Jules Verne Forum

<jvf@Gilead.org.il>

JanFebMarAprMayJunJulAugSepOctNovDec 199619971998199920002001200220032004200520062007200820092010

Re: I am sorry to state that the forum has become a target for scammers

From: Marie-Helene Huet (mhhuet~at~Princeton.EDU) <mhhuet~at~Princeton.EDU>
Date: Mon, 16 Aug 2010 04:20:24 -0400
To: Jules Verne Forum <jvf~at~gilead.org.il>

I agree with Norm. Marie-Helene

----- Original Message -----
From: Norman Wolcott <1001~at~atlanticbb.net>
Date: Sunday, August 15, 2010 6:33 pm
Subject: Re: I am sorry to state that the forum has become a target for scammers
To: Jules Verne Forum <jvf~at~Gilead.org.il>

> Right now my option is for no change. Sure I get one or two spams
> a week,
> but I am sure many more are rejected somewhere along the way. Also
> who is to
> say whether JVF was the cause of the spam or some other activity
> of miine on
> the internet? The JVF is an extremely useful site. It can never be
> perfect,
> but revisions which cause its usefulness to declline should be
> carefuly
> weighed against what actual benefits the change might be expected
> to
> produce. Most servers have efficient spam filters including google
> so close
> to home may the best place to look for individuals who are
> gettiing spam
> when no one else is.
>
> I connect to the interenet with my bank, credit card issuers,
> government
> agencies, tax preparers, and numerous others. The only way to
> completely
> protect you email address is never to use it.
>
>
>
>
> ----- Original Message -----
> From: "Nadav Har'El" <nyh~at~math.technion.ac.il>
> To: "Jules Verne Forum" <jvf~at~Gilead.org.il>
> Sent: Sunday, August 15, 2010 3:02 PM
> Subject: Re: I am sorry to state that the forum has become a
> target for
> scammers
>
>
> > On Sat, Aug 14, 2010, Harry Hayfield wrote about "I am sorry to
> state that
> > the forum has become a target for scammers":
> >> Could I ask whether it is possible to remove the e-mail
> addresses from
> >> the
> >> membership roster on the website and only have them available
> to actual
> >> members (with several criteria: for instance member for more
> than 12
> >> calendar months who has posted at least one a week in the first
> year on
> >> purely Vernian topics)?
> >
> > Hi,
> >
> > As the person who (after my father's death) has been looking
> after this
> > mailing list, I thought I should reply and explain the
> situation, as I see
> > it,
> > and look for advice from the forum members.
> >
> > When he set up the forum, my father, Zvi, tried to strike a
> balance
> > between
> > avoiding spam, and keeping the forum open and friendly to
> everyone -
> > current
> > subscribers, potential subscribers, and casual readers.
> >
> > His first order of business was to get rid of the run-of-the-
> mill spam
> > sent
> > to the list. You may not be aware of this (nor should you), but
> the list's
> > address (jvf~at~gilead.org.il) gets literally dozens of spam
> messages a day.
> > To filter these out, he used a simple measure: Whenever non-
> members posts,
> > their post gets held-up until a moderator (which in the last
> couple of
> > years
> > was me) accepts it manually. Moreover, he decided that for
> foiling
> > spammers
> > from subscribing-and-then-spamming, new subscribers will also be
> moderated> for a week.
> >
> > The next spam problem that became apparent was that spammers
> could no
> > longer
> > send mail *through* the list, but could send it directly to
> invidiual list
> > subscribers. They were crawling web sites, including JVF's
> membership
> > roster
> > and the message archive (today spanning 13 years and around
> 13,000
> > messages!)
> > and collecting email addresses they find there. What my father
> did was to
> > use very simple counter-measures to foil these attempts: If you
> look at
> > the
> > forum's archive you'll see that addresses like
> someone~at~somewhere.com were
> > replaced by "someone~at~somewhere.com", while in the membership
> roster,> the "~at~" was replaced by a picture of the "@" symbol. The
> idea was that
> > humans
> > will easily be able to read the email addresses, while spammer's
> robots> couldn't.
> >
> > These counter-measures always had two problems. First, they were
> > vulnerable
> > to improvements in spammer technology: It is possible that
> spammers today
> > have
