Hacker News Reader

Comment by sdflhasjd | Hacker News Reader

Given that the percentages of blocked spam are just 17, 50, 67 & 83, it appears that the sample was likely just 6 spam emails which isn't a lot. Also doesn't really explain the methodology. I assume it's against a control of no obfuscation which was the 6 emails.

View on HN

So is the real story here that putting your email on the open web simply isn't a significant "vulnerability" anymore?

Honestly, why would you spider and scrape sites when you can just grab a leaked dataset?

It would be slightly more interesting to put the canaries in a more commonly scanned location, like a plain-text bio field on a popular site (like this one... or FB... or LinkedIn...).

Spidering and scraping is 'more' legal?

Scraping is pretty dangerous if you're running a spam business, since there are a lot of honeypots out there, and you'll pretty rapidly find yourself blacklisted. Email spammers generally want verified email addresses.

Since it's far safer to buy email lists from some broker, you tend to get a lot more spam for signing up for things than posting your email publicly.

To offer one corroborating point, my email address is posted in cleartext on the front page of my website and it receives spam at a rate of less than one message per day.

Another: Used the same email for ~2 decades, never hidden it, giving it out freely and available on lots of public websites including my own. Get around ~30 spam emails per day, all automatically marked as spam. Around 2-3 gets through my filter each month.

Difficult to extract any useful info from this post without specifying what or where your spam filter is. Does it run locally? On your own mail server? An ISP's default spam filter? Gmail? CPanel? Have you tweaked any settings?

We’ve been discussing observed rates of attempted spam, not the effectiveness of downstream filters.

> not the effectiveness of downstream filters.

But he chose to mention that all spam were marked as such and that only 1 or 2 get through. Readers will naturally be curious what methodology and tools are in use.

“Difficult to extract any useful info from this post” reads as undue criticism, as if preemptive satisfaction of your curiosity about the tangent was compulsory.

I disagree that the criticism is "undue"... a post that waves off spam as if it's a non-issue ("2-3 each month"), when in fact many people do struggle with it, helps nobody. A post actually explaining how you built or configured an effective spam filter, however, benefits the HN community.

Is that pre or post IP filter attempted spam?

Or what I'm saying is, if the SMTP server blocks by IP first before determining what mail is being delivered then the actual rate of potential spam to any particular email address is not being discovered.

For my case above we have a decent explanation of the “SMTP stage” policy [1] but no visibility into its actual metrics.

[1]: https://www.fastmail.help/hc/en-us/articles/360060591393

The conversation was about how many spam messages we received, not how many were caught or how. But since you're curious: sendmail + SpamAssassin, running on my own server.

But you specifically mentioned the percentage of messages which are marked as spam, and how many get through your filter. If you choose to include that info, people are going to have questions.

My experience is similar; I have my personal email, which has been in use since the early 00s, in almost plain text (@ replaced with <at>) on the about page of a fairly popular site which gets several million visits a month. I only get 5-10 spam messages/day, most of which are filtered without issue. I do get a decent amount of email, but not true 'spam'. It's mostly just crap I've signed up for over the years and can't be bothered to get rid of.

I honestly get more at my work email, which has never been posted anywhere... I wonder if spammers have started to assume the easy to get email addresses are suspicious or not valuable for various reasons.

> So is the real story here that putting your email on the open web simply isn't a significant "vulnerability" anymore?

Yes. The whole obfuscate my email thing is silly. I have the same email since the mid 90s, I post it without any care to wherever.

You should have posted it right here to prove your point.

Spam isn't a problem for you, I take it? What are you using to filter spam out?

Spam is no longer significant. Back around year 2000 I was getting multiple thousands of spam messages per day (to the very same email address I still use today). Those were the dark and difficult days.

Today I basically don't get any spam. I don't keep precise stats on the spam that makes it to my inbox but it's something like 2 or 3 per month. Compared to a few thousand per day twenty+ years ago!

I want to highlight again that it is the exact same email address I use today.

I block misconfigured connections at the SMTP level in postfix (I run my own mail server), that takes care of pretty much all of it.

After that I run bayesian filtering (spamprobe) to score spam, but there isn't much to catch. Over the last 30 days spamprobe has caught 37 messages, all true positives.

Unlike gmail, I also don't get any false positives (zero so far this year).

I know how bad it was couple decades ago and a lot of people are still traumatized by those days and act like it's still 2001, but the reality in 2023 is that spam is a very minor issue.

I also run postfix on my own domain but instead of bayesian filtering I also run PostFwd and PostGrey. The combination of these 3 is enough in my case to reach zero SPAM emails. I can share my config if someone is interested.

Most of the spam I get is the stupid newsletters that you get signed up for automatically and the unsubscribe link is broken.

I have the same situation

> Given that the percentages of blocked spam are just 17, 50, 67 & 83, it appears that the sample was likely just 6 spam emails which isn't a lot.

This is mentioned, but a little hidden (in the description for URL encoding):

> This is based on a small sample size: just six bots that were observed over a one-year period.

I think the number of spam emails would be a bad measure, since a single scan could result in many hundreds of spam emails.

Reply on news.ycombinator.com