use Perl

Sometimes folks ask why I don't want to be forwarded jokes unless I'm on BCC. ...or they ask why I use such funny email addresses. I end up explaining this frequently, so I thought I would put it in the journal.

This was prompted by Matt's observation that many hotmail users complain about getting spam even though they never give out their email address.

If you truely never give the email addie out (ie: never use the account to send mail or give it to anyone any other way), then you probalby won't get spam unless your username can be guessed. (Brute force username guesses against SMTP hosts are on the rise.)

However, if you phone your girlfriend and give her the address the day it was assigned to you, then you might never log in to the account at all and find out when you do so for the first time a year later that it is full of spam.

Suppose your girlfriend sent you only one message once she had your address.

She sent this hillarious story about a kitten which she knew you would appreicate. She also include her co-worker in the recipient list.

That co-worker had a great laugh, and forwarded it to five friends who like to share 'funny stuff' via email. One of those friends is on a mailing list where folks exchange 'funny stuff'. That friend forwards the message to the list.

Now, if these folks all just hit the forward button, then all of the original recpients' addresses are included in this post to the mailing list.

That list may have an address harvester subscribed.

That list may be accessible via NNTP where havesters lurk in abundance.

That list may be archived on the web, where harvesters are probably more common than on usenet these days.

Subscribers to the list may re-foward, further increasing chances of exposure.

It is possible that by telling your girlfriend your email address, you allowed that address to be exposed to spammers. ...and once exposed, it's probably doomed. Spammers are an incestuous lot who constantly buy one anothers' lists, combine them and try to sell the new larger list for more money. I'm sure you've had plenty of spam trying to sell you email addresses, right? Once you get on one list, you have decent odds of being on oodles of lists.

If you use an address, it may get spam through no fault of your own. You can try to educate folks to use BCC when sending that kind of content (and don't send it yourself). ...but the problem is that you just don't have control.

The only certain solution is to never use or advertise your email address.

A decent second-best is to use an infinite number of addresses. Try to use addresses specific to each contact/occasion/date/etc so that if the address ever gets spam, you can route it to the big bit bucket.

An interesting example: I once sent mail to Simon Cozens which he forwarded to a perl list. That address started getting spam, and in addition related addresses started getting spam, revealing a bug in some common spam address-processing software I suppose:

m_to_simon_cozens@wickline.org
     simon_cozens@wickline.org
       mon_cozens@wickline.org
           cozens@wickline.org
             zens@wickline.org

This series came from part of a Message-ID header:

       0.63e37fea@wickline.org
          3e37fea@wickline.org
             7fea@wickline.org

None of the above addresses will get to me... they all get auto-trashed because they've been tainted and now receive spam. I could claim that I never used that simon_cozens address but the truth is that I did use it. One time. Now it gets spam. (and so do some releated addresses!)

When hotmail users say they never give out their address, I bet that they've at least used it once.

-matt

Checking work email from home tomorrow, but not doing any real work... just kicking back and relaxing.

Friday will be some house cleaning so we can come back to a tidy nest (and so our friends won't see how we really live when they drop by to care for our cats ;) and packing.

Saturday we're flying to PDX, meeting up with friends who are also flying in, then driving up to spend some time with my mom, then further up to the Olympic National Forest.

Peace and friends and green and trees and sensible temperatures and no appreciable humidity and no work.

Horray!

-matt

...as long as I'm thinking about icky things...

Within a year of the sig-changing incident, some spammer used one of my addresses in the From header of their mail. The address was one of those 'free for life' ones and forwarded to my less-permanent school-provided address.

I won't mention the provider of that address, as they may have cleaned up their act since then.

I discovered a gazillion bounce messages in my inbox one day, some of which included the bounced message... which was spam. My address was in the From header. I also discovered a large volume of venomous hate mail from folks who had received the spam. While I felt bad for them, I was feeling worse for myself.

A few days later, I got a message directly to my school account from someone who had been unable to reach me at my 'permanent' address. It turns out that my account was closed. When I contacted support, they said that sending spam was in violation of the terms of use, and that they couldn't re-open the account. I provided them with instructions for the trivial From header forgery and they admitted that they hadn't done any investigation beyond looking at the From header... but they still wouldn't re-open the account.

At that point, I was happy to leave them. Sucky service sucks.

This was years ago. Hopefully they've invested in clues since then.

-matt

Until 1995 or 1996 (I forget the date, but I remember where I was living at the time) I had all sorts of information in my .sig file. The more useful info was name/phone/address.

I thought phone number and address (mailing address, that is) were useful because folks would have a convenient way to find my phone number if they needed to call me, or my address if they needed to mail me something. This was before everyone was carrying PDAs in their pockets, and the sig info had come in handy for folks in the past. ...and I didn't think it could do any harm.

I was wrong. :(

One afternoon I got a phone call from some woman about some conversation she thought we had had in a white supremacist irc channel the evening prior.

If there's a group for which I have a prejudiced and unreasoned hatred, it's bigots. That may well make me a bigot myself, but I am not a white supremacist.

I was too upset to remember the details of our brief conversation, but the gist was she was sure she had the right person because she had the right combination of name, phone number and address. I was just as sure she had the wrong person.

Minutes after our phone conversation, my .sig was void of any 'useful' information.

The Internet lost some of its charm for me on that day. I don't suppose it actually was any different, but I sure learned to look at it through less-rosy glasses. :/

-matt

Everyone loves mysterious switches, right?

If you scroll down to the bottom of this page, there's a Misc link. Click the link and you'll arrive at a Miscellaneous Options screen. That screen has a Save button.

Click the button and you'll be informed that "Option(s) Changed."

So, if you don't like the options life hands you, visit use.perl.org, eh?

Acutally, I didn't notice my options changing. Maybe I changed someone else's options? "Sorry" or "Your welcome", as appropriate.

-matt