How is "a list of bad signatures" different from existing blacklists? It isn't. Spammers can just generate new signatures faster than you can mark them as bad... same as IPs, really. And if I manage to get somebody else's private key (which happens so often these days, it's not even funny), I can ruin someone else's career while I push my spam.

Unless, of course, you have a closed system everyone cooperates in; which is nothing like current email and cannot be rolled on gradually.

Honestly now? That list hurts because it's true, and you know it. You cannot wipe out spam without losing the decentralization element built into current protocols. Your "solution" would just add yet another "signal" to the long list of hacks spammers routinely implement.

(Not that I really care: I use gmail, trading my privacy for some of the best antispam systems money can buy, and I'm happy enough. I'm just a bit too old to still believe spam can be fixed, or that "webs of trust" can work at significant scale.)

> Unless, of course, you have a closed system everyone cooperates in; which is nothing like current email and cannot be rolled on gradually.

I was writing about NNTP, not SMTP—they are different.

> You cannot wipe out spam without losing the decentralization element built into current protocols.

NNTP was never decentralised like SMTP is. Each NNTP site had a very limited number of feeds, set up on a social basis. There was no concept that anyone could submit articles anywhere; rather, users submitted articles to their local site, which forwarded them on. In this environment, cutting bad feeds out would have worked (or at least, kept spam to a manageable level, which is all anyone really cares about).

Just so that we're all on the same page I assume by signatures we mean PGP type signing? This would not be spoofible at all (unless a key was lost).

Which is why GP said: "And if I manage to get somebody else's private key (which happens so often these days, it's not even funny), I can ruin someone else's career while I push my spam."

Also, the biggest problem with PGP-type signing as a mechanism to control spam is not whether you can spoof the signature or not, it's that there's nothing in it that stops the spammer from generating a new identity once the current identity is tarnished.

With NNTP, you pretty much have to login to a system in order to post... this means, you are trackable, and if the origin server is doing the signing, this can be traced... It's generally very easy to trace a message through it's server chain.