish the need away by deciding that some sense of free speech is more important, and it makes no sense to advocate for it if your anti-spam strategy is actually to just remain unpopular enough to not be a target.
* or "spinning" questions with a markov text generator, which is sometimes obviously machine-generated gibberish, but sometimes just looks like the kind of gibberish a newbie who is totally lost would post
If it was that simple, I would applaud the new era of surveillance. Unfortunately, some people will be above the law, while others will be subjected to it.
If privacy laws were actually repealed, and everyone saw what everyone else was doing, it might not be so bad. It’s the unfairness of it that really stinks.
I contend that this isn’t true.
First of all, if it was true, there would not be so many deliverability problems with email.
But, more importantly, there are solid, definitional reasons why spam filtering can never be particularly good. Is it spam if a bot copies questions from one mailing list to another one with a similar topic, in an attempt to build out a reputation? The copied “spam” emails have identical content to legitimate traffic, but there’s no human at the other end, and the seemingly-good user is eventually going to “cash in” on their reputation by posting actual spam. Similar tactics can attack Bayesian filters, and IP address-based systems are getting less useful over time as CG-NAT becomes more popular.
Personally, I think “spam filtering” as a heuristic that you tack onto an otherwise spam-vulnerable protocol has been about as good as it will ever get for the last decade [1].
Email and traditional web forums share most of the same problems, but web forums have two big advantages:
* Forums can reactively remove spam, as can USENET [2]. Mailing lists have to filter everything before fanning out. ML archives can be redacted, but anyone maintaining their own personal archive has to do any post-delivery filtering themselves.
* Forums have somewhat more operational flexibility. You won’t see Reddit/HN-style voting in mailing lists unless you customize your local tooling to support it. Normally, all a ML can do is decide whether to block it entirely or not.
This is a post on the Signal blog. They are obsessed with E2E encryption, and will never be talked down from it.
Also, I presented several problems with email, not just poor support for encryption.
> Email can be e2e encrypted easily if you want it.
E2E encryption should have forward secrecy. The way that’s usually implemented requires “handshake” messages to be exchanged before the payload is sent anywhere, which cannot be easily retrofitted onto PGP (adding it would be less “encrypted email” and more “an entirely different communication protocol, tunneled over SMTP”). The Axolotl ratchet that Signal uses requires the key for a communication channel to change over time, which is also pretty far away from what PGP and S/MIME currently do.
> The fact is that you generally don't, because you want to access your mail from any device and you want a server-side search
Signal and WhatsApp both exist and people use them, so they obviously aren’t deal-breakers.
> Also, proper e2ee requires identity verification of your contacts, where you check their key fingerprints using an uncompromised channel
It requires you to verify the identity of one, initial contact to bootstrap your social network. From then on, the “uncompromised channel” can be the previous E2E encrypted channel you already created.
In other words, it didn’t accomplish what any pro-Federation activist actually wants to accomplish.
And your disclosure was in response to a CSS-based fingerprinting demo. If being fingerprinted doesn’t even matter to you, and you use a text-only browser just because you prefer the UX, then why bring it up on this article in the first place?
Why bother, then?
I mean this in the relatively broad philosophical sense. There are few who seek pain, simply because it is pain, and there are few who implement complex tracking schemes simply to implement complex tracking schemes. They only go through this much work if there is some pleasure or profit to be gained from it.
If you start doing significantly-meaningful ad targeting, someone might notice the striking correlation. If you're a big enough organization for the practice to become dangerous, then even if nobody on the outside notices, someone might leak. What's the point in gathering the information if you can't use it for fear of someone figuring out what you did?
Nobody's going to very much trouble at all. They're just dumping every characteristic they can gather about you into an AI system, like a Bayesian classifier or a Convolution Neural Net. It doesn't require very much work to take into account clearly discrete data like the set of headers you submit, or the delay between switching pages, or parts of your IP address.
You hear a lot of stuff on HN about how inaccurate AI is, and much of it is true. But for figuring out when the set of HTTP headers correlates with your shopping habits, it should actually do a pretty good job, because it's basically just a matter of finding ways to correlate data together. No need to recognize when it's missing some form of outside context, because it doesn't "fail" or "succeed", it just does "worse" or "better." As long as it does better than a coin flip, it's worth it.
Right now, it's pretty effective to block ads by just not loading them, but there's no universal law that says it will always be that way. That already doesn't work on YouTube, which serves the ads from the same domain as the content, meaning that most ad blockers don't work on it. If ad blocking keeps becoming more popular, tactics like that will become more common. Once the ad serving becomes strictly first-party, relying on JavaScript looks like an increasingly terrible idea, not because of the minuscule number of people blocking JavaScript, but because you can't trust the potentially-malicious client to defend against click fraud.
This might not matter to you, since it sounds like privacy isn’t your primary motivation here, but it is worth pointing out that custom patched browsers are going to be more fingerprinted, not less.
It's a piece of cloth worn over your nose and mouth. How fragile is your sense of humanity?
> Besides it doesn’t matter what you think about masks. The fact that many people resent wearing them is reason enough to rethink forcing people to wear them.
I don't like wearing shoes, but that doesn't make shoe mandates (which are totally a thing, but only private businesses, not by government order) dehumanizing.
> We do live in society and not everybody considers Covid the only problem in existence.
Is that straw man dead yet?
> Especially post vaccine.
On this point, I actually agree. Would vaccine mandates be acceptable instead? It would be much more effective than mask mandates (which, while I have no real problem with them in principle, don't actually work that well because so many people don't wear them correctly).
I'm curious to hear you actually defend the "Find Setup Wizard." It seems to me like a flow so awful even people who mostly like customization would acknowledge its terrible design.
Node also isn’t actually a language, so there’s a lot of stuff that Node developers get in new version, but it’s actually being done in the V8 project.
When you're done riding that high horse, could you come up with a plan to actually make it stop? Preferably one that can't be dismissed as papering over the failure of the human race to govern itself like self-driving features, or dismissed as an authoritarian power-grab like putting fifty times as many traffic cops on the road, or dismissed as a dream like leveling LA and starting over from scratch with a bike-friendly layout.
Would you know if it did?
Unfortunately, web ads suck. Because there isn't enough Gatekeeping(tm), I can't buy things from web ads, because the probability of it being a scam is too high.