[ciroduran]

I stopped being concerned about email harvesting years ago, I just simply leave the email on my website. Spam handling is okay enough, I guess.

But I like this review of techniques, even the simplest ones are very effective, that surprised me.

[jrmg]

I’ve had my email address in a `mailto:` link in plaintext on my then-web-site, now-blog, since the early 2000s, and spam is no real problem. There are a few spam messages in my spam mailbox per day.

Perhaps my provider’s just great at filtering spam - but I kind of doubt it’s better than the major players (for years I’ve used Zoho for email - and it’s ‘okay’ enough that it’s not worth switching).

[GeoSys]

I agree that email addresses get leaked eventually.

However, LLMs are quite good at generating spam and I think soon will evade most filters.

[BorisMelnik]

you know what's funny is that llms are also good at detecting spam as they are generating it. I've got an automation that scores incoming emails and it's getting better and better each day (also more expensive haha)

[SV_BubbleTime]

I can’t explain it well, but I think there is an asymmetric issue here… that the ability for an LLM to write a plausible email, and the ability for an LLM to detect that it’s spam are mismatched.

If an LLM and make a plausible email, the best another LLM can do is to rank it as plausible. Blackbox creation and detection have to be on the same level.

Perhaps if you said the detection LLM had all your context and websearch. That it could know that a Penny Pollytree at Coco Co isn’t a real person, but… that just seems like burning a ton of coal to detect fraud where the creation LLM was able to easily come up with the fictitious spam cheaply.

The real story here is this will go beyond email verification. That every system we have is going to need to up its security. Paper birth certificates and social security cards and email addresses and all manner of identity is going to need new systems of auth. The challenge will be to prevent authoritarian centralization.

[Anamon]

But I think there's also an asymmetry strongly favouring the defense, namely that for a spam mail to be worthwhile, it needs some call to action, a way to lure in the victims.

A link to a shady website, an infected attachment, a weird freemail address in the body or Reply-To header that doesn't match the forged From header, etc. They're trying to get cleverer for sure -- I started getting phishing mails where the malicious link is only in a QR code in an embedded image -- but I think the need to somehow link to the trap is an inherent weakness against any defense. SpamAssassin rules give a good overview of stuff that help detection no matter how the rest of the mail is generated.

[Gigachad]

I doubt it. Most of the signals spam filters use these days are reputation based. You have to build up your domain and IP reputation for a long time first.

[embedding-shape]

> You have to build up your domain and IP reputation for a long time first.

Or buy/rent domains/IPs that have good reputations, as there are services that specializes in just bringing up the reputation for stuff so they can sell it once "good". Same exists for user accounts for various platforms like reddit and so on.

[Gigachad]

Sure, you'd burn that reputation extremely fast as Google detects your sending patterns change and the first few users start reporting as spam.

[embedding-shape]

> you'd burn that reputation extremely fast

Yes, that is indeed the point of those; "build up reputation -> sell/rent -> someone uses it to burn reputation -> rinse and repeat".

[Cthulhu_]

And so the arms race continues.

[e40]

I’m up to more than 1,500 spam emails a month, with my email on the corp website.

[janderson215]

Is it mostly people trying to give you their mixtapes?

[unilynx]

> But I like this review of techniques, even the simplest ones are very effective, that surprised me.

because harvesters don't care until one technique gets massive use. if you come up with a unique but simple enough scheme for your sites and keep a few dozen email addresses out of their reach.. they've still gathered a million addresses. it's not really worth their effort to get the last 0.0001% of extra email addresses

so it's best to just not advertise your solution and make sure it doesn't get n any outside traction - if it gets popular the harvesters will defeat it

[jmaw]

The author of the article mentioned that they are using it as a honeypot to detect when bots (or rather authors of the bots) implement a work-around for the obfuscation technique. Which is pretty smart!

[kevincox]

I've also been like this. But if as the article suggests trivial options like HTML entities or elements with display:none will keep my email out of >90% of harvesters I'm reconsidering as they seem to have no downside other than an extra couple of bytes on the wire.

[Yaggo]

Same here, the address will eventually leak some way anyway.

I never got SpamAssassin working very well, but since moving my email hosting to Apple (from my own server), spam has not been a problem.

[blitzar]

I swear my apple hosted mail spam filter works in reverse. The inbox is full of spam and the legitimate messages (including apple billing notifications) in the spam folder.