Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The funny rules of SpamAssassin in 2023

updown.io

Post reply on HN
Print view View original

71–80 of 92 posts

Re: The funny rules of SpamAssassin in 2023

#71

Post by cbsmith »

rlpb wrote: post #20
srmarm wrote: post #9

I've been using SpamAssassin for at least 15 years and it's sadly gotten less useful as the spam arms race has moved on. We regularly see people on here post about deliverability issues with Gmail/Outlook but the truth is that sender reputation is by far the biggest indicator of whether a message will be spam - these type of rules are just counting deckchairs on the titanic in comparison. And this plays into the stre…

> It's a bonus to them that every time they block a smaller host there is a good chance that sender will consider a move to office365 or Google Workspace for their mail. The irony is that a substantial amount of the spam I receive comes from those platforms.

Because of course, its an arms race.

Re: The funny rules of SpamAssassin in 2023

#72

Post by cj »

8organicbits wrote: post #70
Mailtemi wrote: post #56

Earlier quoted context omitted.

I've got sometimes a legitimate Google or MS dev newsletter emails going into their own spam folders :) .

I've seen mail from my work Google Workspace that I sent to my own personal Gmail get flagged as spam. It's me sending to me. Google to Google. Logged into both account on the same computer. If anything I'm nervous to recommend Google because they flag too many legitimate emails as spam. After years of not checking, I'm checking spam again.

> mail from my work Google Workspace that I sent to my own personal Gmail

Does your company do outbound marketing/sales?

I've seen multiple companies spin up outbound email marketing campaigns where someone compiles a list of 5000 email addresses based on certain demographics, and then send automated emails (that look not automated) over the course of a month, rinse, repeat. Google Workspace will let you do this, but if you're too aggressive with email volume it can kill the reputation, and therefore deliverability of any email from that domain.

(Which is why most companies send outbound sales emails from a domain other than their primary domain to separate out the sending domain reputation)

Re: The funny rules of SpamAssassin in 2023

#73

Post by dalke »

nradov wrote: post #39
rlpb wrote: post #20

Earlier quoted context omitted.

> It's a bonus to them that every time they block a smaller host there is a good chance that sender will consider a move to office365 or Google Workspace for their mail. The irony is that a substantial amount of the spam I receive comes from those platforms.

Are you certain the spam is actually coming from IP addresses controlled by those platforms? It's common for spammers to fake the SMTP headers.

50% of my spam are from a single Google Groups source - unsolicited job applications, all ending:

  You received this message because you are subscribed to the Google Groups "jan-09" group.
  To unsubscribe from this group and stop receiving emails from it, send an
  email to jan-09+unsubscribe@googlegroups.com.
  
  To view this discussion on the web visit https://groups.google.com/d/msgid/jan-09/0
14101da368d$0bdc8160$23958420$@gmail.com.

I cannot email that unsubscribe link because it says I am not subscribed. I cannot visit that page, I have not subscribed to that group. I've had to set up a special filter to look for that footer.

I am not the only one with this issue. See https://support.google.com/groups/thread/68075070/i-get-goog... .

... Wait! You've indirectly helped solve the issue!

They are being sent to "info@" my domain, an alias that forwards to my real account. I set up a new outgoing account with that From address, sent from there, and managed to get Google to unsubscribe something I never agreed to in the first place.

It's been like this for a year, and with multiple attempts to fix it.

Thank you!

Re: The funny rules of SpamAssassin in 2023

#74

Post by bschne »

I couldn't help but think about mechanistic interpretability research on large neural models reading this — I guess this is what happens when humans do something similar, adding and removing tweaks here and there to better fit this or that case, over a long period of time.

