6 ms·

Given that the percentages of blocked spam are just 17, 50, 67 & 83, it appears that the sample was likely just 6 spam emails which isn't a lot. Also doesn't re

Given that the percentages of blocked spam are just 17, 50, 67 & 83, it appears that the sample was likely just 6 spam emails which isn't a lot. Also doesn't really explain the methodology. I assume it's against a control of no obfuscation which was the 6 emails.

mbauman 3y ago
So is the real story here that putting your email on the open web simply isn't a significant "vulnerability" anymore? Honestly, why would you spider and scrape sites when you can just grab a leaked dataset? It would be slightly more interesting to put the canaries in a more commonly scanned location, like a plain-text bio field on a popular site (like this one... or FB... or LinkedIn...).
- NeoTar 3y ago
  Spidering and scraping is 'more' legal?
  - marginalia_nu 3y ago
    Scraping is pretty dangerous if you're running a spam business, since there are a lot of honeypots out there, and you'll pretty rapidly find yourself blacklisted. Email spammers generally want verified email addresses. Since it's far safer to buy email lists from some broker, you tend to get a lot more spam for signing up for things than posting your email publicly.
- aendruk 3y ago
  To offer one corroborating point, my email address is posted in cleartext on the front page of my website and it receives spam at a rate of less than one message per day.
  - capableweb 3y ago
    Another: Used the same email for ~2 decades, never hidden it, giving it out freely and available on lots of public websites including my own. Get around ~30 spam emails per day, all automatically marked as spam. Around 2-3 gets through my filter each month.
    - listenallyall 3y ago
      Difficult to extract any useful info from this post without specifying what or where your spam filter is. Does it run locally? On your own mail server? An ISP's default spam filter? Gmail? CPanel? Have you tweaked any settings?
      - aendruk 3y ago
        We’ve been discussing observed rates of attempted spam, not the effectiveness of downstream filters.
        listenallyall 3y ago
        > not the effectiveness of downstream filters. But he chose to mention that all spam were marked as such and that only 1 or 2 get through. Readers will naturally be curious what methodology and tools are in use.
        aendruk 3y ago
        “Difficult to extract any useful info from this post” reads as undue criticism, as if preemptive satisfaction of your curiosity about the tangent was compulsory.
        listenallyall 3y ago
        I disagree that the criticism is "undue"... a post that waves off spam as if it's a non-issue ("2-3 each month"), when in fact many people do struggle with it, helps nobody. A post actually explaining how you built or configured an effective spam filter, however, benefits the HN community.
  - Xamayon 3y ago
    My experience is similar; I have my personal email, which has been in use since the early 00s, in almost plain text (@ replaced with <at>) on the about page of a fairly popular site which gets several million visits a month. I only get 5-10 spam messages/day, most of which are filtered without issue. I do get a decent amount of email, but not true 'spam'. It's mostly just crap I've signed up for over the years and can't be bothered to get rid of. I honestly get more at my work email, which has never been posted anywhere... I wonder if spammers have started to assume the easy to get email addresses are suspicious or not valuable for various reasons.
- jjav 3y ago
  > So is the real story here that putting your email on the open web simply isn't a significant "vulnerability" anymore? Yes. The whole obfuscate my email thing is silly. I have the same email since the mid 90s, I post it without any care to wherever.
  - Ringz 3y ago
    You should have posted it right here to prove your point. /s
  - nvy 3y ago
    Spam isn't a problem for you, I take it? What are you using to filter spam out?
    - jjav 3y ago
      Spam is no longer significant. Back around year 2000 I was getting multiple thousands of spam messages per day (to the very same email address I still use today). Those were the dark and difficult days. Today I basically don't get any spam. I don't keep precise stats on the spam that makes it to my inbox but it's something like 2 or 3 per month. Compared to a few thousand per day twenty+ years ago! I want to highlight again that it is the exact same email address I use today. I block misconfigured connections at the SMTP level in postfix (I run my own mail server), that takes care of pretty much all of it. After that I run bayesian filtering (spamprobe) to score spam, but there isn't much to catch. Over the last 30 days spamprobe has caught 37 messages, all true positives. Unlike gmail, I also don't get any false positives (zero so far this year). I know how bad it was couple decades ago and a lot of people are still traumatized by those days and act like it's still 2001, but the reality in 2023 is that spam is a very minor issue.
      - tmcdos 3y ago
        I also run postfix on my own domain but instead of bayesian filtering I also run PostFwd and PostGrey. The combination of these 3 is enough in my case to reach zero SPAM emails. I can share my config if someone is interested.
NeoTar 3y ago
> Given that the percentages of blocked spam are just 17, 50, 67 & 83, it appears that the sample was likely just 6 spam emails which isn't a lot. This is mentioned, but a little hidden (in the description for URL encoding): > This is based on a small sample size: just six bots that were observed over a one-year period. I think the number of spam emails would be a bad measure, since a single scan could result in many hundreds of spam emails.

mbauman 3y ago

So is the real story here that putting your email on the open web simply isn't a significant "vulnerability" anymore? Honestly, why would you spider and scrape sites when you can just grab a leaked dataset? It would be slightly more interesting to put the canaries in a more commonly scanned location, like a plain-text bio field on a popular site (like this one... or FB... or LinkedIn...).

