Slashdot Mirror
Volunteering for OSS == Sign Up for Spam?
bckspc asks: "I've been getting pounded by spam lately, so did a Google search on my email address to see where it might appear on the Web. To my horror, it turned up several times in an archive of a Gnome listserv for a project I briefly participated in. While the email address is visibly obscured on the Web pages, it is quite intact in the HTML code. I emailed the list admin about obscuring or removing my email address, but was curtly dismissed. I'm a relative newbie and the experience soured me on participating in other OSS projects. How to Slashdot users deal with this? Must I set up disposable email accounts for every list?"
When I searched for my name, it was more the questions i'd answered geekily on some debian list about 4 or 5 years ago that concerned me. theres loads of them! :-)
And the debian lists are very well linked to its been hard for me to pursuade google to give higher priority to my own website, where I can make out I'm not a geek
SURELY NOT!!!!!
Try using simply foss@domain for lists, and them filter ad filter and filter it. I do agree this is very annoying, and although some listservs do respect this and change the email addresses on list servers, this can't be relied apon. I can't choose my participation based on which projects are going to give my email away.
The only solution that will effectively work (until we fix the spam problem all round) is for list admins to be more careful about munging email addresses to some degree.
The default setting for programs such as pipermail should be one where email addresses are not explicitly displayed.
The best solution I've found to solve problems with email addresses online is Jodrell's mailto php script which renders the address obfuscated but displays it correctly in the browser using JavaScript.
http://jodrell.net/projects/mailto
Set up an account to only receive mails from the lists you joined. Junk everything else.
The Awful Truth
Whenever I need to put my email address somewhere public (i.e. mailing lists and websites) I make up a new email address of the form mailinglistname@myaccountname.freeserve.co.uk or websitename@myaccountname.freeserve.co.uk e.g. the email address I gave slashdot is slashdot.org@myaccountname.freeserve.co.uk
The good part: when I start getting spam to a particular address I just setup a filter that sends all mail to that address to /dev/null
It also lets you know where your email address was harvested from. So when I get spam turning up on slashdot.org@myaccountname.freeserve.co.uk I know it was slashdot who sold my email address to the evil spammers ;-)
If I want to receive mail from slashdot again I just change my email on slashdot to slashdot.org2@myaccountname.freeserve.co.uk
Interestingly most of the spam I get comes in to the email address ebay.co.uk@myaccountname.freeserve.co.uk
This has worked very well for me for several years.
GMail. :-)
I find it difficult to believe that the spam that you are receiving is as a result of your email address being on a list associated with an oss project.
My email address is openly available on numerious mailing lists and publications, and I also administer a small sports club website in which my personal email address has been visiable for years. During that time I have constantly used the same email address. But to date I only receive about one or two spam mails per week. It may be that my experience is unusual, but I highly doubt that your experience with spam can be attributed to your email address being published through the open source project that you were involved in.
Worse than that, my name and email also appear on one OSS project's discussion board, in full and with really akeward comments from 1997 or so... Kind of embarassing to read them now, especially with potential clients googling anybody's identities 8-)
I don't otherwise sign up my primary email address to any lists of sorts, and I use fake names when signing up for non-essential things; I also use disposable webmail addresses and vanity domains for that purpose. I only clean-up web accounts accounts prior to expecting some sort of comfirmation email, after which the account goes back to the abandoned, spammed-to-death status for another while.
Hi,
:-)
Nearly all of the SPAM email to am email address that I kept hidden for this reason come from a one line change I submitted to JRefactor for context menus on the mac. But still at least I got some credit for it!
OSS or not, you should. There is no link between OSS and spam, but there is between mailing lists and spam.
There is not (yet) a way to make sure obfuscated e-mail addresses don't get caught by robots, so as a good habit I'd suggest you use disposable E-mail addresses every time your mail will be available on the web.
use a spamgourmet.com address for anything that may ever become public. It's free, and after a specicified number of emails it blocks the address. You just sign up, and everytime you give out an email, you make up on the spot a keyword.numberofemails.username@spamgourmet.com email address, and spam gourmet automatically blocks after that number, you can then allow trusted domains through forever if you want.
Spam has gone crazy for me in the last few days. I've gone from 600+ every day, a figure I've been approaching gradually over the last couple of years, to well over 1,000 per day this week.
