It wasn’t a conscious decision: I just reflected the e-mail out to
usenet as it stood. It struck me that as this was a public mailing list,
with no subscription qualifications, then any e-mail address used was
effectively public too.
I’m open to discussion on this
In theory, I like the idea of sending out the email as is, unfortunately,
in the modern world, having your email be easy to get is simply a recipe
for getting spammed, or “wormed”.
Even though I don’t run Windows at all, this newest worm has wasted hours
of my precious time. Half was spent tweaking SpamAssassin filters, the
other half was spend dealing with the mail that snuck through.
Having said that, I’m in a much better position than some, because I run my
own server, have a mailing-list-specific email address, and know enough to
tweak my filters.
Even though the mailing list is public, it’s a lot less visible than a
newsgroup, and so it doesn’t end up on a spam list as easily. I think it
would make sense to obfuscate the email address on messages copied from the
mailing list to the newsgroup, and then “deobfuscate” it on the way back.
It could be as simple as transforming this: user@domain.com to user@domain.example.com.
Even if most people on the list run good spam filtering software, there’s
still the bandwidth and CPU cost of having that spam get through the whole
filtering process.
It wasn’t a conscious decision: I just reflected the e-mail out to
usenet as it stood. It struck me that as this was a public mailing
list, with no subscription qualifications, then any e-mail address used
was effectively public too.
I’m open to discussion on this
It wouldn’t take much effort to change the email address, would it?
email.sub(/@/, " (at) ")
And nobody would complain that their address was being modified.
Well, I wasn’t sure - it’s sometimes inconvenient dealing with hacked
e-mail addresses - it means that anyone wanting to send e-mail to a
poster has to retype.
Might it not be easier to set up a filter so that you only accept mail
to a particular alias if it comes from ruby-talk?
Cheers
Dave
···
On Monday, Sep 22, 2003, at 12:28 Europe/Copenhagen, Gavin Sinclair wrote:
It wasn’t a conscious decision: I just reflected the e-mail out to
usenet as it stood. It struck me that as this was a public mailing
list, with no subscription qualifications, then any e-mail address
used
was effectively public too.
I’m open to discussion on this
It wouldn’t take much effort to change the email address, would it?
email.sub(/@/, " (at) ")
And nobody would complain that their address was being modified.
But then I would compalin that my address was being modified. Spammers
can spot something as simple as this and flip it back to an @.
All addresses are visible on the archives at ruby-talk.org anyhow,
freely available for harvesting.
···
Gavin Sinclair (gsinclair@soyabean.com.au) wrote:
It wasn’t a conscious decision: I just reflected the e-mail out to
usenet as it stood. It struck me that as this was a public mailing
list, with no subscription qualifications, then any e-mail address used
was effectively public too.
I’m open to discussion on this
It wouldn’t take much effort to change the email address, would it?
email.sub(/@/, " (at) ")
And nobody would complain that their address was being modified.
It wasn’t a conscious decision: I just reflected the e-mail out to
usenet as it stood. It struck me that as this was a public mailing list,
with no subscription qualifications, then any e-mail address used was
effectively public too.
I’m open to discussion on this
In theory, I like the idea of sending out the email as is, unfortunately,
in the modern world, having your email be easy to get is simply a recipe
for getting spammed, or “wormed”.
[snip]
Even though the mailing list is public, it’s a lot less visible than a
newsgroup, and so it doesn’t end up on a spam list as easily.
_ I don’t think this is true, they both have searchable
archives. Every message I post on USENET has a unique, but
workable email address and the only thing that shows up on those
addresses is virus email. Goggle and the web is where the spam
harvesters are going now. Usenet is not as visible as you might
think. I don’t much care either way, but if you use an email
address that can be looked up somehow, you will get spam to that
address. Certainly Usenet was a spam source early in the game,
but now it’s much simpler to use the web and publically available
directories to get email addresses.
_ The virus email is not coming from USENET, but from the mail
archives that people have on their hard drives. The only thing
that will stop that is entirely munging the address so that you
can only communicate via the email list.
Then wouldn’t that defeat the purpose of being able to reply to
someone? In one case you have to retype the address, in the other
case, you simply can’t reach them because of the filter.
