ReCAPTCHA Mailhide | Hacker News Reader

ReCAPTCHA Mailhide

google.com

30 pointscskau21 comments

ReCAPTHA has become such a huge pain to solve. Personally I wouldn't even bother solving their horrible captcha to get your email unless I REALLY REALLY need it.

Is the benefit worth the inconvenience? I've had my email in plain text on my personal site for the last 2 years and haven't noticed an increase in spam (thanks to gmail, I suspect).

I've had mine on the Internet for well over a decade and run my own mail server. Plus it is a catch all domain - anything before the @ goes to me.

My mail server is configured to be deliberately slow - taking a few seconds extra here or there to respond to SMTP commands. This catches out the spammers who just spew traffic at you ignoring the protocol. Checking sender domains actually exist plus the Zen RBL gets almost everything else. The dribble that gets through all that then goes to spamassassin which does a sterling job. (I make it put messages scoring 5-7 points in a special folder I manually examine every now and then to double check its effectiveness.)

About the only problem I have had are bad recruiters who have made zero effort to ensure I am match for their client or vice versa. I even have a "Note to recruiters" prominently displayed on my resume, but of course the bad ones aren't going to bother reading that. I have to maintain a list of their domains to block since that appears to be the only way to stop them. (Currently 45 entries and counting ...)

Would you be willing to share your list of bad recruiters?

I've been threatening to do it for years, and I guess this is as good a time as any. Note of course that this is based on my experience.

http://www.rogerbinns.com/blocked_recruiters.txt

This is my "Note to recruiters"

http://www.rogerbinns.com/recruiters.html

"As any group of people gets larger, they get collectively slower and collectively stupider."

Amen!

My personal threshold is around 100 people. Pass 100, and you quickly dive into Dilbert territory.

> My personal threshold is around 100 people

That is probably highly correlated with Dunbar's number

http://en.wikipedia.org/wiki/Dunbars_number

Very enlightening article, thank you!

This is not only for your own email on your site. Especially on comminity sites your you can protect your users' emails with mailhide API http://code.google.com/apis/recaptcha/docs/mailhideapi.html

Far more user-friendly is Dan Benjamin's Enkoder. http://hivelogic.com/enkoder/

It requires that JavaScript be enabled for users, but blocks a large number of spam bots.

There's an older trick that still works for me: a passphrase in the subject line.

You can even include the passphrase in the mailto: uri. E-mail harvesters usually discard it, but a user who clicks the link (e.g. to compose a message in Thunderbird) will have their subject field populated.

Now set up procmail to redirect messages to /dev/null if the passphrase is not present. Now you can freely post the uri all over the web.

Real example:

mailto:aoxomoxoa@finnw.me.uk?subject=Don%22t+buy+this

(I'm confident that no spammer will send bulk messages with "Don't buy this" in the subject line, so that makes a good default passphrase.)

I know someone who always changes the subject line to reflect the content. He even changes the subject line when responding to other people's e-mails, which is quite annoying because it often breaks Gmail conversations.

So you'll have to take some measure to tell people not to delete that passphrase from the subject line. For example, "Don't change or delete this or it will go into my spam box." But that's verbose.

If I send a reply, it comes from a different address (which is not published and is unaffected by the procmail recipe)

This is just another stupid hurdle that people are required to jump over if they want to use the internet.

If you offer products or services over the internet, stay clear of captcha. Unless, of course, you give a dam about your conversion rate.

Spam filters are effective enough to keep your inbox clean. There is no need to play hide and seek with email harvester bots.

Example: show hello@yourdomain.com in plain text on your site and let it pass Gmail's spam filter but send the reply from yourname@yourdomain.com if you get a non-spam message. Use Enkoder ( http://hivelogic.com/enkoder/ ) if you're really spam sensitive.

Although, if you are hosting your email with Google already, it seems kind of irrelevant. I happily post my email in `mailto:` form, and I get spam infrequently enough to happily read through it and laugh at the contents when I do (it's always the funny ones that make it through).

I'm curious why people bother with these posts anymore. It's like some sort of (self) identity validation. E.g. "Look! I sided with Google and I'm on the winning side!"

It seems the site's encoding is broken somehow. I see only question marks, instead of the å's, ä's and ö's it should display. (Trying to view the Swedish version)

Same on Russian page.

A horrible idea -- those who really want your email will just get it when there is a leak at some big site (ala slicehost forum) and the people you most want to get news from won't take the time to get your email (except if you are very famous).

If you are that concerned about spam, let Google handle it -- get your own domain if you want -- and you don't have to worry too much about it.

justtoproveapoint-neverusedthisbefore@tomjen.net.

this has been around for years no? Also, in recent months I've started to move away from using reCaptcha everywhere on webform deployments because of increased difficulty from, shall we say, the less patient and computer literate, visitors of my sites.

Reply on news.ycombinator.com