6 ms·
I run marketing email databases. This is cute, but it doesn't actually do anything in most systems - either the employees all already get the marketing emails o
by legitster 4y ago
I run marketing email databases. This is cute, but it doesn't actually do anything in most systems - either the employees all already get the marketing emails or there is a system-wide rule to suppress against the email domain.
If you actually want to (potentially) break something, try submitting some obscure characters or malformed html into some fields. Blank spaces in emails can particularly be a nuisance.
And if you want some real fun, some systems only enforce validation rules via client-side javascript. If you block them, you might be able to submit some real chaotic entries.
- sodimel 4y agoThe zero-width char seems to be a good candidate, thanks !
- s09dfhks 4y agoUnicode Character “⠀” (U+2800)
- Gravyness 4y agoA trick I like is to fill every form with "null".
- legitster 4y agoThe extent that this bugs us though is pretty minimal. Any publicly facing form is going to have to handle massive amounts of garbage data as it is (if not just from people, from bots as well) so records that cleanly identify themselves as garbage save us a ton of time.
- dylan604 4y agoIt's amazing how Lil' Bobby Drop Tables is still causing havoc
- Avamander 4y agoI would also recommend naming yourself Viagra, Cialis or CBD.
- legitster 4y agoThis is actually kind of clever, but only if you give us a real email address. We will often take your name and insert them into emails (for some dumb reasons around personalization supposedly increasing opens). But an email being stuffed full of spam words is a good way to get it flagged by anti-spam software and potentially hurt our sender reputation score. You would probably have to do it en masse and use real inboxes. A couple other names you could use would be "free", "lovers", "singles", or any sort of mid word character substitution.
- iamacyborg 4y agoThis reminds me of when I briefly worked at a major luxury fashion retailer. We were not allowed to send emails with “pussy bow” blouses as they were getting caught by corporate spam filters
- soco 4y agoWhoever named those blouses wasn't an English speaker right? Right?
- projektfu 4y agoThere is some year, between 1980 and 1992 perhaps, where people stopped saying "pussy" and meaning "cat". Until then, both meanings and their double entendres were used (cf. Octopussy). One of my favorites was in Leather Goddesses of Phobos. Something like: LGOP: ... there is a painting of a cat. > LOOK PAINTING LGOP: It's a very nice painting of a pussy, but is it art?
- jaclaz 4y agoIn the Bond saga (books and movies) and well before Octopussy, there was the airplane pilot in Goldfinger (the movie): https://en.wikipedia.org/wiki/Pussy_Galore https://en.wikipedia.org/wiki/Pussy_Galore
- TechBro8615 4y agoI think Log4shell was about the closest we got to this. It’s still crazy to me you could exploit an unknown machine by leaving a string of text somewhere and waiting for a vulnerable client to process it. I imagine many spammers are running a lot of insecure PHP and Perl scripts to support their operation. That was certainly the case back in ~2006, and I imagine most “new entrant” spammers are not using email but rather social media tactics and the like, so I doubt email spam infrastructure improved. That said, the real guilty spammers are the companies doing it under the flag of a sales tool. RIP your email if you put it in a git commit.
- Jerrrry 4y agoBlind XSS is a thing. not my fault you haphazardly inserted <whatever I crafted> into an HTML field in some browser at some point in the future. DNS records, facebook statuses, titles of apps on the playstore, Wifi SSIDs, BIO's on obscure forums, names of children, recipe ingredients, your TV's network nick name...anything that can hold the input of a user, that a scraper or content mechanism will eventually naively come across... eventually it will get added to the DOM of some unknownst messenger, and I will receive a ping, letting me know that someone, somewhere, somewhen, sniffed my digital fart.
- jwx48 4y ago> ...anything that can hold the input of a user, that a scraper or content mechanism will eventually naively come across Good way to put it, and I'm going to share this.
- legitster 4y agoSo, for the email industry (both marketers and client developers) "Spam" is used to specify emails that are not compliant with the CAN-SPAM act - they don't have a way to unsubscribe or report abuse. ITT people are using Spam to cover all sorts of junk email, but in my mind there is a difference between companies engaging in annoying methods to get your consent and organizations engaging in bad faith breaches of CAN-SPAM.
- 4y ago
- sacrosancty 4y agoThe extended version where he sends signs up his list of other spammers for each other's newsletters should get around that problem.
- legitster 4y agoIf it's an public email address we actually care about, it's likely flooded with OOFs or noise anyway. There's a product we use called SiftRock that automatically sorts through noisy inboxes and detects real human responses so we know which ones a service person actually needs to respond to.
- ARandomerDude 4y agoHow do you sleep at night?
- LilBytes 4y agoI hope they slept well.
- mandmandam 4y agoOn a bed of money and shitty rationalisations, if they're like the other people ruining the world.
- legitster 4y agoMost of my job is gathering data to explain to managers and executives how ineffective our email programs are and that we need to stop emailing customers so much.
- tjbiddle 4y agoNot all email marketing is bad - most of it isn't, really. 90% of stuff you likely subscribed to at some point for whatever reason (Free gift, discount, purchase, interested in their content, whatever) - and most things have an unsubscribe so it's a simple matter to remove yourself. Most of the other 10% goes to spam anyway and I never see it. Apart from the obvious spam that I never see anyway, I very rarely get emails that I didn't intend to receive.
- ransom1538 4y agoWhat they should do is put in a non existing email eg: foobar323992382@gmail.com . These are great since email senders get hit hard with bounces which kill your send rates.
- mechanical_bear 4y agoYou really had to go and put my email address out there didn’t you? At least pick a nonexistent one….sheesh
- iforgotpassword 4y agoWould it work if I create a mail alias on my domain that forwards to the CEOs mail? Assuming I only do that for one address per company and they're not all hosting with the same provider, it could take a while until my box ends up on a blacklist.
- ricardo81 4y ago>some systems only enforce validation rules via client-side javascript Terrible! It's as good as no validation. Client side validation should simply save the convenience of a wasted HTTPs request. Surely better to send known honeypot email addresses if looking to poison an email list.