News for hackers. Stuff that matters.
Re:Mailinator.com: Anatomy of a Spammy Campaign by mmt on Sunday July 15, 2018 @04:43PM (#17536970)
> Marketing for a service you have registered is not spam

From a legal standpoint, this is broadly true, but I'd say from a user's perspective, this is only very narrowly true.

For example, if I'm receiving an advertisement for a product that I "freely" trialed but subsequently rejected, I perceive it as spam.

Reputable companies provide an "unsubscribe" feature that actually works, but it's impossible to determine a priori which companies those are, and, more importantly, if they'll still be that way when that first e-mail arrives.

Really, the most trustworthy behavior would be to assume I'm consenting to precisely one follow-up email regarding my free trial, rather than an open-ended subscription. Until that's either industry standard or regulated (in a way where individuals can easily recover money damages), then I'm still using disposables at first contact.

> More and more companies deny registration from Disposable Email Addresses. Because these users are worthless.

Encountering a company like that, I assume they believe the second assertion to be true because the sole value of the users is as advertising eyeballs due to the product trial itself demonstrating no value. In that case, I don't bother.

I will, however, usually make at least a modest effort to try a few non-Mailinator disposables.

Although Mailinator has alternate domains, they've made themselves very easy to block, because a simple DNS query reveals the MX to be mail.mailinator.com. Just one more level of obfuscation (e.g. making the MX for streetwisemail.com be mail.streetwisemail.com and just have the same IP as mail.mailinator.com) strikes me as a good Pareto-principled step.

Re:Mailinator.com: Anatomy of a Spammy Campaign by wpietri on Sunday July 15, 2018 @06:16PM (#17537383)
> For example, if I'm receiving an advertisement for a product that I "freely" trialed but subsequently rejected, I perceive it as spam.

Agreed. I understand that marketing people perceive getting an email address once as permanent consent to basically anything. But I think this is pathological. People who behave like this in any other context are obviously abusive. That even includes some marketing contexts. If you try a free sample at Costco, nobody follows you around the store badgering you until you explicitly tell them to leave you alone.

Re:Mailinator.com: Anatomy of a Spammy Campaign by gknoy on Sunday July 15, 2018 @07:11PM (#17537619)
> ... an advertisement for a product that I "freely" trialed but subsequently rejected, I perceive it as spam.

I get lots of email about things I don't want -- vendor spam from AWS conferences, etc. I even call it "spam" when I talk about it. However, it feels _really disingenuous_ to also want it to be classified as spam. Sure, it's unwanted, but _I did sign up for it_. That's pretty much an implicit agreement when you go to a trade show. ("Let us spam you, and get a T-shirt!" "oo, that one has an awesome looking octopus [evident.io], okay!") In almost every case, their service isn't right for me. I'm happy to tell them that at the booth, and explain why I don't feel we need your Enterprise Scale Thingamabob.

When I get those emails three months later that I don't want, I don't feel comfortable marking as spam. I'd much prefer to unsubscribe.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mmt on Sunday July 15, 2018 @10:02PM (#17538257)
The trade show situation, however, is entirely different, however, because the whole thing is purely about marketing. There's no trial product whose real value could be substituted for that marketing.

That said, I'm having trouble with this seeming contradiction:

> Sure, it's unwanted, but _I did sign up for it_.

Maybe "want" is too strong a word, but you certainly knew you were willing to tolerate it when you did sign up for it.

Conversely, when I'm at a trade show, because I find those emails truly unwanted (and actually intolerable from vendors in whom I have no interest), if I've registered with a real e-mail address, I don't share it just for the octopus t-shirt.

Re:Mailinator.com: Anatomy of a Spammy Campaign by Fnoord on Monday July 16, 2018 @05:19AM (#17539815)
Some e-mail clients have plugins to make it very convenient to parse the unsubscribe link and do the rest of the dirty work when you click unsubscribe from within your client.

However the danger is that some of these are fake, and you might not remember what you signed up for. Then, the spammer knows that you clicked that link. They may learn to know your IP address, dox you further, etc. Or, worse, they can attempt to breach the security of your computer via your browser (0-day or otherwise).

A way to deal with this is using the + sign. Whenever you share your e-mail address knowingly, add the + sign with the address name sans (cc)TLD. Whenever someone e-mails you without the + sign they either harvested that address or they got it from you directly. So when you receive a spam e-mail you'd like to unsubscribe from not addressed to your + e-mail address, don't unsubscribe. You never signed up for it in the first place.

Re:Mailinator.com: Anatomy of a Spammy Campaign by fjsolwmv on Monday July 16, 2018 @12:55AM (#17538861)
Just mark it as spam. If they aren't spamming the internet at large, they won't get blocked at large, and your local bayesian filters will block them from you.
Re:Mailinator.com: Anatomy of a Spammy Campaign by mmt on Monday July 16, 2018 @04:02AM (#17539533)
I don't think that works that way with giant services like Gmail.