NeoTar 3y ago
Spidering and scraping is 'more' legal?
- marginalia_nu 3y ago
  Scraping is pretty dangerous if you're running a spam business, since there are a lot of honeypots out there, and you'll pretty rapidly find yourself blacklisted. Email spammers generally want verified email addresses. Since it's far safer to buy email lists from some broker, you tend to get a lot more spam for signing up for things than posting your email publicly.
aendruk 3y ago
To offer one corroborating point, my email address is posted in cleartext on the front page of my website and it receives spam at a rate of less than one message per day.
- capableweb 3y ago
  Another: Used the same email for ~2 decades, never hidden it, giving it out freely and available on lots of public websites including my own. Get around ~30 spam emails per day, all automatically marked as spam. Around 2-3 gets through my filter each month.
  - listenallyall 3y ago
    Difficult to extract any useful info from this post without specifying what or where your spam filter is. Does it run locally? On your own mail server? An ISP's default spam filter? Gmail? CPanel? Have you tweaked any settings?
    - aendruk 3y ago
      We’ve been discussing observed rates of attempted spam, not the effectiveness of downstream filters.
      - listenallyall 3y ago
        > not the effectiveness of downstream filters. But he chose to mention that all spam were marked as such and that only 1 or 2 get through. Readers will naturally be curious what methodology and tools are in use.
        aendruk 3y ago
        “Difficult to extract any useful info from this post” reads as undue criticism, as if preemptive satisfaction of your curiosity about the tangent was compulsory.
        listenallyall 3y ago
        I disagree that the criticism is "undue"... a post that waves off spam as if it's a non-issue ("2-3 each month"), when in fact many people do struggle with it, helps nobody. A post actually explaining how you built or configured an effective spam filter, however, benefits the HN community.
- Xamayon 3y ago
  My experience is similar; I have my personal email, which has been in use since the early 00s, in almost plain text (@ replaced with <at>) on the about page of a fairly popular site which gets several million visits a month. I only get 5-10 spam messages/day, most of which are filtered without issue. I do get a decent amount of email, but not true 'spam'. It's mostly just crap I've signed up for over the years and can't be bothered to get rid of. I honestly get more at my work email, which has never been posted anywhere... I wonder if spammers have started to assume the easy to get email addresses are suspicious or not valuable for various reasons.
jjav 3y ago
> So is the real story here that putting your email on the open web simply isn't a significant "vulnerability" anymore? Yes. The whole obfuscate my email thing is silly. I have the same email since the mid 90s, I post it without any care to wherever.
- Ringz 3y ago
  You should have posted it right here to prove your point. /s
- nvy 3y ago
  Spam isn't a problem for you, I take it? What are you using to filter spam out?
  - jjav 3y ago
    Spam is no longer significant. Back around year 2000 I was getting multiple thousands of spam messages per day (to the very same email address I still use today). Those were the dark and difficult days. Today I basically don't get any spam. I don't keep precise stats on the spam that makes it to my inbox but it's something like 2 or 3 per month. Compared to a few thousand per day twenty+ years ago! I want to highlight again that it is the exact same email address I use today. I block misconfigured connections at the SMTP level in postfix (I run my own mail server), that takes care of pretty much all of it. After that I run bayesian filtering (spamprobe) to score spam, but there isn't much to catch. Over the last 30 days spamprobe has caught 37 messages, all true positives. Unlike gmail, I also don't get any false positives (zero so far this year). I know how bad it was couple decades ago and a lot of people are still traumatized by those days and act like it's still 2001, but the reality in 2023 is that spam is a very minor issue.
    - tmcdos 3y ago
      I also run postfix on my own domain but instead of bayesian filtering I also run PostFwd and PostGrey. The combination of these 3 is enough in my case to reach zero SPAM emails. I can share my config if someone is interested.

NeoTar 3y ago

> Given that the percentages of blocked spam are just 17, 50, 67 & 83, it appears that the sample was likely just 6 spam emails which isn't a lot. This is mentioned, but a little hidden (in the description for URL encoding): > This is based on a small sample size: just six bots that were observed over a one-year period. I think the number of spam emails would be a bad measure, since a single scan could result in many hundreds of spam emails.