bobince

> Who do you mail when you get spam from mailchimp?

I normally use the link in the X-Report-Abuse header. I invariably get an automated reply immediately (so if this isn't happening for you something must be going wrong; this seems to have been introduced about a year ago).

This is followed by what appears to be a semi-automated response (it varies depending on outcome but the text is usually made up of mostly the same content). I've had human responses from replying to that. (Though there is rarely the need—the initial complaint seems consistently to remove the complaining address from the mailing list, so that campaign stops unless the spammer manually adds the address back. Why doesn't everyone do this? It seems pretty obvious.)

I've also blocked Sendgrid as, despite the occasional response from their abuse contacts, the campaign doesn't stop coming. (I can't get away with blocking Mailchimp in any case as I have users relying on legit mailing lists that use it.)

> the most absurd part is that mailchimp is opt-out by default

I think this is understandable in terms of customers wanting to move mailing lists from one ESP to another without having to re-opt-in every subscriber. I wish there were a better way to manage permissions for mail receipt, but the SMTP infrastructure is made largely of despair and tears.

I've always been able to get a response from replying to the initial response mail. Maybe I've just been lucky to have a different experience to you, but personally I've dealt with few more-responsive ESPs. (And obviously many, many total black holes—or what seems to be the new norm, automated systems completely unable to cope with deliberately malicious users and/or use of multiple accounts.)

Yep. My networks refuse all mail from amazonses, as it is almost entirely spam and the abuse contact is completely unresponsive.

Mailchimp isn't spam-free but it stops the spammer hitting you straight away and has human follow-up for problem cases. If that increases the price of sending mail, so be it.

You might consider prefixing other fields with an apostrophe to avoid them being misinterpreted as numbers or dates.

Unfortunately, even if you put an apostrophe on everything, problems remain:

- the apostrophes are non-standard and assure all other CSV-handling tools get the wrong, apostrophe-prefixed values

- Excel itself doesn't escape fields on output, so if someone loads your exported file into Excel, saves it and reloads it, the exploits come back

Excel is a quite frighteningly terrible tool for handling CSV.

What.cd to me was a live feed of every piece of music released anywhere, tagged well enough that I could go through each week and pick out potentially interesting things I had never heard before.

Whether I actually use the downloads or not, it allowed me to discover new bands, new genres, and music from different cultures that I would never have been able to listen to before. Where is the commercial service that offers anything close to this?

On the other hand, `$('#'+id)` fails when the ID contains dot or other characters that have special meaning in a CSS selector, and `$(selector)` is overloaded with `$(html)` causing common XSS injection issues in apps misusing it. jQuery's “Do What I Mean” philosophy jas introduced as many of its own bugs as it ever fixed in browsers; I wish there were a happy medium.

It turns out storing hashed combinations is barely any stronger than plaintext.

The attacker just has to be successful against one of the combinations (eg characters 1+2+3), which doesn't offer enough combinations to make it a sufficient slow guess even if the password is randomly-chosen; for real user-chosen passwords it falls very quickly. Once the attacker has that it's trivial to leverage to guess other combinations (eg 1+2+4) repeatedly until you have the whole password.

If you have to implement a n-of-m password system, you can't do one-way hashing, so you have to fall back to keeping it encrypted in the database, and keeping the encryption keys separate and more strongly protected (eg in an HSM).

(But yes: n-of-m is generally a bad idea for usability as well as of very doubtful security benefit.)