Let me explain why I think having obfuscated email address is
essential. When I joined the Ruby mailing list I did it from a work
account, but I didn’t know that the address would be mirrored exactly
as-is to newsgroups. When I found out it was too late, I was already
getting tons of spam. Unfortunately, the email server at work is a MS
exchange server and so there’s no way I can get it to be more spamproof.
Once I realized that my email was being sent out as-is, I switched to
my home account on a custom address. Then, last Thursday, both that
account and my work account started getting flooded with spam. After a
little work I was able to tweak the filters on my home account to avoid
it all, but my work account is still being flooded and there’s nothing
I can do about it, aside from exercise my delete key.
My personal opinion is that any time an email address is shown in an
easy to harvest way (either via newsgroups or via a web page) it should
automatically be obfuscated. It doesn’t have to be anything fancy,
just enough that not every single spambot will spot it.
Ben
···
On Monday, September 22, 2003, at 12:35 PM, Dave Thomas wrote:
It wouldn’t take much effort to change the email address, would it?
email.sub(/@/, " (at) ")
And nobody would complain that their address was being modified.
Well, I wasn’t sure - it’s sometimes inconvenient dealing with hacked
e-mail addresses - it means that anyone wanting to send e-mail to a
poster has to retype.
Might it not be easier to set up a filter so that you only accept mail
to a particular alias if it comes from ruby-talk?
I agree with both of you. I get a ton of spam as it is, but I can easily
filter it out. I’d much rather not have to go through and replace lots
of “spam-guard” symbols from some guy’s email address in order to send
him a reply. Besides, whenever I use an actual newsreader I post with my
proper email address. And it’s been out there for at least three years now.
···
On 9/22/2003 8:20 AM, Emmanuel Touzery wrote:
Unless they’re one of the people who has weird opinions like “hitting
reply in the newsreader should do the right thing”.
plus now it’s so spread, i doubt it bothers spam-harvesters. i’m quite
sure they don’t have any problems finding the AT patterns as well.
–
Dean saor, dean saor an spiorad. Is seinn d’orain beo.
Here’s my view. If it’s possible to give people the ability to have
their e-mail addresses obfuscated, I would recommend making that a
non-default option. I think spam, viruses and worms are a menace and
those responsible for them should be dealt with harshly. I also think
the appropriate place to systematically deal with them is not at the
mailing-list/newsgroup level. I like using e-mail to communicate and
don’t want my own e-mail address obfuscated. I have a pretty good junk
filter that is capable of learning about new junk and I take great
satisfaction in looking at my junk folder before I delete every junk
e-mail without reading them. But I do think people should be given a
choice on the matter.
So? Its also being presented as-is in the archives at ruby-talk.org.
Here’s a link to your message, as you can see, your email address is
presented on the third line from the top.
On Monday, September 22, 2003, at 12:35 PM, Dave Thomas wrote:
It wouldn’t take much effort to change the email address, would it?
email.sub(/@/, " (at) ")
And nobody would complain that their address was being modified.
Well, I wasn’t sure - it’s sometimes inconvenient dealing with hacked
e-mail addresses - it means that anyone wanting to send e-mail to a
poster has to retype.
Might it not be easier to set up a filter so that you only accept mail
to a particular alias if it comes from ruby-talk?
Let me explain why I think having obfuscated email address is
essential. When I joined the Ruby mailing list I did it from a work
account, but I didn’t know that the address would be mirrored exactly
as-is to newsgroups.
So? Its also being presented as-is in the archives at ruby-talk.org.
Here’s a link to your message, as you can see, your email address is
presented on the third line from the top.
Spam spiders can find the email just as easily as a newsgroup-reading
bot could.
I think the email address should be obfuscated there too. Many newsgroups
with public archives obfuscate or remove entirely the original author’s
email address.
But I also think that the web site for an obscure language is harder to
spot than a newsgroup. Afterall, if you receive a newsgroup feed, all you
need to do is grep the data for an email-like pattern. To get email
addresses off a web site you have to actually go out there and spider the
web. Not difficult, but not as easy.
So? Its also being presented as-is in the archives at ruby-talk.org.
Here’s a link to your message, as you can see, your email address is
presented on the third line from the top.
Spam spiders can find the email just as easily as a newsgroup-reading
bot could.
I think the email address should be obfuscated there too. Many newsgroups
with public archives obfuscate or remove entirely the original author’s
email address.
Am I missnig something? If the sender wants their address obscured,
can’t they just tweak their from address?