I've also noticed that I get blocks of maybe a dozen of the same three or four spams, and while the 40+ Kb ones are still arriving they've been joined by dozens of 100+ Kb ones.
I use Mailwasher and frankly it's a joke nowadays. Easily 50% of my legitimate mails are flagged as spam because of blacklisting, and 100+ spams per day are listed as legitimate. So I still need to check through every single mail apart from the ones that I have manually flagged by filters.
Does anyone know why there might have been such a dramatic increase in spam this last week?
And can anyone recommend a better anti-spam solution? I'm using Eudora on Windows so some of the more advanced (and presumably more reliable) solutions are either unsuitable or unavailable.
I run a web site commercially and after putting it off for months I'm getting to the point that my only realistic option is to start using web-based customer support. I dislike web-based support but the risk of erroneously deleting legitimate customer e-mails is simply too high now.
I'm on quite a few mailing lists, and I get almost no spam. In fact, I get such a small amount of spam that I use the thunderbird filter to get rid of non-spam e-mails that I just don't want. The miniscule amount of spam that I do get is filtered 99% perfectly.
I don't know what everyone else is doing that is bringing them so much spam. If you play your cards right and use a filter it really isn't a problem anymore.
The GeekNights podcast is going strong. Listen!
Yes.
Doesn't matter what the list admin does to the web archives created, it won't stop other people creating web archives.
Many people on the gentoo lists have complained about getting bararged by spam and viruses soon after signing up and posting, yet Gentoo don't create any web archive!
If you use your email address for *anything*, you'll eventually get on a spammer's list.
Send only to friends and family? Whoops -- your cousin Jane just sent you an e-card for your b-day. Guess what? The e-card company now has your address on a list (which will eventually be sold, resold, etc...).
Mom just sent you (and everyone else in her addressbook, and whatever addresses were on it to begin with) a copy of a chain letter! Guess what? One of those email addresses went to someone who's making a list!
Uncle Jim just got infected with the latest/greatest worm! Guess what? In addition to getting spammed "from" his address, you've most likely ended up on yet another list!
Posted to a public mailing list? Yep - you're on a list. Doesn't matter if it was Harvester 1.0 or the new and improved Harvester 3.5.2b, you're on the list.
See, no matter what you do, no matter how closely you guard that email address - if you actually intend it to be used, it's eventually going to get on a spammer's list. And once you're on one list, you mightaswell be on them all (as spammers sell their lists to each other, or collect & trade, etc...)
Munging the address in a public archive does really only one thing: Prevent legitimate contact. Remember: If a human can decypher the email address, so can a harvester. Simple string replacement is easily coded around. "Coding" your email address only works until the harvesters have translation tables. Munging them severely makes it incredibly hard for an actual human to use your address. In short, you're spiting the forest for the trees.
Looking at my personal mail stats, I get roughly 90% spam on any given day. Most of it's not even in english (and although I can understand a bit of spoken Japanese, I certainly can't read it, let alone the vast ammount of Korean spam I receive). Sure, it sucks. But what can I do?
Well, for starters I filter on the server-side. SpamAssassin is the first line of defense. After training up the bayesian side of things, it catches roughly 90% of the spam I receive.
Second stage is a set of basic "sanity test" filters. Is it from someone I actually know (and is therefore whitelisted)? Is it actually "To" or "Cc" to a legitimate email address of mine? Attachments of known bad types? Headers added by known bulk-mailers? What does ClamAV have to say about it? (Yes, I started building this filter before I discovered SpamAssassin, so there's a bit of overlap) This weeds out around 50% of the remaining spam I get (5% of the total).
Third stage is Mozilla Thunderbird's bayesian filter, which once trained does a suprisingly good job of catching things that make it through the first two stages. I get about 1 or 2 a week that pass through all three stages - these get fed to both bayesian filters to be learned. The system isn't perfect, but it seems to work OK, until something better comes along. And anyone who needs to contact me can.
The other thing I do now (which I'd have done earlier, had I the resources) is give each company I do business with it's own address. While this doesn't cut the spam, it does allow me to track who's been selling my address, and who hasn't. Yahoo and Ebay (both previously mentioned in other threads) have been the main culprits thusfar, although there are a few smaller companies I've caught as having sold their email lists as well.
