> Yes, good spammers make sure their DMARC, DKIM and SPF are correct.
Many do, but not all. One of the hats I wear at work is mail server administrator, and it's astonishing the number of spam and phish attempts using our company domains that I see from all over the world, all of which bounce off due to SPF.
I've noticed too in recent years that some phishing spammers seek out established domains with liberal SPF (either no SPF or ~all) and use those for their phishing attempts. Some of the most common I've seen, ones that stuck in my mind, were secure.net, yale.edu, and servermail.com.
A point I have to reiterate to colleagues over and over is that SPF and DKIM are a form of identity management for domains. They're designed for phishing prevention, not general spam prevention. If you register a domain for any purpose, the first thing you should do, in my opinion, is stick a "v=spf1 -all" in DNS for it. Otherwise, phishing spammers may ruin its reputation before you get a chance to use it.
> For a number of reasons, I feel that the only way we got here was via some kind of infinite improbability drive.
Oh very much so! In my mind, it seems that someone must have figured out what the universe was for, and now it's been replaced with something even more bizarre and inexplicable.
Can you imagine a knowledge worker from the 1950s, say a clerk or a marketer, being magically transported into our time and dropped into a meeting like a morning standup, where people talk about how they spent their time stopping the artificial intelligence from talking about goblins so much? Hell, even when I was an IT student back in the 90s, people from my parents' generation struggled to grasp what it was that I was doing. Now, the disconnect is so vast that the mind reels.
> I’m always a bit shocked how seriously people take concerns over the install script for a binary executable they’re already intending to trust.
The issue is provenance. Where is the script getting the binary from? Who built that binary? How do we know that binary wasn't tampered with? I'll lay odds the install script isn't doing any kind of GPG/PGP signature check. It's probably not even doing a checksum check.
I'm prepared to trust an executable built by certain organisations and persons, provided I can trace a chain of trust from what I get back to them.
Screenshots of text! Luxury! In my day, the screenshots were embedded in a Word document too.
But I can't be the only one appalled at the suggestion to use an LLM to parse the text. The sheer, prodigious waste of computing power, just to round-trip text to an image and back to text, when what's really missing is a computer user interface that makes it as simple to send text or other snippets as it is to send screenshots.