> > crawlers which understand the phrase "~at~" or images replacing
> "~at~", which
> > they didn't have several years ago. The second problem is that
> it was
> > always
> > vulnerable to human scammers, who can look at the list and
> easily pick out
> > addresses by hand.
> >
> > Before we go around fixing the problem, if at all, we (the forum
> members)> will need to decide what balance we want to strike
> between openness and
> > privacy. I want to raise several issues that can be discussed:
> >
> > 1. Is the membership roster,
> http://jv.gilead.org.il/forum/members.html,> which includes
> names and email addresses (and more), still considered
> > a useful service to the public?
> > I know I've used it in the past to look for an address of an
> individual> forum member. Are people happy to appear on this
> list, or afraid of the
> > consequences of being there?
> >
> > 2. If we attempt some "weak" protection of the roster (e.g., you
> need to
> > be
> > a member first), a dedicated scammer could easily circumvent
> it (by
> > becoming a member) and see the roster anyway. Are we trying to
> avoid> the common case, or avoid any email address leak in any way?
> >
> > 3. Do people consider it important, or desirable, to have email
> addresses> on the forum's archives? The original intention was
> that someone that
> > finds
> > a message, say I find a 5 year old message in Google, could
> easily write
> > to
> > the person who wrote this message.
> >
> > 4. I can "strengthen" the obfuscation of email addresses (on the
> roster
> > and
> > in the archive) to make it harder for spammers to understand
> them. But,
> > if I keep them readable to humans, human scammers will still
> be able to
> > read them, and eventually, spammers will get hold of the
> address. Is
> > this
> > aceeptable, or must we avoid "leaking" email address completely?
> >
> > Finally, I hope that everyone realizes that no matter what kind of
> > protection I set up for email addresses in the roster and
> archive, the
> > moment you actually *post* a message, you are sending your email
> address> to all other members. One of these members might be a
> lurking spammer, and
> > worse - there have been documented cases where virus writers
> specifically> wrote viruses which infect ordinary people's
> machines, and then send every
> > email address that this machine sees to the spammer for future
> use. This
> > way spammers can discover email addresses that have never been
> published> on the Internet, anywhere!
> >
> > Because every counter-measure we come up with can be countered
> back by the
> > spammers (as explained above), in my opinion, the question is
> when do we
> > stop
> > treating email addresses as secrets, and go (back) to treat them
> as
> > completely
> > open. I've been using the same email address for 20 years, so by
> now every
> > spammer on the planet already has it. Whatever spams I get
> (probably
> > several
> > dozens every day) are easily eaten by my spam filter, so why
> should I
> > care?
> > And at the same time, I can remain calm and don't need to worry
> all the
> > time
> > if my address "leaks" or not. It can't leak more than it already
> has ;-)
> >
> > After this introduction, I'll try to summarize the options we
> have, as I
> > see
> > them:
> >
> > 1. Regarding the membership roster, should we:
> > A. Leave it as-is (lightly obfuscated addresses).
> > B. Strengthen the address obfuscation but leave it human-usable.
> > C. Make the roster readable only to members (and spammers who
> become
> > members)
> > D. Delete it altogether.
> >
> > 2. Regarding the list archive, should we:
> > A. Leave it as-is (lightly obfuscated addresses).
> > B. Strengthen the address obfuscation but leave it human-usable.
> > C. Make the addresses readable only to members (this will be
> > difficult...)
> > D. Delete addresses altogether from the archive messages.
> >
> > Am I missing any options? Which option do people prefer?
> >
> > Thanks,
> > Nadav Har'El.
> >
> > --
> > Nadav Har'El | Sunday, Aug 15
> 2010, 6 Elul
> > 5770
> > nyh~at~math.technion.ac.il
> > |-----------------------------------------
> > Phone +972-523-790466, ICQ 13349191 |Windows-2000/Professional
> isn't.> http://nadav.harel.org.il |
>
>
Received on Mon 16 Aug 2010 - 11:20:34 IDT

JV.Gilead.org.il
Copyright © Zvi Har’El
$Date: 2010/08/16 09:00:04 $$