Hacker News Reader

Comment by brianpgordon | Hacker News Reader

It would be nice if these big mail services accepted actual proof of work as a way to guarantee that your mail gets through. Maybe someone could extend SMTP with a bitcoin-like challenge where the server sends the client a nonce and a difficulty factor, and the client has to reply with a suffix that you can append to the nonce so that the whole string hashes to something with the corresponding number of zeroes at the end. People sending personal emails will be happy to burn a penny of CPU time as "postage" but spammers won't be able to send their spam profitably, especially if you increase the difficulty factor based on how many emails you've sent in the last hour.

View on HN

> People sending personal emails will be happy to burn a penny of CPU time as "postage" but spammers won't be able to send their spam profitably

The problem with this idea is that spammers don't use their own computer, they borrow other people's computers to send the spam. It also heavily penalizes people who legitimately need to send bulk email.

> It also heavily penalizes people who legitimately need to send bulk email.

Aka spammers.

Believe it or not there are email newsletters and mailing lists that people legitimately want to receive.

Such as the Linux kernel mailing list.

Yeah, but for bulk-mail one could introduce "whitelists".

(Note: deleted and moved here because I put it in reply to the wrong comment)

I work for an email marketing provider (opinions my own, obviously), and I was extremely surprised how many people genuinely want to receive lots of commercial bulk marketing email. And by "want to" I don't mean "don't mark as spam", I mean "continually sign up for different marketing newsletters, and consistently use links in newsletters/marketing emails to make purchases from multiple companies". It's an alien phenomenon to me, and it may be a minority of bulk email, but it definitely is useful to a lot of people. Maybe it's their equivalent of coupon-clipping-based shopping, or maybe they just like learning about things to buy in that format? I have no idea.

That aside, the last thing an email marketing platform wants to do is send spam. Every time someone marks an email such a provider sends as spam, the reputation of their sending addresses is damaged, and therefore their ability to deliver mail to aforementioned people who want to receive them (and therefore the ability of the marketing platform to make money by facilitating that kind of desired email) is jeopardized.

TL;dr there's bulk marketing email and then there's spam, and surprisingly little overlap (and overlapping incentives) between the people who send each.

Sure, I do this. A lot of stuff people buy is often a lot cheaper with promotions. Just the other day, I bought a $600 set of tires for $300-380 (depending on whether or not I remember to do the mail in rebate). That alone is well worth the few clicks it took to filter mails from that list out of my inbox and into a label for car-related marketing.

I have a couple of broad categories for these filters like car stuff, computer stuff, other-hobby-related-stuff and of course clothing, and just take a look at the appropriate one when I need or want something. Takes virtually no time, and saves a lot of money.

Of course I'm not gonna lie, I do end up buying things that I wouldn't have bought otherwise by doing this. But some of those things are pretty cool, too. :) I do have a few more cheap ARM boards of various types than I can probably use, though.

One of the big corner cases I've noticed is transaction-oriented email-- the password resets, "welcome to your account" emails, order details, shipping notifications. People want these, but they're probably harder to deliver than personal email or much spammier bulk mail sent directly via outsourced experts.

These have a lot of iffy issues.

* Since they're going to be generated by the ecommerce service, it may not be running on the same server or IP block as your main mail infrastructure, so you might have to specially configure around that.

* The content-- hundreds of messages a day, at seemingly scattershot recipients and highly templated-- screams spammy nto the wrong algorithm.

Yeah, there's services like Mandrill, but the whole ecosystem feels broken. It's not serving mailers. It's not serving the recipients very well. It seems designed to please a small, delicate, vocal audience. The people so upset at the prospect of false negatives (spam in the inbox) that they rally around providers who are prone to aggressive false positives. Who are these people and what makes them tick?

I could see this backlash in a situation where it's high risk or cost, but users can manage their own filters in any half-decent mail system, and frankly, clicking through a few pieces of spam a week is not a big deal-- arguably far less a hassle than spending an hour on the phone to get a tracking number that a spam filer ate.

https://en.wikipedia.org/wiki/Hashcash

> Hashcash was proposed in 1997 by Adam Back[1] and described more formally in Back's paper "Hashcash - A Denial of Service Counter-Measure".[2]

I guess the idea was too obvious to be original. I'm surprised that it inspired Bitcoin instead of the other way around though.

Proof of work proves not to work (2004)

http://www.cl.cam.ac.uk/~rnc1/proofwork.pdf

The paper's argument assumes that the PoW scheme is required though. It could be an option which just guarantees that individual mail can get through, while still keeping the usual reputation-based spam filtering for clients which don't want to participate.

If there's one lesson from the history of spamming, it's that spammers are among the fastest adopters of anti-spam technologies. If PoW meant that spammers could only send 1/100th the email, but the email was 1000× more likely to actually show up in an inbox, spammers would jump on it in a heartbeat.

That doesn't make sense. Each email is only worth so much to a spammer. They can't lose money on every email and make up for it with volume.

The value to spammers isn't in email delivered, it's the actual user engagement at the end of the process. A million messages delivered to the inbox is worth far more than a billion messages delivered to the spam folder.

Yeah, but if the marginal cost of the next message is higher than the marginal expected increase in revenue then they won’t. It doesn’t matter optimizing inbox delivery rates if per-delivery you lose money.

Keep increasing the PoW cost and think about where that line of argument leads you. "One message delivered to the inbox is worth far more than a billion messages delivered to the spam folder." One single delivered message is going to be profitable for the spammer? Clearly not. This proves the existence of some break-even point at a lower cost. Mail providers just need to set the cost above this point.

Given that spammers mostly use others' computers to blast their email out, I suspect that the price point that would truly throttle spam would be higher than the price legitimate users of email would be willing to pay. I'm not sufficiently knowledgeable in spam and black market economics to throw any actual numbers around.

A million messages delivered to the right inboxes are valuable.

The quantity-above-quality model in the spam industry probably lead to low-quality or vague list criteria. Broad demographic groups and domains. A lot of third party data of questionable legitimacy. If you've been running the list a long time, some "email address foo@bar.com clicked on campaigns A and B" data. You might be able to say on a large scale "List A is likely to convert better than B", but it still comes down to spray-and-pray at the individual address level.

If you went to a spammer with a few "sucker lists" of 100k emails each, and told him "you can only send 1k per day", will he have the data to triage his list to get a decent return on it anymore?

This would also snowball over time. Without being able to do high-volume campaigns initially, they'd have a harder time building up the knowledge they can use to manage their lists, and the quality would decline over time.

Also, they didn't consider that slow machines can still provide proof of work by relaying it to a fast machine (perhaps in exchange for real money).

It's an interesting idea, but wouldn't this be easy to abuse though, like Gmail could force Fastmail to do huge proofs of work before accepting their mail?

Reply on news.ycombinator.com