Hacker News Reader

Comment by bantic | Hacker News Reader

I always thought this sort of systematic obfuscation ( /@/at/s, /\./dot/s, etc) was as machine-readable as an actual email address. I've just gone on the assumption that there are spam harvesters out there using regexes that catch "bob at domain dot com" as well as bob@domain.com.

View on HN

Sure, there are. But given the huge number on unobfuscated addresses on the web how many bother? Ten percent?

EDIT: This experiment shows it to be much less than that (based on volume of spam received) http://techblog.tilllate.com/2008/07/20/ten-methods-to-obfus...

Given the large number of blog, wiki and CMS engines which use the same cargo-cult security idea, it's probably considerably higher than 10%. If you're getting paid to harvest addresses, wouldn't you write a single regexp to increase the number of good addresses?

Sure I would, but like most half-way decent programmers, you couldn't pay me enough to code spam bots.

I've blocked a huge volume of comment spam on my sites by blocking certain malformed HTTP headers. The authors couldn't be bothered to check if they were getting it right. I don't think most spam bot authors are A) very well paid or B) very good.

Don't forget that it's a dynamic system. As more of the low-hanging fruit emails get picked by spam email harvesters, then there is more value in the harder to decode emails since they haven't been spammed. There is a tipping point where it would be "worth it" for someone to start to decode the harder other types of obfuscated emails.

Possibly, but couldn't you argue that the low-hanging fruit email addresses are more likely to be profitable to spammers? Which of these two internet users is more likely to buy your replica rolex: danny@aol.com, or AOL: danny (or danny at aol, or danny+don'tspamme at teh a oh l's dot com)?

My point is that users smart enough to disguise their emails from spammers are more likely to be wary of their wares.

I don't think it even makes sense to harvest these addresses. The people who write email [AT] address [dot] com are MUCH less likely to purchase their Viagra online in you shop just because you send them an email:)

Does that really matter? A botnet of '3 million users' sounds pretty impressive until you find out they're all on dial-up.

Reply on news.ycombinator.com