[fauigerzigerk]

My guess is that the ratio of false positives is extremely small and hence this may be a very low hanging fruit when it comes to spam filtering.

Having an honest reason to belong to a minority that is on average very dishonest is one of the worst things that can happen to you.

This is a real dilemma, not just with spam filtering.

[loup-vaillant]

Shame on the big providers to force this dilemma on us.

I bet that's not the whole story. There was a reason they were lazy in the first place, but I bet there's another reason why they stay lazy. Punishing decentralization is a great way to get more users, after all: sent from gmail? works. Sent from little provider? Doesn't work.

The only way out of this I see right now is the generalization of the Freedom Box. Though even then, one would need to run protests to be able to send email from home. Between ISP wide firewalls, interdictions on home servers (by contract with some ISP), or the blacklisting of all residential IPs (Hotmail), it will take a lot of collective action before we can send mail from home again.

[fauigerzigerk]

>Punishing decentralization is a great way to get more users

I very much doubt that Google sees decentralization as a major threat to Gmail at this point.

[loup-vaillant]

It wouldn't take much for it to be. We basically need 3 things: a usable Freedom Box (some commercial implementation of this idea are starting to pop up), the authorization to send email, and then end of "little provider" blacklisting. The last one is basically under Google's and Microsoft's control. If they put an end to it, we now have only 2 hurdles to overcome, and both are already partly solved.

Since Snowden, people know they are being spied on. The only reason so many of them still use Gmail is because they don't know how not to. Give them a little box that's as usable as Gmail, and they will use it.

While I agree decentralization is hardly a threat to Gmail right now, it could be, and I don't see them taking any step to make it even more threatening.

[chrismartin]

The pattern -- and volume -- of messages that Gmail would receive from an independent server with legitimate users would look very different than someone running a similar server to send spam.

Perhaps a spammer with a new server could gain Gmail's trust by passing genuine-looking correspondence, but this would stop working as soon as they start to send bulk messages.

Seems to me that tuning Gmail's filters to recognize and trust small-volume email servers would not be difficult or time-consuming.

[fauigerzigerk]

That could well be. It's hard to know without access to the data, but they could probably do better if they tried.

However, I fear if Google were to try harder, spammers would also jump on that opportunity. It's easier to mimic the patterns of a small legit SMTP server than to pose as one of a few big well established email providers with known IP ranges. They could potentially use millions of compromised PCs, each sending spam in low volumes mixed with non-spam traffic.