I routinely see marketing e-mail that I want to see erroneously auto-sent to Spam by Gmail. Since this has even happened for infrequent explicit-opt-in lists, I have to conclude there's no such thing as a "local" filter there.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mcbits on Monday July 16, 2018 @07:34AM (#17540441)
It seems Gmail does globally filter some campaigns if enough users (or enough of the right users) mark them as spam, but that doesn't mean they don't also have local account-level spam filters. A way to test it would be to mark Amazon or LinkedIn's spam as spam and see if Gmail starts automatically filtering it for that account. They definitely don't filter it globally.
Re:Mailinator.com: Anatomy of a Spammy Campaign by mmt on Monday July 16, 2018 @01:55PM (#17543382)
Even the success of such an experiment as you describe (which I believe I've previously run, unsucessfully, i.e. it took more than one mark-as-spam of a popular, otherwise-legit sender to get it reliably in my Spam folder) wouldn't convince me that there exist any such local, per-account or even per-domain (unless I'm paying for the Postini service) filters.

It would merely be evidence that there's a datum of "spam: From:LinkedIn To:mmt" going into the global filter database and that matching both From and To is sufficiently strong evidence to that global filter.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mcbits on Monday July 16, 2018 @02:48PM (#17543881)
Huh? "To:mmt" would be a local filter (or a localized signal in the filter - implementation detail). At least, hopefully nobody else is receiving email addressed to you.

If you start marking someone's emails as spam and their emails start automatically landing in your spambox but not everyone else's, then obviously they do have localized filtering. They almost certainly do because some people actually like to receive "newsletters" and junk mail to clip the coupons or whatever.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mmt on Monday July 16, 2018 @06:44PM (#17545816)
> "To:mmt" would be a local filter (or a localized signal in the filter - implementation detail)

You imply that this distinction doesn't matter, but I assert that it matters very much.

The difference is that a local filter can reasonably be expected to exclude any remote (to my domain, for example) "localized signal" when making a decision, whereas to a global filter, there's no such thing as "remote".

Looked at another way, imagine mmt.example.com with 10 users and mcbits.example.com with 800 users are both served by gmail (and we're the first two early adopters). Then imagine none of my users ever mark From:LinkedIn mail as spam (and maybe even mark it as ham in some way), whereas 25% of your users mark From:LinkedIn as spam and the rest merely ignore it (never marking it as ham, though perhaps reading it, mark-as-read-ing it and/or labeling/archiving it either manually or with a filter).

With two local filters, I would expect my users never to have to search their Spam folder for message from LinkedIn. With a global filter, I would expect the relatively small quantity of relatively weak data indicating From:LinkeIn is ham (which happens to be associated with "localized signal" of instances of "From:@mmt.example.com") to be overwhelmed by more numerous strong signals from your users that "From:LinkedIn" is spam and for my users to have to check the Spam folder for messages from LinkedIn at some point.

The latter is what I have observed actually happens.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mcbits on Monday July 16, 2018 @07:30PM (#17546069)
There's little doubt that they have global filtering informed by user flagging. The question is whether they also have localized filtering for items where users may disagree on what's spam. If so, I would expect email from LinkedIn to be far more likely to be automatically marked spam for those 25% of users who have previously marked those emails as spam. That seems to be what happens, at least from what I've heard. (Gmail is essentially my spambox already, so I don't bother to flag individual items.)

That doesn't preclude the global filters from also occasionally binning some of LinkedIn's email when the global spam score is so high that the local ham score fails to override it. And the same thing could happen whether they implement it as a hierarchy of filters or just one filter with localized signals.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mmt on Monday July 16, 2018 @10:23PM (#17546833)
I'm still failing to understand the distinction you're trying to make with a local filter, if it exists only in addition to, and is generally overridden by the global filter.

> I would expect email from LinkedIn to be far more likely to be automatically marked spam for those 25% of users who have previously marked those emails as spam.

This is true regardless of whether or not the filter is global or local, though. That 25% provides the majority behavior for both a local filter and a global filter.

> That doesn't preclude the global filters from also occasionally binning some of LinkedIn's email when the global spam score is so high that the local ham score fails to override it.

It does preclude it, because with a truly local filter, those people are a majority (unanimous, even). Even occasional miscategorization as spam would be completely unexpected. It's only when the filter is global do they end up subject to tyranny-of-the-majority behavior.

Re:Mailinator.com: Anatomy of a Spammy Campaign by mmirate on Saturday July 28, 2018 @09:53AM (#17633166)
> From a legal standpoint, this is broadly true, but I'd say from a user's perspective, this is only very narrowly true.

Oh, please. Of the two, the former is the only one that really matters here.