Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Spamnesty: Waste spammers' time

stavros.io

Post reply on HN
Print view View original

181–188 of 188 posts

Re: Show HN: Spamnesty: Waste spammers' time

#181

Post by criddell »

Spooky23 wrote: post #174
criddell wrote: post #147

Earlier quoted context omitted.

I don't buy that argument. What liability would they have when I choose to do something? They could get around it the same way Toyota limits their liability from me using the touch screen while I drive - pop up a message saying when and how the feature should be used.

The difference is that fiddling with a screen is a traffic ticket and potential accident where you are at fault for being inattentive. For call recording, the phone maker is potentially facilitating a felony. It's really complex. Does the phone stop recording when you cross state lines? Does it allow covert recording? If I'm from California recording a call in DC on vacation and accidentally enter Maryland and get ar…

The phone thing is complex too. Where I live (suburb of Austin), it's legal to use your phone but about five miles down the road it's illegal.

Likewise, if you are in California, you can't send a text while driving, but you can enter an address into the GPS app (probably).

All Apple and Google would have to do is warn you that recording calls may be illegal.

Radio Shack sold phone recorders in every state and AFAIK, nobody ever sued them.

I have Google Voice and Google lets me record calls on that. I'm not sure what the big difference is for when the call is over Android.

Edit: There have been cell phones that had call recorders built in, just none that run Android or iOS (AFAIK). I know a lot of Motorola phones included the functionality.

Re: Show HN: Spamnesty: Waste spammers' time

#182

Post by blisterpeanuts »

estefan wrote: post #54

Someone posted about Lenny [1] the other day. I've had fun listening to him on youtube waste telemarketers' time. [1] https://www.youtube.com/playlist?list=PLduL71_GKzHHk4hLga0nO...

Lenny is great. My 11-year-old and I play the Lenny game sometimes -- one of us is telemarketer, the other plays Lenny. Lenny is a brilliant piece of software. I just worry that eventually most call centers will be onto Lenny. Already some telemarketers recognize him. Luckily, as AI and voice recognition improve, more such systems will come online for the amusement of youtube audiences and to thwart telemarketers and scammers.

Re: Show HN: Spamnesty: Waste spammers' time

#183

Post by inimino »

chriswarbo wrote: post #127
inimino wrote: post #97

Earlier quoted context omitted.

Instead of hashcash why haven't we solved the problem by just attaching real money to every email? The convention would be that you "accept" the payment only if it is spam. $1 gets you into the inbox. If it isn't spam then after 48 hours the token just expires and the sender keeps their dollar. I assume the money transfer can be solved today using Bitcoin, and it wouldn't be a terribly complicated protocol.

> $1 gets you into the inbox. This is exactly the same problem faced by hashcash, just wrapped up in more layers of complication. If emails require a $1 attachment to get into your inbox, you will receive no emails, since nobody is currently sending any emails with $1 attached. Just rewrite my above comment, but replace "hashcash" with "dollars". > I assume the money transfer can be solved today using Bitcoin, and it…

Hashcash is pure waste, this at least benefits the one whose attention is wasted by the spam.

> You do realise that Bitcoin itself is a complicated protocol built on top of hashcash, right?

Of course, but it already exists.

> If emails require a $1 attachment to get into your inbox, you will receive no emails, since nobody is currently sending any emails with $1 attached.

Yes, but assume there are people sending bulk email legitimately who have delivery issues. All you need is one major provider to accept it and then there is a benefit for senders. DKIM and SPF prove that the deployment problem can be overcome, even for relatively weak attacks on the spam problem.

Re: Show HN: Spamnesty: Waste spammers' time

#184

Post by tuananh »

gamerDude wrote: post #133

Have you thought of adding in a check in if they haven't responded after a week? Perhaps, "Hi there, I thought we were really making progress, but I haven't heard from you for a week. Is there still a chance I could get in on this great opportunity?"

and that's how we become spammers.