So, should we munge all email addresses beyond recognition in order to "stop" spam? I'd have to say no - as it prevents legitimate users from emailing you. Should we be extremely careful *who* we give our email addresses to, and *what* address we give out to them? Absolutely. Should we complain, *loudly* to companies whom we can catch selling our addresses to spammers, or worse, spamming us themselves. Absolutely.
Just my $.02.
1. change email accounts very regularly
2. keep the same email account and filter spam
#1 is a pain as you have to keep updating contacts to your new email address. (spammers seem to have no trouble finding it)
#2 also involves ongoing effort. Every new thing I do to stop spammers seems to be great for the first few weeks (no spam gets through), then one, then one or two. It still filters out 99% though.
Remember though, for every spammer you shoot, there are 5 more ready to step up to take their place!
Google and friends show my address in many maillist and FIDO archives for last four or five years. There's 200+ mail users in our domain. I receive more spam and viruses than anyone else.
There's no reason to hide my email anymore. I receive lots of spam anyway. Simple procmail rules stop 90% of it:
I use nkvir-rc under procmail to filter them, which leaves only a few dozen bounce messages per day from sites that got viruses with my return address on them. I have amended nkvir-rc to work properly with Maildir-style mailboxes. (Probably the next released version will have these improvements.)
I use one obviously false handle to refer to myself with folks who don't already know me (or in an online context with those who do). If I ever decide to claim something, I can provide proof (witnesses, records on my machine, passwords to log into accounts under that handle) that I am that person; otherwise, I retain my anonymity.
It's not perfect; you could still trace it to me, or steal the handle if you were so inclined. But a google for that handle won't link it to me - I've checked for that.
It goes without saying the same thing happens with list archives, where one might participate in OSS-related discussion. However, as per my journal entry, submitting a bug report gives similar results. So now, I don't submit bugs where I don't have control over my email address.
Move your domain or account to a real provider who does:
- virus-checking (I don't have to wade through almost 600 viruses per month just by using clamav on the server)
- RBL'ing of all the open proxies, open relays and dynamic IP-address-space (~5000 "hits" per month for me - potential spam that never even enters my server)
- and filter the rest of mail via Spamassassin
This way, I get only 5-10 spams per day or so and most of it is pre-filtered into my Spam-folder on the server.
The rest is collected by mozilla, mostly and moved into the "spam-train"-folder, where sa-learn will take it from time to time.
That doesn't do anything about the bounces, but it improves the situation very, very much.
Since I've done that, email is (almost) just like it used to be in 1995.
Rainer
Windows 2000 - from the guys who brought us edlin
I've been using SpamAssasin that my mail ISP(ASP) provides me with - and it seemed to be working really well. I trust it so much that anything now goes to /dev/null - however - it all seems to have broken down with what appears to be a new improved spam attack: Over the last week or two I've been getting 50+ mails a day that appear as "Mail returned" messages where they are obvisouly bouncing mail back to me - often using random_username@mydomain.com as the fake from address which then hits my postmaster@mydomain.com and is forwarded to me.
This is a major PITA, as whilst I now filter these too it makes it more difficult to see when _my_ real legitimate mail didn't make it somewhere because of a problem.
How long can the spam filters hold all this back !
I sign up to mailing lists using listname@mydomain.com, then use TMDA to:
- Rewrite the From: address to the one the list knows about, eg: gentoo@jamesholden.net
- Generate a time-limited address for the Reply-To: header, which only works for a week.
This means that I never post to the list from the wrong address, and people on the list can reply to me without being issued a challenge/response mail.Actual list traffic is sorted into a folder based on the List-ID: header.
Like tinyurl, but one letter less! http://qurl.co.uk/
Until this year, I was lucky enough to have never received an email based worm. I have participated in an OSS project, and my email address is in the code and on a mailing list.
Starting this year I started receiving emails to my OSS address, and variations on that address (as anything@me.domain will be delivered to me).
I turned on virus protection at my email provider. That left me with 100 bogus bounced emails a day, mostly to unused email addresses.
I set up rules to reject email sent to common-names@me.domain. That eliminated most of the viruses and bounces.
I also received my first spam to my oss email address. I suspect it is from a spammer recieving worm email with my oss address (which my be in other people's legitimate address books).
