Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #233852 > unrolled thread

Re: Modern best practice for putting a contact email on the web

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Modern best practice for putting a contact email on the web Joe <joe@jretrading.com> - 2021-04-05 21:40 +0200
    Re: Modern best practice for putting a contact email on the web Celejar <celejar@gmail.com> - 2021-04-05 22:20 +0200
      Re: Modern best practice for putting a contact email on the web Joe <joe@jretrading.com> - 2021-04-05 23:00 +0200
        Re: Modern best practice for putting a contact email on the web Celejar <celejar@gmail.com> - 2021-04-05 23:40 +0200

#233852 — Re: Modern best practice for putting a contact email on the web

On Mon, 5 Apr 2021 14:49:15 -0400
Celejar <celejar@gmail.com> wrote:

> On Mon, 5 Apr 2021 14:12:07 -0400
> Dan Ritter <dsr@randomstring.org> wrote:
> 
> > Celejar wrote:   
> > > Hi,
> > > 
> > > What's the recommended modern best practice for putting a contact
> > > email address on the web while avoiding having it scraped by spam
> > > / fraud bots?  
> > 
> > Assume that every address will be hit by spammers and scammers.
> > Put in appropriate antispam and antimalware precautions.  
> 
> Okay, but why isn't trying to limit spammers getting hold of an
> address a logical part of a defense in depth strategy?

It is, but if you are reachable then a human can enter your address on
a list. Or, as you suggest, OCR will eventually find it.
> 
> > Train your people to recognize spam and scams.  
> 
> I'm talking about a small hobby project that I run in my spare time. I
> just want to reduce spam to an address that I may put up to allow
> people to reach me.
> 
>
Unfortunately, there's nothing to beat running your own mail server,
which is not particularly high-maintenance after setup. The address at
the top of this email was created nearly 23 years ago, and has been used
widely around the Net, including several Usenet groups. I get between
one and four spams a day in my inbox. As it happens, I put a new CIDR
group on my blacklist today, for the first time in perhaps a year.

The next best method is a new free mailbox, with collection piped
through the anti-spam software of your choice. But I tried spamassassin
some years ago, and decided I couldn't spare the time that staying
ahead in the arms race was costing me. Maybe the maintainers have made
better algorithms since then.

-- 
Joe

[toc] | [next] | [standalone]

#233855

On Mon, 5 Apr 2021 20:36:39 +0100
Joe <joe@jretrading.com> wrote:

> On Mon, 5 Apr 2021 14:49:15 -0400
> Celejar <celejar@gmail.com> wrote:
> 
> > On Mon, 5 Apr 2021 14:12:07 -0400
> > Dan Ritter <dsr@randomstring.org> wrote:
> > 
> > > Celejar wrote:   
> > > > Hi,
> > > > 
> > > > What's the recommended modern best practice for putting a contact
> > > > email address on the web while avoiding having it scraped by spam
> > > > / fraud bots?  
> > > 
> > > Assume that every address will be hit by spammers and scammers.
> > > Put in appropriate antispam and antimalware precautions.  
> > 
> > Okay, but why isn't trying to limit spammers getting hold of an
> > address a logical part of a defense in depth strategy?
> 
> It is, but if you are reachable then a human can enter your address on

Yes, but humans don't scale the way bots do ;)

> a list. Or, as you suggest, OCR will eventually find it.
> > 
> > > Train your people to recognize spam and scams.  
> > 
> > I'm talking about a small hobby project that I run in my spare time. I
> > just want to reduce spam to an address that I may put up to allow
> > people to reach me.
> > 
> >
> Unfortunately, there's nothing to beat running your own mail server,
> which is not particularly high-maintenance after setup. The address at
> the top of this email was created nearly 23 years ago, and has been used
> widely around the Net, including several Usenet groups. I get between
> one and four spams a day in my inbox. As it happens, I put a new CIDR
> group on my blacklist today, for the first time in perhaps a year.

I've certainly been tempted for a while. And I suppose that receiving
is less problematic then sending, where one apparently has to manage
reputation, worry about past users of an IP address, monitor
blacklists, etc.

> The next best method is a new free mailbox, with collection piped
> through the anti-spam software of your choice. But I tried spamassassin
> some years ago, and decided I couldn't spare the time that staying
> ahead in the arms race was costing me. Maybe the maintainers have made
> better algorithms since then.

