3 ms·

> This will get abused by spammers, even with email confirmations. Could you elaborate? I have vague worries since there's not a captcha or anything. But I can

> This will get abused by spammers, even with email confirmations. Could you elaborate? I have vague worries since there's not a captcha or anything. But I can't think of an attack or abuse beyond a DoS-type thing, and I don't know why someone would do that beyond trolling. I know my naïveté probably sounds painful but I would appreciate more feedback here. Would a captcha be enough? My concern there is that I'm being super paranoid about privacy (https://aytwit.com/about#privacy https://aytwit.com/about#privacy) and wouldn't want to incorporate Google's captcha if I don't have to.

snazz 8y ago
You’re letting anyone with an email address send mail (through your service) to another address. It looks like the spammer wouldn’t be able to completely control the contents of the message, but they could still send unsolicited junk emails from your email provider or server, which might get your email or IP address blacklisted by spam filters and prevent legitimate users’ emails from being delivered. I would implement heavy rate limiting and maybe come up with a basic captcha that would stop most spammers. Oh, and by the way: if you want italics there can’t be a space between the asterisk and the phrase to be italicized (like * this * versus this).
- jmathai 8y ago
  I wouldn't worry about this unless/until it became a problem :)
prawn 8y ago
You have a form on your site where someone can set a destination email address and a hashtag message. Am I missing something or can someone put target@domain.com and a private thought of a spam message or abuse or anything like that? Trolls will hit it and as soon as bots find it, you are going to get more spam than users by some stretch. If people report you, you will be blacklisted very quickly and your host will get stroppy. I'm speaking from experience, but in my case it was a tinyurl-type site. Even if you require approval from the sending email before pushing the thought, someone can still use Mailinator/similar for that. Personally, the combination of solution-in-search-of-a-problem and this sort of hassle would make this a non-starter for me. I can't think of a single time someone would realistically use any of the modes the site lists. If they used a hashtag, there's no way to handle knowing which email address someone might've used (personal, work, etc). The first-date example had me checking for April 1. "It's all up to Lisa now. If she really wants to get out of there she might check for a bunch of variations like #wannaGetOutOfHere, #letsBounce, #notFeelingThisPlace, #wannaGo, etc." What are the chances that two people on a date use their phones long enough and are both aware of an obscure site to make more progress than just saying "Well, this is very formal. What do you think?"
- dougk16 8y ago
  There is at least a confirmation email step. Otherwise hehe your worries on spam do echo mine. So far I've just been ignoring that aspect and leaving it open. Honestly I don't know how any web service that ultimately sends transactional email really deals with it, beyond brute-forcing it down to an acceptable rate. Even Google's captchas can be defeated by bots nowadays AFAIR, and they're the best. My thoughts are that ultimately you have to hope that it doesn't happen to you. I would appreciate other people's opinions and experience here as well. Thanks for your comment.

snazz 8y ago

You’re letting anyone with an email address send mail (through your service) to another address. It looks like the spammer wouldn’t be able to completely control the contents of the message, but they could still send unsolicited junk emails from your email provider or server, which might get your email or IP address blacklisted by spam filters and prevent legitimate users’ emails from being delivered. I would implement heavy rate limiting and maybe come up with a basic captcha that would stop most spammers. Oh, and by the way: if you want italics there can’t be a space between the asterisk and the phrase to be italicized (like * this * versus this).

jmathai 8y ago
I wouldn't worry about this unless/until it became a problem :)

prawn 8y ago

You have a form on your site where someone can set a destination email address and a hashtag message. Am I missing something or can someone put target@domain.com and a private thought of a spam message or abuse or anything like that? Trolls will hit it and as soon as bots find it, you are going to get more spam than users by some stretch. If people report you, you will be blacklisted very quickly and your host will get stroppy. I'm speaking from experience, but in my case it was a tinyurl-type site. Even if you require approval from the sending email before pushing the thought, someone can still use Mailinator/similar for that. Personally, the combination of solution-in-search-of-a-problem and this sort of hassle would make this a non-starter for me. I can't think of a single time someone would realistically use any of the modes the site lists. If they used a hashtag, there's no way to handle knowing which email address someone might've used (personal, work, etc). The first-date example had me checking for April 1. "It's all up to Lisa now. If she really wants to get out of there she might check for a bunch of variations like #wannaGetOutOfHere, #letsBounce, #notFeelingThisPlace, #wannaGo, etc." What are the chances that two people on a date use their phones long enough and are both aware of an obscure site to make more progress than just saying "Well, this is very formal. What do you think?"

dougk16 8y ago
There is at least a confirmation email step. Otherwise hehe your worries on spam do echo mine. So far I've just been ignoring that aspect and leaving it open. Honestly I don't know how any web service that ultimately sends transactional email really deals with it, beyond brute-forcing it down to an acceptable rate. Even Google's captchas can be defeated by bots nowadays AFAIR, and they're the best. My thoughts are that ultimately you have to hope that it doesn't happen to you. I would appreciate other people's opinions and experience here as well. Thanks for your comment.