Hacker News Reader

Comment by ttul | Hacker News Reader

Nobody in the email world considers ARC to be a bulletproof way to bypass spam filtering at a major receiver. The DEFCON presenter was ill-equipped to make that determination.

View on HN

> bulletproof way to bypass spam filtering

Yeah that's definitely not what I meant or what the presenter seems to be implying. If it helps spam scores even a little bit, that's very interesting and potentially worth implementing in private hosts that often get dinged by larger hosts just for not being well-known. It doesn't need to get anywhere near turning actual spam into non-spam.

I've worked in anti-spam since 2003. I am skeptical that his claims about ARC work at scale. Google does not have a rules-based spam filtering system. It is entirely driven by a massive machine learning model that adjusts its weights in response to user interaction. You can't beat that model.

> It is entirely driven by a massive machine learning model that adjusts its weights in response to user interaction. You can't beat that model.

Why not? Spammers do. I get spam to my gmail all the time.

Yep, I see phishing style spam (email from random domain that claims to be my bank) in my gmail in the past few weeks.

> You can't beat that model.

Sign up for a google apps account and send outbound cold sales spam via gmail. Seems to work exceedingly well judging by my inbox.

… I should have carved out a space for cold prospecting. I’m using GPT-3.5 to detect it in my own inbox because bulk spam filters don’t seem to have the requisite power to deal with such highly customized messages at scale.

They’ll be detecting based on spam received from the sending domain soon enough.

> I've worked in anti-spam since 2003.

By that you mean 2003 was the first year this vulnerability was reported to you, and every year since you've been auto-replying "nothing to see here" when people kept reporting this vulnerability to you?

Reply on news.ycombinator.com