Lastly, my machines run Linux, so they didn't execute the worm.
Where law ends, tyranny begins -- William Pitt
Must I set up disposable email accounts for every list?"
Actually, what I do is have a single disposable email account for all lists, and change it regularly. I suspect that some spammers (probably those who troll WHOIS records) are getting wise to that and starting to email to random@domain.tld (where random is someone's name).
I've never had any problems with sourceforge.net. They listserv modification successfully obscures my e-mail on the list archives.
But, please, don't blame OSS.
I used to try being as anonymous as possible, because, like the poster, I did not want to face the wrath of the spam monster. However, when my work address, which was on published aliases, started getting hunted in earnest by the spam monster, I was finally forced to look into Baysian filters (I chose spamprobe, but there are plenty of other good ones as well). The pleasant surprise was that they work extremely well. So well, in fact, that I've really just stopped worrying about how many spammers get my email address. It's not that the monster is gone, but it is trapped in soundproof box in another room that I never go into. Silly monster.
Slashdot example: I used to have a visible mail account posted here at /.
I quickly turned that off, though to this day 10% of my spam is to that account, so I've placed it in the /dev/null filter. I've not used it in 4 or more years.
The sad thing is that I did initially get some on-topic private emails...no more.
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
which obviously beckons ... you have your own website and you expect it to show that you're not a geek?
Thunderbird eats spam.
I use TMDA (Tagged Message Delivery Agent http://tmda.net ) which lets me generate addresses which only accept mail either for a limited time or from certain domains/addresses. It'll auto maintain a whitelist, and you can have a blacklist. If mail comes in to an address which has 'expired' or which is from the 'wrong' sender, you can decide whether to drop the email, or send a 'challenge', which if the sender replies to, you receive the email. :-) is when someone is 'joe-jobbed' and they receive challenges in addition to all the bounces and the 'hey ass, why'd you spam me' emails. Hopefully people will really start to implement 'SPF' http://spf.pobox.com/ soon.
The only problem with C/R mechanisms like this (besides the ~3x bandwidth
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
I used to be a subscriber to the Sue Spammers mailing list, for folks interested in taking legal action against spammers. I unsubscribed after a month or so, when I found the list archives were public, with exposed e-mail addresses, including my own. Red flag, bull, etc.
WTF?
-Waldo Jaquith
Go to Sneakemail and sign up. It makes life so much easier.
you can use all the disposable addresses you want at dodgeit. Just fill in #3 for me if you get a chance :-)
1. create disposable email service
2. give it away for free
3. ???
4. profit!
slashsearch.org - slashdot search. powered by google.
Alas, the 1st step is to allocate temporary email addresses for everything you participate in outside of your own domain.
The 2nd step should be public evisceration of anyone who sells an email address, or sends email to a purchased email address -- preferably after having been administered enough stimulants that they are unable to lose consciousness until they lose life.
And, yes, that is my tempered, reasoned response. You should see my knee-jerk response....
RHCE; are you certified? Karma: ambiguous.
> which obviously beckons ... you have your own website and you expect it to show that you're not a geek?
and I've got about 5 domain names I don't need......and?!
SURELY NOT!!!!!
One more reason why running your own mailserver is the way to go. Sendmail, for instance, easily supports virtual user tables (virtusertable) - aliases, basically. Use a rule like:
:-(
USERNAME+%2@yourdomain.com USERNAME
Which will deliver all mail in the form of bob+amazon@hisdomain.com to bob@hisdomain.com. Use a different name on each site, but you don't need to create aliases for each user. When you start getting spam to that address, just add a line *before* the one above of
USERNAME+SOMESITE@yourdomain.com error:nouser User has been removed because of SPAM
I only wish I had started doing this before my primary addresses had been harvested
This is entirely by accident, but I've talked to others who have done the same thing, and they've reported similar results.
About 2 years ago, my wife and I set up our own mail server in-house. While we set up the normal "service@domain" addresses for various things, I also had her create a "spam@ourdomain" address for me - something I could use as a generic address for one-time registration pages, that sort of thing. I've been using my "spam@" address pretty regularly since it's been created. More so as time wore on, when something became pretty apparent:
I was getting almost no spam directed to that address.
