[OT] Whether and how to obfuscate email addresses in posts, docs & code

Dear Boosters What follows is OT, but since this post discusses a problem that I expect to hit boost contributors especially hard I think it is ok to post it here. If not, please let me know. **** lengthy obfuscation rationale begin **** Spammers routinely harvest email addresses from web pages and newsgroups. Viruses scan harddisks to find email addresses of potential new victims. Spammers have even started to use special viruses to install backdoors on computers and then later hijack the infected machines to send their junk to the email addresses found on the harddisk (see e.g. http://tinyurl.com/35usd). Boost contributors are especially vulnerable as their email address is published on the boost website and on the boost list. Moreover, their email address can be found on the harddisks of the thousands of people who use the boost distribution. Despite these vulnerabilities, very few obfuscate their address on the list and in the 1.31 distribution (I don't do so yet, either). Sure, virus scanners and spam filters alleviate the problem but they can never fully solve it. Spammers have become very sophisticated in making their junk pass filters. Although I'm employing multiple spam/virus filters (spamcop, gmx, yahoo) I'm currently getting about 10 unsolicited messages per day (up from about 3 per day a year ago) and I'm concerned what will happen once my address is stored on thousands of hard drives when/if my library is accepted into boost. Sure, I could simply disable my throw-away address and publish a new one as soon as spam/virus levels become unbearable but that also immediately cuts off users who have downloaded the distribution. Plus, this solves the problem only temporarily. So, the only real solution to considerably reduce email junk is to thwart automatic harvest and thus to obfuscate email addresses. I realize that even this offers no guarantee for not receiving spam/viruses as someone sending me email will often have my unobfuscated email address on his/her hard drive but it definitely reduces the number of locations where my address can be harvested considerably. **** lengthy obfuscation rationale end **** Questions: 1. How do other contributors deal with spam/viruses clogging up their in-boxes? Am I worrying about something that will never be a big deal? 2. What do other people think about a voluntary boost standard for obfuscating email addresses published in posts, docs & code? 3. If you think 2. is a good idea then what is a good way to obfuscate email addresses? Is the simple <at> & <dot> approach sufficient or do we need something that is less common (and thus prone to automation)? E.g. WHATah2003EVER@gmx.net with a remark to remove all capital letters? Regards, Andreas

Andreas Huber wrote:
2. What do other people think about a voluntary boost standard for obfuscating email addresses published in posts, docs & code?
3. If you think 2. is a good idea then what is a good way to obfuscate email addresses? Is the simple <at> & <dot> approach sufficient or do we need something that is less common (and thus prone to automation)? E.g. WHATah2003EVER@gmx.net with a remark to remove all capital letters?
Don't bother. Your address is probably already harvested. See for example http://lists.boost.org/MailArchives/boost/msg65470.php

Peter Dimov wrote:
Andreas Huber wrote:
2. What do other people think about a voluntary boost standard for obfuscating email addresses published in posts, docs & code?
3. If you think 2. is a good idea then what is a good way to obfuscate email addresses? Is the simple <at> & <dot> approach sufficient or do we need something that is less common (and thus prone to automation)? E.g. WHATah2003EVER@gmx.net with a remark to remove all capital letters?
Don't bother. Your address is probably already harvested. See for example
Right. ah2003@gmx.net is a disposable address. I'd definitely disable it and create a new one, which I would then publish only obfuscated. Regards, Andreas

"Andreas Huber" <ah2003@gmx.net> writes:
Peter Dimov wrote:
Andreas Huber wrote:
2. What do other people think about a voluntary boost standard for obfuscating email addresses published in posts, docs & code?
3. If you think 2. is a good idea then what is a good way to obfuscate email addresses? Is the simple <at> & <dot> approach sufficient or do we need something that is less common (and thus prone to automation)? E.g. WHATah2003EVER@gmx.net with a remark to remove all capital letters?
Don't bother. Your address is probably already harvested. See for example
Right. ah2003@gmx.net is a disposable address. I'd definitely disable it and create a new one, which I would then publish only obfuscated.
It's very strange, since we have this option enabled in Mailman: obscure_addresses (privacy): Show member addresses so they're not directly recognizable as email addresses? Setting this option causes member email addresses to be transformed when they are presented on list web pages (both in text and as links), so they're not trivially recognizable as email addresses. The intention is to prevent the addresses from being snarfed up by automated web scanners for use by spammers -- Dave Abrahams Boost Consulting http://www.boost-consulting.com

David Abrahams wrote:
Right. ah2003@gmx.net is a disposable address. I'd definitely disable it and create a new one, which I would then publish only obfuscated.
It's very strange, since we have this option enabled in Mailman:
obscure_addresses (privacy): Show member addresses so they're not directly recognizable as email addresses?
Setting this option causes member email addresses to be transformed when they are presented on list web pages (both in text and as links), so they're not trivially recognizable as email addresses. The intention is to prevent the addresses from being snarfed up by automated web scanners for use by spammers
Right, this avoids problems with bots harvesting web pages. It does not avoid problems with bots harvesting newsgroups. Moreover, when people use news readers like OE, then the email addresses in downloaded messages end up trivially recognizable on their hard drives. As I explained in my original post this becomes more and more of a problem (viruses that suck email addresses from newsgroup archives). Regards, Andreas

"Andreas Huber" <ah2003@gmx.net> writes:
What follows is OT, but since this post discusses a problem that I expect to hit boost contributors especially hard I think it is ok to post it here. If not, please let me know.
Well, it really should go elsewhere inasmuch as it has nothing specific to do with Boost or C++ library development. -- Dave Abrahams Boost Consulting http://www.boost-consulting.com

David Abrahams wrote:
"Andreas Huber" <ah2003@gmx.net> writes:
What follows is OT, but since this post discusses a problem that I expect to hit boost contributors especially hard I think it is ok to post it here. If not, please let me know.
Well, it really should go elsewhere inasmuch as it has nothing specific to do with Boost or C++ library development.
Ok. Regards, Andreas

Andreas Huber wrote:
1. How do other contributors deal with spam/viruses clogging up their in-boxes? Am I worrying about something that will never be a big deal?
I am not a contributor; yet I am sure my email address appears many places from which it would be harvested, such as ChangeLogs in other projects. I have found the ability to use separate different address (as you seem to do) for different purposes limits the potiential for spam to ever be a serious problem for me. The particular fashion in which I have mail filters set up (nothing unique I'm sure) means that the vast majority of spam is immediately recognizable such that I can skip it very quickly. A good threaded mail reader helps in this respect. I would be extremely suprised if the time I spend processing spam would ever come near the amount of time it takes me to sort through the mailing lists I read, and actually reading email that I am genuinely interested in. Therefore, I am vaguely opposed to this sort of thing. Often overzealous spam measures make it difficult to get at someone's address when I would really like to; other measures such as subscribe-only lists etc threaten to take more time for me to work with than spam ever will. Hoping these comments will be useful, Aaron W. LaFramboise
participants (4)
-
Aaron W. LaFramboise
-
Andreas Huber
-
David Abrahams
-
Peter Dimov