Impermium

» see impermium.com as it lived, on the wayback machine

~ the eulogy ~

Impermium was founded in 2010 by three people who had spent years keeping spam out of Yahoo Mail, which is one of the few jobs on the internet that teaches you the adversary's schedule. What they sold was not a spam filter for email. It was an API that a website called at the moments that matter, when an account was created and when something was posted. You sent it the signals, it sent back a judgment on whether the account was a person, and you decided what to do with that.

It worked well enough that by the time it was sold the company was covering more than 1.5 million sites. The customer list is the part that dates it perfectly: Disqus, Livefyre, Pinterest, Squarespace, Tumblr. If you left a comment anywhere in 2012 or 2013, something Impermium wrote had probably made a decision about you first. Accel and Greylock were among the investors.

On 15 January 2014 Google announced it had bought the company. The team and the technology went into Google's own abuse-fighting group, and Impermium told its customers on the way out that it was discontinuing service to third-party websites and winding down existing contracts. The site itself was replaced with a note from the chief executive about joining the best abuse fighters in the world.

~ the dossier ~

~ the dependency ~

Every service that used Impermium had made the same reasonable trade: spam and fake signups are a specialist problem with a permanent adversary, so rent the specialist. The trade is correct right up until the specialist gets bought, at which point you have a wind-down notice and no model.

I have worked inside this exact shape, which is common enough to be unremarkable as an engineer: a third-party service you do not own doing something load-bearing in a system you do own, and a company announcement arriving one morning to explain that it is your problem now. The uncomfortable part is not the outage. It is that nobody on the inside actually knows how the decisions were being made, because the whole value of the vendor was that you never had to learn.

~ what google was buying ~

Google did not need Impermium's customers and it did not need the revenue. It needed people who could reason about abuse at a scale where the attackers are automated and funded, and it needed them inside, not selling the same capability to everybody else. Tech Monitor had to go and confirm afterward that this was a full acquisition rather than a hire of the staff with the code thrown away, which tells you how little separated the two possibilities in practice.

What went off with the service was a shared defense. For three years a spam pattern that hit Tumblr got spotted and then blocked for Squarespace and Disqus by the same vendor. After January 2014 each of those sites was back to seeing only its own traffic, or paying somebody else for the view.

~ the page that is still up ~

impermium.com resolves in 2026. What it serves is a Google page, with Google's stylesheet and Google's analytics tag, titled "Impermium" and nothing more. Twelve years after the acquisition, the domain of a dead spam-fighting startup is still being paid for and served by the company that ended it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »