Comment by kazinator | Hacker News Reader

Comment by kazinator | Hacker News Reader

Parent Full thread

> I hope laws like this help deter such behavior.

Wishful thinking. The law in Canada, to my understanding, says that if you have conducted business with someone, then it's fair game for them to contact you with offers for some period of time (either 6 months or 12; I can't remember which.) Spam is defined as unsolicited bulk mail. If you bought something or subscribed to a site or whatever, then it's not unsolicited regardless of any opt-in or opt-out mechanism. The "do not call" registry of phone numbers similarly only applies to unsolicited callers; companies you've done business with can spam you with calls if you give them your phone number.

For these throwaway subscribes and transactional e-mails, I use an e-mail of them form <user>.<pin>@<mydomain>. When my mail server receives mail for this pattern, it changes it to <user>@<mydomain>, and bypasses all filters. Thus I'm sure to get important transactional e-mail. From time to time, and when I start seeing spam, I simply change the value of <pin>, which is a global in my mail server's config file.

Some people have date-based approaches, which can work well. E.g. if it is March 2015, your mail server might recognize an e-mail of the form you.201503@yourdomain, and map it to you@yourdomain. When April comes around, it stops working.

With gmail you can also simply add some text after a +

e.g.

cole.christensen+hnspam@gmail.com

And when mail from that source becomes troublesome setup a filter based on that To: address.

And then filtering is often your only option because the unsubscribe link doesn't work right with the plus character in it. Also, Gmail helpfully prevents us from creating filters that pipe the messages in question to /dev/null.

In gmail you can setup a filter that automatically deletes messages. Not quite /dev/null but pretty close.

"Delete it" merely moves the messages to the trash. It does not, in fact, delete the message. Not close at all.

And anything in the trash gets automatically deleted in 30 days.

That kind of depends entirely on who/what you are unsubscribing from, and how intelligently they encode e-mail addresses through URL's, surely?

Maybe the problem you're running into is that the + character is special in URL's and must be escaped, otherwise it is treated as the representation of a space character. E.g. the URL parameter in <http://foo.example.com?unsubscribe&bob+whatever@domain> looks, after URL decoding by the server, like "bob whatever@domain". The software which inserted the e-mail into the URL didn't treat the plus properly, but the software which is decoding the URL is treating it like it is supposed to.

If that's the issue, the workaround could be as simple as manually fixing the URL in your browser, replacing the unescaped + character with its percent-encoding equivalent, %2B, as in <http://foo.example.com?unsubscribe&bob%2Bwhatever@domain>. The URL parameter bob%2Bwhatever@domain should now decode into bob+whatever@domain.

Try it next time.

It's easy to see how this could happen because the insertion of e-mail addresses into unsubscribe links in e-mail bodies is done by ad-hoc software probably cobbed together in house, whereas whereas URL parsing is done by generic URL handling code in a web server.

(But anyway, the whole point of this exercise is that we don't trust the unsubscribing. If unsubscribing could be trusted to be honored, we wouldn't need this extraneous e-mail address that we can recognize and junk.)

One problem with this is that this suffers from lack of obscurity, being implemented by a very popular mass mailer. It help against obnoxious, but otherwise honest sites that you have a relationship with, but it won't hamper real spammers, who can easily encode in their spamming software the blanket rule that any e-mail matching the pattern <x>+<y>@gmail.com should always be filtered to <x>@gmail.com.

You could not, for instance, widely publicize your "plus armored" gmail address in ways that make it susceptible to harvesting, and the scheme won't safeguard against situations where that e-mail address, once given legitimately, ends up sold to spammers.

Basically, everyone should have their own mail domain with a different trick. :)

Here is something you can do to bootstrap your own trick: make a "plus armored" gmail address your main one. For instance "bob.smith+rocks@gmail.com", such that "bob.smith@gmail.com" is considered invalid and thrown to the bit bucket. Do not give the "+rocks" version to anyone other than close contacts. Since "rocks" is a personal suffix, a spammer who has the address "bob.smith+junk003@gmail.com" cannot guess that "junk003" must be replaced with "rocks".

Actual spam filtering is as good as I could ask for on gmail. Maybe a few per month get through to my inbox, and I can't complain about that at all. I am also not at all worried about parsing x+y to ditch y. The real spam filter works really well, and despite public knowledge of '+', it's very uncommonly used.

My email address isn't Fort Knox. Email I don't want just doesn't get past the spam filters; even at peak spam a few years back when I was getting 4000+ illicit messages a month. Complex schemes aren't going to benefit me any because despite publicly posting my email as above, I just don't have a problem with unwanted messages.

Reply on news.ycombinator.com