Subject: Working Group web page spam

From: Tom Pusateri <[email-masked]>
Date: Wed, 31 Aug 2005 14:57:01 -0400

I have a new email address but before I sent out the address to
anyone, I updated it on the ietf PIM working group page. Immediately
(within hours), I started getting spammed.  Most people these days
try to encode the email address in a way that isn't as easily
detectable as an email address. I don't know if that would help but
the way it is now certainly is an open target.

Can we fix the working group web pages?

Thanks,
Tom

---

From: James Carlson <[email-masked]>
Date: Wed, 31 Aug 2005 15:08:52 -0400

> the way it is now certainly is an open target.

I'd rather be spammed than make it difficult to contact me.

If someone wants to change the addresses from "[email-masked]" to
"[email-masked]", so that I at least know whence the address was
stolen, that'd be fine, but I'm not sure I'd want to see more than
that.

-- 
James Carlson, KISS Network                    <[email-masked]>
Sun Microsystems / 1 Network Drive         71.232W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.496N   Fax +1 781 442 1677

---

From: Tom Pusateri <[email-masked]>
Date: Wed, 31 Aug 2005 15:12:21 -0400

>stolen, that'd be fine, but I'm not sure I'd want to see more than

Something like "pusateri at bangj dot com" would be a good compromise.

Thanks,
Tom

---

From: James Carlson <[email-masked]>
Date: Wed, 31 Aug 2005 15:24:24 -0400

> Something like "pusateri at bangj dot com" would be a good compromise.

That's what I was assuming you were proposing, and exactly what I was
hoping not to see.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 31 Aug 2005 15:35:18 -0400

>That's what I was assuming you were proposing, and exactly what I was
There are a few evil things that can be done.  On my web page, I use a 
table, with each letter in a separate cell.  My department's online 
directory uses Javascript to emit the email address -- mine is 
generated by

	hideemail('', 'smb','cs.columbia.edu','','')

I'm no fan of Javascript, but at least here it's serving a better 
purpose than glitzy animation.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 31 Aug 2005 21:54:05 +0200

> Can we fix the working group web pages?

There are many ways of doing this, of course.  One way which I've now
put in place for the WG status pages at tools.ietf.org is to have the
email address generated by a java script snippet.  The page presented
to a user who has Javascript running is unchanged, but the html visible
to a harvester is (for http://www1.tools.ietf.org/wg/pim):

<script type="text/javascript">
  showEmail("pusateri", "bangj.com", "Tom Pusateri"); 
</script>
<noscript >
  Tom Pusateri &nbsp;
  <small>pusateri (&#97;&#116;) bangj.com </small>
</noscript>

Do you find that an improvement?  Should we leave out the <noscript/>
part? Should we propose a similar solution to the WG charter pages at
www.ietf.org ?

(The pages for other WGs should be updated within an hour or so.)

	Henrik

---

From: James Carlson <[email-masked]>
Date: Wed, 31 Aug 2005 16:16:18 -0400

> to a harvester is (for http://www1.tools.ietf.org/wg/pim):

This has the benefit that the link is no longer conveniently clickable
for legitimate users, and the detraction that it won't slow down a
real harvester for more than a few microseconds.

Not much of a trade-off, if you ask me.  I'd rather just use good spam
filters and hit 'd' when necessary.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 31 Aug 2005 16:30:37 -0400

>real harvester for more than a few microseconds.

Sure it's clickable -- the Javascript emits the mailto: part as well.

As for slowing down the harvesters -- I don't know that harvesters have 
Javascript engines yet.  If they do, add a delay loop -- an extra 
couple of seconds to render a page might mean little to a legitimate 
user, but a real nuisance to a spammer....

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 31 Aug 2005 22:54:05 +0200

on 2005-08-31 22:30 Steven M. Bellovin said the following:
[...]
> user, but a real nuisance to a spammer....

Right. Implemented.  500ms / email address rendered, for now, giving
1 second delay for your average WG with 2 co-chairs.

	Henrik

---

From: James Carlson <[email-masked]>
Date: Wed, 31 Aug 2005 17:01:08 -0400

> Sure it's clickable -- the Javascript emits the mailto: part as well.

I meant the other part ... for those who turn off javascript for the
usual reasons.

> user, but a real nuisance to a spammer....

They don't actually need engines at all.  Once you notice that the
function call (excuse me "method invocation" ;-}) follows a known
format every time, you can just sed the right bits out.  It's not as
if this usage will be intentionally different on every page.

Plus, as noted in other places, the bad guys can subscribe to the list
to snarf addresses of far more posters (not just the chairs and other
contacts), or seek addresses in an number of not-so-obfuscated
archives.  Email addresses, like IP addresses, aren't really all that
good as "secrets."

In other words, it seems to inconvenience only the legitimate users
while doing what appears to be little lasting harm to the abusers.  I
don't see much point in that.  If it simply must be done, I guess I'll
shut up now, but I don't see a point.

---

From: Henrik Levkowetz <[email-masked]>
Date: Wed, 31 Aug 2005 23:57:12 +0200

> if this usage will be intentionally different on every page.

Oh, I doubt that my hand-crafted javascript occurs on enough pages for
them to add an explicit recognition pattern for it.  

> archives.  Email addresses, like IP addresses, aren't really all that

As for this, I'm afraid that it's quite correct.  Subscribing to the
list is a very straightforward way of harvesting addresses.

> shut up now, but I don't see a point.

I'm happy to go whichever way people want on this.  Up till now I've left
the addresses in cleartext for accessibility purposes, following James'
reasoning; but if people would feel more comfortable with some other
solution I'll put it in place and advocate it for the charter pages on
www.ietf.org.

	Henrik

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Wed, 31 Aug 2005 20:08:50 -0400

>them to add an explicit recognition pattern for it.  

Right -- this would only be an issue if something like mailman 
generated such patterns, since the spammers have already written 
scripts that recognize mailman archives.  But if that's the problem, 
you just write a trivial encryption algorithm in Javascript, and supply 
the key on the page.