Re: [My e-mail address in gcc-bugs mailing list archive]

[Christopher Faylor <me@cgf.cx>]

On Mon, Feb 28, 2005 at 09:57:59AM -0800, Jason Molenda wrote:
>Hi all, sorry for not following the discussion too closely...
>
>Yeah, I know mhonarc can be configured to do all sorts of munging on
>the contents of messages.  I haven't looked at it recently (I've been
>meaning to update the version on sourceware for a year or two now...
>sigh), but we're not treading new ground here.
>
>On Mon, Feb 28, 2005 at 12:44:06PM -0500, Christopher Faylor wrote:
>
>>Actually, if we munged everything consistently, we could provide an
>>interface which gave you raw email addresses again, if you knew the
>>secret handshake.
>>
>>Perhaps Jason Molenda would like to comment on this interesting new
>>idea that I have just invented now, off the top of my head, without any
>>prior knowledge of anything which could potentially have been done
>>before...
>
>Hehe, yeah, as Chris implies, the "get raw text" cgi-mechanism that all
>the mailing list archives use does its munging on the fly; the files on
>disk are stored unmunged.  Right now it only munges addresses in
>headers; it would have to be modified by hand to munge addresses in the
>body of messages.
>
>But Chris, I'm not sure what you're impling here?  An option to the cgi
>script that would NOT munge the headers?  Surely that would be
>exploitable by spammers, wouldn't it?  Sounds like security through
>obscurity to me.  Not a good plan, that.  nomunge=1.

I wasn't exactly sure what I was implying either.  I guess it was
something like a "nomunge=1" option, the theory being that spammers
wouldn't be following the gcc mailing list where this setting could be
announced.

It is security-through-obscurity but it's similar to the current spam
blocking system.  A spammer just has to subscribe themselves to the
global-allow list if they want to spam mailing lists but I haven't seen
any clear indication of anyone doing that yet.  Having to special case
something like this seems to be contrary "send millions of emails to get
one response" economy that spammers use.  If they have to do research
to figure out how to spam or scrape this one mailing list, it doesn't
seem like that will be a very common thing.

Even if it was common, it won't be any worse than what we have now and
it should be slightly better.

(of course, I'm sure that all of this has been rabidly discussed on some
spam-related mailing list or newsgroup somewhere)

cgf