3 ms·
Looks like you are using Hakara mail server (edit:nope) and Firebase. http://haraka.github.io/ http://haraka.github.io/ Site is clean, documentation is simple
by degenerate 7y ago
Looks like you are using Hakara mail server (edit:nope) and Firebase.
http://haraka.github.io/ http://haraka.github.io/
Site is clean, documentation is simple and everything seemed to work great. Thanks for sharing. The only issue I see: I can sign up using my own referral code seemingly unlimited times with fake emails, and I don't even need to do this on a real domain... the JS code works from a local HTML file [0]. So people that want to bump their place in line, or competitors wanting to cost me money/headache, can seemingly sign up dozens of fake referrals per second. I assume nefarious use was not on the high priority list before launch, but do you have any plans to mitigate this type of activity in the future? Perhaps rate limiting and IP / browser session checks on the server side to start?
[0] https://docs.referlist.co/#/?id=install-embedded-sign-up-form-in-a-website-builder-like-squarespace-webflow-wix-etc-you-write-0-lines-of-code https://docs.referlist.co/#/?id=install-embedded-sign-up-for...
- parthi 7y agoWe don't use Haraka but we do use Firebase! Thanks for the feedback! You only move up the waitlist if a person you refer verifies their email. Robinhood Crypto had this issue where they didn't check email verification and people gamed it. Made sure to handle that nefarious use case. But thanks for asking! I guess you could own a ton of fake emails and still be adversarial. In which case, I should probably implement an IP rate limit like you suggested.
- degenerate 7y agoGlad you already thought of the email verification idea. Great!
- agustif 7y agoNext step would be blocking temporary emails domains, which is a rabbit hole, and also adding captcha to the verify I guess. Also allowing only hotmail/gmail/etc might help