Please stop using (at) email [dot] com(garmr.posterous.com)
garmr.posterous.com
Please stop using (at) email [dot] com
http://garmr.posterous.com/please-stop-using-at-email-dot-com
8 comments
I believe the purpose is just to make it harder (which, really, is the purpose of security in general).
Of course if a spammer wanted my email address there would be little I could do to stop them, but a script kiddie that just learned regex and does a preliminary `wget | grep` won't notice my slightly obfuscated address missing from the list of billions of low hanging fruit.
While I certainly see your rationale for not "break[ing] the internet," there are sometimes more important things than usability. If someone can't be bothered to retype my non-mailto-ified email address, chances are high I'm better off not being bothered by their email.
Of course if a spammer wanted my email address there would be little I could do to stop them, but a script kiddie that just learned regex and does a preliminary `wget | grep` won't notice my slightly obfuscated address missing from the list of billions of low hanging fruit.
While I certainly see your rationale for not "break[ing] the internet," there are sometimes more important things than usability. If someone can't be bothered to retype my non-mailto-ified email address, chances are high I'm better off not being bothered by their email.
I think the problem is that you also make legitimate use harder, like copy-pasteing an email address from a web page.
In fact I think this applies to security in general. You need to balance the costs and the benefits. Usually in matters like this benefits seem to be implicitly overestimated and costs underestimated, and people just get used to living in the worsened conditions.
It's probably because you can't really see the benefits, so you just imagine them to be there. And you imagine them to be larger than the costs, which you can easily downplay (by saying people shouldn't be so lazy, etc).
I think this kind of thinking is bad and I don't think we should voluntarily make our own lives worse in every possible opportunity we get.
In fact I think this applies to security in general. You need to balance the costs and the benefits. Usually in matters like this benefits seem to be implicitly overestimated and costs underestimated, and people just get used to living in the worsened conditions.
It's probably because you can't really see the benefits, so you just imagine them to be there. And you imagine them to be larger than the costs, which you can easily downplay (by saying people shouldn't be so lazy, etc).
I think this kind of thinking is bad and I don't think we should voluntarily make our own lives worse in every possible opportunity we get.
"If someone can't be bothered to retype my non-mailto-ified email address, chances are high I'm better off not being bothered by their email."
This. It is less to do with me worrying about spam as much as it is me adding an extra layer between myself and people that mass-email myself and others about employment opportunities, etc. If they really like my work and want to talk, they won't have an issue typing it out.
This. It is less to do with me worrying about spam as much as it is me adding an extra layer between myself and people that mass-email myself and others about employment opportunities, etc. If they really like my work and want to talk, they won't have an issue typing it out.
I definitely agree with this on the desktop, but I wonder if it's still true when folks try to contact you via mobile and they can't keep the browser window open for reference while entering your address in their email client.
I've seen this before:
to email me, take off my pants... mypants[email protected]
Probably not very effective but funny. :)
to email me, take off my pants... mypants[email protected]
Probably not very effective but funny. :)
Why not convert the email address to a readable (and mailto-able) format in javascript?
This is also an awesome little trick:
<span class='reverse'>[email protected]</span>
.reverse { direction: rtl; unicode-bidi: bidi-override; }
<span class='reverse'>[email protected]</span>
.reverse { direction: rtl; unicode-bidi: bidi-override; }
But you still can't click on it, and if you copy it, it's backwards when you go to paste it. Well, unless your MUA is aware of rtl, then it looks fine until the email bounces (and the bounce falls into your spam filter).
Generating the email address in javascript is probably a better solution (and if you generate it early enough in page load you'll catch proxy browsers like Opera Mini as well).
Generating the email address in javascript is probably a better solution (and if you generate it early enough in page load you'll catch proxy browsers like Opera Mini as well).
Recaptcha's email solution isn't too elegant, but it works: http://www.google.com/recaptcha/mailhide/
If you are on a forum, you can link to a page with the Recatcha solution too (e.g. hosted for free on Github). You could combine it with a contact form too, and give visitors an option between the two.
If you are on a forum, you can link to a page with the Recatcha solution too (e.g. hosted for free on Github). You could combine it with a contact form too, and give visitors an option between the two.
I'm a fan of [name] ... [email] (I.e. joe22 ... yahoo). Gets the point across in a safe way.
Which is still contrary to the spirit of the article and getting a little terse for those who dont realise that Yahoo is your email provider.
Alright, I'll bite. Yahoo what? com? fr? ca? co.uk? And if you add the TLD, then you're back at square one - a simple regex and you can grab the email easily.
Well, I'm not sure if the author is correct. I'm sure that the spammers use automated scripts and there also a lot of script kiddies, which just use the script without knowing how it works. I changed to ..[at].. [dot].. email notation a while ago and I received much less spam.
I'd to compare it to ssh on port 22. If you run it on the default port you will notice a lot of failed logins etc. If you change the port to e.g. 8756 you don't get any failed logins anymore, because the script doesn't scan and just use the default port.
I'd to compare it to ssh on port 22. If you run it on the default port you will notice a lot of failed logins etc. If you change the port to e.g. 8756 you don't get any failed logins anymore, because the script doesn't scan and just use the default port.
I've worked with proprietary products like Barracudas, and similar open source systems like MailScanner, and none of them have been as good at stopping spam and allowing legitimate messages as GMail.
So extrapolating out his sample size of one to the entire internet is a bit of a stretch.
Further, he assumes that people running these scanners are doing regex type stuff to get these variations, when it's more likely that 99% of e-mail harvesters won't bother.
Spending the time to get those few amount of e-mails would not be worth the time, not to mention, the people that try to obscure their e-mail are probably the least likely people to buy viagra from some unsolicited e-mail.