Celejar

[toc] | [prev] | [next] | [standalone]

#233866

On Mon, 5 Apr 2021 16:10:05 -0400
Celejar <celejar@gmail.com> wrote:

> On Mon, 5 Apr 2021 20:36:39 +0100
> Joe <joe@jretrading.com> wrote:
> 
> > On Mon, 5 Apr 2021 14:49:15 -0400
> > Celejar <celejar@gmail.com> wrote:
> >   

> > > Okay, but why isn't trying to limit spammers getting hold of an
> > > address a logical part of a defense in depth strategy?  
> > 
> > It is, but if you are reachable then a human can enter your address
> > on  
> 
> Yes, but humans don't scale the way bots do ;)

No, but you don't care about how many other addresses are harvested,
just about yours.


> > >  
> > Unfortunately, there's nothing to beat running your own mail server,
> > which is not particularly high-maintenance after setup. The address
> > at the top of this email was created nearly 23 years ago, and has
> > been used widely around the Net, including several Usenet groups. I
> > get between one and four spams a day in my inbox. As it happens, I
> > put a new CIDR group on my blacklist today, for the first time in
> > perhaps a year.  
> 
> I've certainly been tempted for a while. And I suppose that receiving
> is less problematic then sending, where one apparently has to manage
> reputation, worry about past users of an IP address, monitor
> blacklists, etc.
> 
Yes, sadly that boils down to having a competent ISP, and I know that
in some parts of the world there's not much choice. In the UK, we have
three good ISPs, one of which is amazing but expensive. In general, if
you can find an ISP who will provide a fixed IPv4 address at little or
no extra cost, they probably know what they're doing.

It is possible to send through a smarthost, which an ISP may provide,
without worrying about your own address, but you lose one of the
advantages of your own server, of having troubleshooting information
about outgoing emails. ('My message, ID xxxxxxxx, was accepted by your
server at xx:yy:zz two days ago... what did you do with it?')

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#233869

On Mon, 5 Apr 2021 21:57:50 +0100
Joe <joe@jretrading.com> wrote:

> On Mon, 5 Apr 2021 16:10:05 -0400
> Celejar <celejar@gmail.com> wrote:
> 
> > On Mon, 5 Apr 2021 20:36:39 +0100
> > Joe <joe@jretrading.com> wrote:
> > 
> > > On Mon, 5 Apr 2021 14:49:15 -0400
> > > Celejar <celejar@gmail.com> wrote:
> > >   
> 
> > > > Okay, but why isn't trying to limit spammers getting hold of an
> > > > address a logical part of a defense in depth strategy?  
> > > 
> > > It is, but if you are reachable then a human can enter your address
> > > on  
> > 
> > Yes, but humans don't scale the way bots do ;)
> 
> No, but you don't care about how many other addresses are harvested,
> just about yours.

Well, actually I care about others as well ;)

But my point was that if it takes a human to scrape my email address,
then spammers are less likely to do it, since to scrape emails manually
at scale would be prohibitively expensive, whereas if the address can
be scraped by bots, then they will do it, since the cost of the bot can
be amortized over lots of addresses.

> > > Unfortunately, there's nothing to beat running your own mail server,
> > > which is not particularly high-maintenance after setup. The address
> > > at the top of this email was created nearly 23 years ago, and has
> > > been used widely around the Net, including several Usenet groups. I
> > > get between one and four spams a day in my inbox. As it happens, I
> > > put a new CIDR group on my blacklist today, for the first time in
> > > perhaps a year.  
> > 
> > I've certainly been tempted for a while. And I suppose that receiving
> > is less problematic then sending, where one apparently has to manage
> > reputation, worry about past users of an IP address, monitor
> > blacklists, etc.
> > 
> Yes, sadly that boils down to having a competent ISP, and I know that
> in some parts of the world there's not much choice. In the UK, we have
> three good ISPs, one of which is amazing but expensive. In general, if
> you can find an ISP who will provide a fixed IPv4 address at little or
> no extra cost, they probably know what they're doing.
> 
> It is possible to send through a smarthost, which an ISP may provide,
> without worrying about your own address, but you lose one of the
> advantages of your own server, of having troubleshooting information
> about outgoing emails. ('My message, ID xxxxxxxx, was accepted by your
> server at xx:yy:zz two days ago... what did you do with it?')

Understood.

Celejar

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web