259532 - talkback-public.mozilla.org is helping spammers by publishing valid email addresses

Status: VERIFIED FIXED

(mozilla.org :: Talkback Server & Webtool, task)

Description

[Mats Palmgren (inactive)]

talkback-public.mozilla.org is helping spammers by publishing valid email addresses.

STEPS TO REPRODUCE:
1. go to URL
2. filter out all strings that has @ in them
3. send spam

Please put that data behind a query URL to make it less likely that spiders
can harvest the mail addresses.

Comment 1

[Jay Patel [:jay]]

I'll just take out the email addresses from that report.  If people need to find
out who owns the bugs, they can just go look at the bug itself.  

I've made it a point to not include any user email addresses sent in the
Talkback data for privacy reasons, so other than the bug info at the top, there
shouldn't be any other email addresses to find.

Putting the data behind a query url is something I'll have to look into as a
permanent solution...but that might take a while.

Comment 2

[timeless]

mats: just use an invalid email address like i do :).

jay: i'd rather you just drop the @ sign entirely (replace it with a space, you
can do the same thing to periods). being able to quickly glance through the list
and understand which owners they had is fairly important to me.

Comment 3

[Jay Patel [:jay]]

thanks timeless...i was thinking the same thing actually. it'll be just as easy
to  change the email address format to something like that.  if no one has any
objections, i'll simply replace the at and dot with spaces.

taking bug.

Comment 4

[Mats Palmgren (inactive)]

Well, it's better than nothing I suppose.  Call me paranoid, but I still think
a query URL is a better long term solution.

Comment 5

[Jay Patel [:jay]]

In an attempt to appease both timeless and mats, I have changed the bugstatus
info to only contain the username from the email address.  This way there is no
way to tell which address it is attached to but there is enough info to quickly
know who the owner is.  Hope that works for both of you.

I'm marking this fixed (you will see the results in tommorrow's reports).  When
I find some more time, I will look into the query url solution.

Comment 6

[timeless]

the hazard with that is a number of users have accounts of bugs@ or bugzilla@ or
mozilla-bugs@ hence my suggestion. actually  you might as well s/[^a-z0-9]/ /
that way + and - also become space so there's really no pattern for calculating
the address, although a seasoned bugzilla user could probably recognize the strings.

Comment 7

[Mats Palmgren (inactive)]

Attachment: A suggestion

I'm pretty sure a decent harvester can read my mail address from "mats palmgren

bredband net". However, I don't believe they are sofisticated enough to
understand CSS (yet) though so maybe this is a better solution...
(It requires that you use HTML though)

Comment 8

[timeless]

oh, the other thing you could do is drop the last few letters of the domain

up to 5 letters., be it .com, .co.uk, .tld, .bugs

Comment 9

[Jay Patel [:jay]]

Yeah, I was thinking about converting the entire report into html and using
something like what's suggested here:

http://www.ibeck.com/tools/mailto.php?print=1

Reopening for now.  I'll at least try timeless' idea next week and if I find
some extra time, I will convert the report into html (which I've been wanting to
do for  a while).

Comment 10

[Christian :Biesinger (don't email me, ping me on IRC)]

(In reply to comment #7)
>  so maybe this is a better solution...
> (It requires that you use HTML though)

fwiw mozilla's copy&paste of that does not quite do what you expect. or rather,
while it may do what you expect, it does not do what a normal user would expect ;)

Comment 11

[Mats Palmgren (inactive)]

Thanks for addressing this problem so promptly.  Would it be possible to
remove/regenerate older reports which still has this problem? 
http://talkback-public.mozilla.org/reports/mozilla/M16/smart-analysis.all

Comment 12

[Jay Patel [:jay]]

Thanks for the reminder Mats!  I actually shutdown the generation of the older
releases last week before making this change.  I'll run them this week one more
time (once the Talkback db is back up). 

Comment 13

[Jay Patel [:jay]]

Mats: all the old release reports are running now and I have generated the
latest bugstatus file to include some changes I made.  The email address will be
shown as <username> <domain> without the .com/.net/.etc at the end (actually
just the first word of the complete domain when it's split by .)

Can you take a look at the reports tommorrow to make sure everything looks ok
and then mark this fixed?  Thanks.

Comment 14

[Mats Palmgren (inactive)]

Looks ok now, thanks for fixing this.

-> FIXED

Comment 15

[Mats Palmgren (inactive)]

Attachment: Another suggestion

(In reply to comment #10)
> fwiw mozilla's copy&paste of that does not quite do what you expect.

fwiw, that can be worked around by using klingon ;-)