Re: The funny rules of SpamAssassin in 2023

#75

Post by njharman »

londons_explore wrote: post #7

Having the rules public seems to take away most of the benefits... Any smart spammer will just tweak his spam to not hit these rules... And if he hasn't, it's because the vast majority of people don't use SpamAssassin

Spam is a minimal effort endeavor. A lead generator for scams. Only 0.1% or 0.01% response rate is good. They only want the unsophisticated, naive recipients. Expending effort to tweak rules is not worth the effort. (Although if they can get AI to do it, then that's back to near zero effort)

Re: The funny rules of SpamAssassin in 2023

#76

Post by brokensegue »

kjs3 wrote: post #37
brokensegue wrote: post #8

Earlier quoted context omitted.

On Gmail I get maybe 1 spam a month max in my inbox (and it blocks many per day)

So...statistically insignificant difference from SA for most mail users.

3-5 spams per week vs. 1 per month is a big difference

Re: The funny rules of SpamAssassin in 2023

#77

Post by iamacyborg »

nradov wrote: post #39
rlpb wrote: post #20

Earlier quoted context omitted.

> It's a bonus to them that every time they block a smaller host there is a good chance that sender will consider a move to office365 or Google Workspace for their mail. The irony is that a substantial amount of the spam I receive comes from those platforms.

Are you certain the spam is actually coming from IP addresses controlled by those platforms? It's common for spammers to fake the SMTP headers.

There is a significant amount of spam coming from google accounts, yes. Just think about all the “sales automation” junk that businesses uses.

Re: The funny rules of SpamAssassin in 2023

#78

Post by 8organicbits »

cj wrote: post #72
8organicbits wrote: post #70

Earlier quoted context omitted.

I've seen mail from my work Google Workspace that I sent to my own personal Gmail get flagged as spam. It's me sending to me. Google to Google. Logged into both account on the same computer. If anything I'm nervous to recommend Google because they flag too many legitimate emails as spam. After years of not checking, I'm checking spam again.

> mail from my work Google Workspace that I sent to my own personal Gmail Does your company do outbound marketing/sales? I've seen multiple companies spin up outbound email marketing campaigns where someone compiles a list of 5000 email addresses based on certain demographics, and then send automated emails (that look not automated) over the course of a month, rinse, repeat. Google Workspace will let you do this, but…

> Does your company do outbound marketing/sales?

Good guess, but we don't. I also checked DKIM/SPF when this happened and all appeared in order.

Re: The funny rules of SpamAssassin in 2023

#79

Post by kjs3 »

brokensegue wrote: post #76
kjs3 wrote: post #37

Earlier quoted context omitted.

So...statistically insignificant difference from SA for most mail users.

3-5 spams per week vs. 1 per month is a big difference

I got (if I'm reading this right) 5500 emails (junk+delivered) to my personal mail account from 12/01/2023 to 12/31/2023. So that's a minimum, since I don't see the ones that get flushed out before I even see them.

1 spam a month would be .018% of emails and 5 x 4 spams a month would be .364% of emails

So I would have gotten about .346% more spam based on the number of emails. In reality, because I don't see all of the mails, it's less. Is a touch more than a third of a percent a 'big difference'? YMMV.

Re: The funny rules of SpamAssassin in 2023

#80

Post by tempestn »

dalke wrote: post #73
nradov wrote: post #39

Earlier quoted context omitted.

Are you certain the spam is actually coming from IP addresses controlled by those platforms? It's common for spammers to fake the SMTP headers.

50% of my spam are from a single Google Groups source - unsolicited job applications, all ending: You received this message because you are subscribed to the Google Groups "jan-09" group. To unsubscribe from this group and stop receiving emails from it, send an email to jan-09+unsubscribe@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jan-09/0 14101da368d$0bdc8160$2395842…

This reminds me, it would be nice if Google had an easy way to blacklist a sender and/or subject such that it wouldn't even go to spam. I have enough spam false positives that I needed to scan my spam folder periodically, and I'd love to have a way to permanently filter out regular crap in there. I've created explicit filters for some of the more prevalent ones, but a one click blacklist button on spam emails would be great. (Along with some way to edit the blacklist in case of mistakes.)
Post reply on HN