Re: [ANNOUNCE] contrib/hashcash.el spam fighter

["Patrick J. LoPresti" <patl@curl.com>]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:

> * "Patrick J. LoPresti" <patl@curl.com>  on Fri, 28 Jun 2002
> | Right, so you have to try them all.  Checking the validity of a coin
> | is "fast", so this is OK, in theory.
> 
> Not even in theory.  It is a linear problem, and linear problems do not
> scale.

Sure, it is linear in the number of recipients times the number of
addresses you have.  But this product for a typical message is not
increasing over time, so there is no scalability problem.

> [...]
> 
> | Then again, it is not disastrous if you miss a message.
> 
> And if that lost message is the job offer I am expecting?

Do you usually have job offers BCC'd to you?  :-)

You are correct that you cannot combine BCC's with X-Hashcash without
risking the privacy of the BCC.  (All someone else has to do is guess
that you were a recipient, then check the X-Hashcash header to confirm
it.)  So BCC'd messages would have to go into your "has no X-Hashcash
header" folder for later perusal.  You will need such a folder anyway
as long as you have correspondents who are not using X-Hashcash.

> -Anything- that causes loss of legitimate mail is BAD.  Really bad.
> Unacceptably bad, in my opinion and that of the 350 employees in my
> company who expect mail not to be lost.

Tagging mail as potential spam, then perusing it later, is not
"losing" it.  In fact it is precisely how many (perhaps most) existing
spam-filtering implementations work.

> That is 1.8 million hashes per hour.
> 
> All those hashes being dumped into your spent coin database.  And five
> thousand Sub7 variant infections is a very conservative number.

You do not record invalid coins as "spent", because you can always
recognize them as being invalid.  Only valid coins need to be
remembered, and creating even a single valid coin is computationally
expensive.  How expensive is up to the recipient to choose.

> Do you begin to see the vulnerabilities in X-Hashcash?

I have yet to see you present any.  Yes, it does not combine well with
BCC.  But so far, that is the only correct argument you have made...

 - Pat