Re: Show HN: Spamnesty: Waste spammers' time

#185

Post by Pyxl101 »

CodeMage wrote: post #131

I'm just waiting for someone to hook this sort of stuff to some kind of machine learning system, to learn and adapt and come up with new replies. And some 100 years hence we'll be explaining to kids that the singularity arose out of people's annoyance with spammers ;)

Not repeating the same messages too much would be a good first start.

Re: Show HN: Spamnesty: Waste spammers' time

#186

Post by mikeash »

fiatjaf wrote: post #163
mikeash wrote: post #135

Earlier quoted context omitted.

I've done a crappy implementation for my blog to fight spammy comments. It works OK, probably more because it's a totally custom thing that isn't worth time for spammers to fight, rather than because it's actually effective. The way I did it is: - When the user focuses in a comment field, the page makes a request to the server asking for initial parameters. - The server returns the number of leading zeroes required,…

Is that code public and in Python/Go/Javascript?

My web site is a hacked-together thing that's been gradually accumulating since the late 90s, so it's kind of ugly. The hashcash code is not very modular, either.

If you'd like to see it anyway, I pulled out the relevant parts here:

https://gist.github.com/mikeash/daf02b6cc3017560f930515c3c17...

The comment-inline.js file is directly embedded in the HTML for the comments area, and is the glue code between the actual UI and the hashcash computation code. The hashcash.js file is where all the client-side work happens, and it handles the actual hashing, making multiple attempts, checking to see if an attempt produced a good result, and such. Then commentsubmit.py handles the server side by returning hashcash parameters when requested, and checking the provided hashcash for validity when submitting.

I have a brief blog post about it here, which you can also use to see the system in action:

https://www.mikeash.com/pyblog/testing-hashcash-based-anti-s...

If you have any questions, comments, or criticisms, please feel free to get in touch.

Re: Show HN: Spamnesty: Waste spammers' time

#187

Post by StavrosK »

contras1970 wrote: post #179
StavrosK wrote: post #169

Earlier quoted context omitted.

It turns out that some DNS servers cached the old nameservers and are now failing to resolve those. It's unfortunate, but all we can do is wait for the cache to expire :(

Did you forget step 4 from https://cr.yp.to/djbdns/run-server.html#move-zone ?

No, it looks like Namecheap stops serving the old records when you change nameservers.

Re: Show HN: Spamnesty: Waste spammers' time

#188

Post by chriswarbo »

mikeash wrote: post #82
chriswarbo wrote: post #63

Earlier quoted context omitted.

The problem with hashcash for email is that there's no way for the sender and receiver to negotiate the amount of work to be proved, so they must correctly guess how much to perform/require. The most sensible requirement to guess is zero, since all existing email is sent without any proof of work, and the value of interoperability is higher than blocking spam. After all, if you're willing to lose interoperability, yo…

Could the work requirement be advertised as part of the destination's MX record or something? I know that in theory you're supposed to be able to send the message to your upstream server and let it worry about how to deliver, but in practice it seems like these days you can count on being able to look up the target's DNS info. Another problem is finding a quantity of work which is high enough to stop spam, but low en…

> Could the work requirement be advertised as part of the destination's MX record or something?

The frustrating part is that only the good guys would follow such a scheme. As long as there's a fallback available, no matter how deprecated, spammers will use it to avoid such payment schemes.

I suppose it could be used as a strong signal for spam filters, in addition to other security/authentication schemes which have been adopted.

> Another problem is finding a quantity of work which is high enough to stop spam, but low enough not to stop legitimate traffic.

Yes, this is another problem which negotiation could alleviate. These days there would also be the option of offloading the actual email sending to a service (either run on your own server, or "in the cloud"). Of course this just shifts the problem, but at least such services can provide arbitrary APIs, and hence can restrict their hashcash power to authenticated users, or require users to provide proof of work in a way which can be negotiated down, e.g. by building up a reputation over time.

Not sure how botsnets can be tackled, but raising the amount of effort even a small amount would hopefully make a lot of spam-based scams unprofitable. I'm sure the problem would just shift then, e.g. to using the botnets for more DDoS attacks or other more lucrative schemes.

Post reply on HN