Now, I've used that address in a number of places, including on Usenet. I get (perhaps) one or two prices of spam per month. The only thing I can figure is that spammers, or folks putting together mailing lists for spammers, have decided that "spam@" just isn't worth sending email to. Maybe I've just been lucky; maybe my "spam@" address will be inundated with spam tomorrow morning. I don't know. I do know that it's worked well enough for me that if I ever end up managing a mail server for another domain, I'm going to make sure that I have a "spam@" address there as well.
"Great men are not always wise: neither do the aged understand judgement." Job 32:9
Slightly off topic, but the discussions here made a light bulb go off in my head...
We, the people fighting spam, might be making stuff worse for ourselves. Super bacteria that are resistant to antibiotics came about as a result of an overuse of antibiotics. Are we doing the same thing to spam? Are we inadvertently accelerating the evolution of spam technology?
Maybe instead of using ever more complex filters and other anti-spam techniques, we should alter our approach to spam before we completely lose the ability to send email that won't get lost in the deluge of junk. No matter what kind of filter we throw up the spammers will respond with stuff that gets around it. Spammers aren't stupid. Do we think they don't have access to the same filters we do?
The alternative is two-fold. First, we have to accept that a certain amount of spam in our inboxes is inevitable. Throwing sophisticated filters at every possible filter point only accelerates spam evolution.
Second, we have to take the fight against spam out of the arena of technology and into the real world. Sue the spammers! Lobby for laws prohibiting spam. Don't accept "legal" spam from politicians. Find out who the spammers are and hold them up to public ridicule. In a similar manner ridicule those who respond to spam. Yada, yada, yada.
Don't blame me, I didn't vote for either of them!
Doesn't always work. My ISP(Cogeco cable) doesn't allow inbound SMTP connections to its users.
The only other high-speed residential option is Bell's DSL, which has other issues(such as not being terribly high-speed). A regional ISP does offer residential DSL, but not to my particular area.
And I'm not a business, I've got a limited budget, so I can't afford something more expensive like a business connection. Always-on Internet is an expense I'm willing to deal with, but not by much.
NB: YMMV. IANAL. Take the above with a grain of salt.
If you find yourself forced to use Outlook (Look out!) for whatever reason, you might want to try using SpamBayes for Bayesian spam filtering. I actually like it better than Thunderbird's filtering. It dumps mail into three buckets: spam, ham, and not sure. I've been using it for one of my accounts for a number of months now, and I haven't seen spam in my ham bucket since about a week after I started using it. The "not sure" bucket is innovative; it allows a third option for e-mails that the filter isn't sure about. I get about 5 e-mails a week in the "not sure" bucket; they're about half ham, half spam.
I use Thunderbird at home. Its built-in Bayesian filter is pretty good (though not as good as SpamBayes, in my experience), and because you can view e-mail in Text or Simple HTML mode (as well as full HTML when necessary), you can avoid falling victim to web bugs.
I have two accounts on my mail server. Account A is for personal mail, and Account B for other mail\mailing lists\etc.
For every person who I want sending me personal e-mail, I set up a redirect (@mydomain.tld) to Account A. If I begin receiving spam on that address, I simply delete it and inform the person. If they want to send me more mail, they can let me know, and I'll set up 2@mydomain.tld. After that, they get one more chance. If they screw that up, I just don't give them my address again.
For mailing lists or websites, I set up a redirect (slashdotorg@mydomain.tld) to Account B. If I start getting spam there, I delete the redirect. Then I get my shotgun and go 'hunting' =)
</ASP>
My User Agent: "Where is the pr0n?"
the easiest way to set up disposable addresses is to get a (free) account at spamgourmet.com. you can then create addresses on the fly, without having to go to their site. for example, the first 12 messages sent to
slashdot.12.mbloore@spamgourmet.com will be forwarded to me. any others will get eaten. i don't ever have to go back to the spamgourmet site, but if i do i can do things like see how much mail each of my addresses has received, set up whitelists, and reset counters on existing addresses.
Everything should be made as simple as possible, but not simpler. -- A.E.
Well, with a name like SkunkPussy, I'm suprised that was the worst you found!
TMDA allows you to specify "keyword" addresses. Simply pick a keyword, and a new e-mail addy is generated. If it gets swamped with spam, put it in your blacklist and get on with life.