Subject: Re: Replacing @ with " at "

From: "Dave Page" <[email-masked]>
Date: Fri, 5 Dec 2003 10:45:47 -0000

> -----Original Message-----
> From: Devrim GUNDUZ [mailto:[email-masked]] 
> Sent: 05 December 2003 09:27
> To: PostgreSQL WWW Mailing List
> Subject: [pgsql-www] Replacing @ with " at "
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> Hi,
> 
> I edited buildnews.php and buildevents.php to replace @ signs 
> with " at " 
> (omitting the quotes) to avoid spam, as proposed by 
> Christopher Kings-Lynne. Dave, should it be committed to CVS?

Thanks Devrim, commited.

> I saw something on index.php; but I'm not sure that it works:
> 
>  ereg_replace("@", "&#064;", pg_result($rs, $x, "posted_by"))

That was done by Greg Sabino Mullane 
 
Regards, Dave.

---

From: Devrim GUNDUZ <[email-masked]>
Date: Fri, 5 Dec 2003 13:20:46 +0200 (EET)

Hi,

> That was done by Greg Sabino Mullane 

hmm. I've edited index.php, and it seems ok now.

http://www.postgresql.org/index.php

I've also edited news.php and event.php. Dave, could you please commit all 
three files to CVS?

BTW: index.php and index.html are not in sync for hours. IS there a 
problem?

Regards,
- -- 
Devrim GUNDUZ
[email-masked]				[email-masked] 
			http://www.TDMSoft.com
			http://www.gunduz.org

---

From: Robert Treat <[email-masked]>
Date: Fri, 5 Dec 2003 07:34:39 -0500

> I've also edited news.php and event.php. Dave, could you please commit all

I have an issue with the way this was done.  The email addresses were left as 
links, but the links aren't valid (pops up in your email as foo at bar.com.  
Theres a couple solutions to this:

1) Don't make the email address a link
2) make the mailto be a valid link, but the words on the page not 
3) add a checkbox to the submit page to "obfuscate email", so that s/@/at, and 
not a link, or we'll leave in @ and make it a link.

Robert Treat
-- 
Build A Brighter Lamp :: Linux Apache {middleware} PostgreSQL

---

From: Devrim GUNDUZ <[email-masked]>
Date: Fri, 5 Dec 2003 14:43:45 +0200 (EET)

Hi,

> 1) Don't make the email address a link

This was what I was thinking now :) I vote for this one.

What do the other guys think? BTW, mailto links in event/news details does 
not work.

Regards,
- -- 
Devrim GUNDUZ

---

From: Michael Glaesemann <[email-masked]>
Date: Fri, 5 Dec 2003 21:55:03 +0900

> not a link, or we'll leave in @ and make it a link.

As for 2, if the mailto is literal text in the html, a spambot is going 
to pick it up regardless—my guess is it's even more likely to pick up a 
mailto: link than just a address elsewhere on the page. I know there 
are ways of obfuscating the email address using Javascript (such as 
Hiveware's Enkoder http://www.hiveware.com/enkoder.php for Mac OS X. 
Pretty cool, as it even varies the Javascript so bots have more trouble 
learning it. I know someone a lot smarter than me can figure out how to 
turn this into a server-side solution, and I'm sure someone probably 
already has.)

1 & 3 seem fine, though it would be nice of the mailto: worked as a 
link.

Michael Glaesemann
grzm myrealbox com

---

From: [email-masked]
Date: Sat, 6 Dec 2003 00:38:52 -0000

> are ways of obfuscating the email address using Javascript
 
Indeed:
 
http://www.turnstep.com/Spambot/avoidance.html
 
Almost any change has an amazing rate of return: while a spambot can be
simply changed to pick up things like greg "at" turnstep.com, there
is so much low-hanging fruit around that few if any bother. Glad to
see this is finally being changed. But we need to remove the mailto
link and make it a simple text.
 
I will propose one final thing: changing press at postgresql.org to
something else, as that email is likely to get lots of spam for
many years to come at this point. :(
 
- --
Greg Sabino Mullane [email-masked]
PGP Key: 0x14964AC8 200312051936

---

From: "Marc G. Fournier" <[email-masked]>
Date: Fri, 5 Dec 2003 21:13:48 -0400 (AST)

On Sat, 6 Dec 2003 [email-masked] wrote:

> something else, as that email is likely to get lots of spam for many
> years to come at this point. :(

all the mailing lists are run through Spamassassin, which seems to trap
most of the garbage ... press@ doesn't get much dump'd into the moderators
mailbox ... 20 a week, maybe ...

----
Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
Email: [email-masked]           Yahoo!: yscrappy              ICQ: 7615664

---

From: [email-masked]
Date: Mon, 8 Dec 2003 03:21:22 -0000

> mailbox ... 20 a week, maybe ...
 
I am not sure I understand the point here. Are you saying that all those posts
to the press email are ones that have slipped through the spamassassin filter?
Whatever the system that is in place, the press list is currently overrun with
spam - I did a quick count and got a ratio of about 100 spams for every couple
of real messages. If we were to change the email address to "contact" and not
publish that on the main web page, I am sure that ratio would decrease
dramatically.
 
- --
Greg Sabino Mullane [email-masked]
PGP Key: 0x14964AC8 200312072218

---

From: "Marc G. Fournier" <[email-masked]>
Date: Mon, 8 Dec 2003 01:42:03 -0400 (AST)

On Mon, 8 Dec 2003 [email-masked] wrote:

> I am not sure I understand the point here. Are you saying that all those
> posts to the press email are ones that have slipped through the
> spamassassin filter? Whatever the system that is in place, the press
> list is currently overrun with spam - I did a quick count and got a
> ratio of about 100 spams for every couple of real messages. If we were
> to change the email address to "contact" and not publish that on the
> main web page, I am sure that ratio would decrease dramatically.

Huh?  I'm on the press@ mailing list, and I see an occasional posting to
it, but that is it ... ah, shit, that would explain it ... My anti-spam
filter is cleaning them out ... will take a look at why the ones
"pre-list" aren't picking it out this week ...

----