> Also, it might be easier to control this sort of thing in a silo like > Signal than in a federated network like XMPP.
It's definitely easier for them, since they don't have to federate with badly setup servers that leave doors wide open, and their own users need to verify a phone number before they can connect. > When I log in and receive dozens of spam messages, that's a degraded user experience No argument from me here: I think XMPP spam is a problem that needed solving yesterday. Remko, what do you suggest? > I was sort of hoping that you would come up with a magic trick after getting through your reading list. I don't see an easy solution. Looking at my account, my guess is badly setup servers are the biggest problem today. Servers probably need to tighten their registration (e.g. no IBR, harder proof of validity), server vendors might take steps to discourage bad setups (e.g. make it hard to enable IBR), but you'll always have to deal with the case of badly setup servers (and eventually malicious servers) on a federated network, so you'll need to have S2S checks. I was also thinking of a reputation-based system for S2S (with a blacklist as an extreme), assuming that the reputation can propagate fast enough to handle a spam attack (I don't know the dynamics of spam sent through XMPP). You'll probably also need some smart content-based spam-detection systems contributing to the reputation. I haven't checked, but my gut feeling tells me that starting with basing reputation purely on whether IBR is enabled or not (which every server can detect for itself) would probably prevent most of the spam I get today. (my personal XMPP domain blacklist is available on request for anyone wanting to write a script to invalidate or validate this claim ;-)) In the end, though, you'll end up with a likelihood score of a message being spam, so I still think it'll be up to the client to make the call whether and how to display it. Remko
_______________________________________________ Standards mailing list Info: https://mail.jabber.org/mailman/listinfo/standards Unsubscribe: [email protected] _______________________________________________
