I'm not sure his method would prevent a headless scraper like CasperJS or PhantomJS from doing the dirty work, but nice technique nonetheless.
How to get gmail.com banned (2011)
21–30 of 65 posts
Re: How to get gmail.com banned (2011)
#22This reminds me of the sites that discouraged hotlinking by examining Referer and then sending Goatse.
Re: How to get gmail.com banned (2011)
#23Earlier quoted context omitted.
Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.
Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…
I had a first.m.last@university.edu (though I have a really common name so it was actually first.m.last.3@university.edu), but fortunately they also gave us 8 character usernames (which were also our login to our shared hosting on the Sun E6500 machine), but I never used the long form since it was rejected nearly everywhere.
Re: How to get gmail.com banned (2011)
#24Here's a list of disposable email domains if you'd really like to block them: https://github.com/lavab/disposable I would go one step further and look for {spam_words} in "username+{text}@{googledomain}.com", where spam_words can be "junk", "spam", etc. This is like a very narrow edge case, but still might catch something. Again, if you're into that kind of thing; I'm quite skeptical that it brings any value.
until you have a the german guy, Joseph Unker, with junker89@gmail and your validation prevents them signing up :)
Or Dick van Dyke.
Re: How to get gmail.com banned (2011)
#25A few years back we came into work one morning to find that some bot was scanning our site so hard that it seemed the lights nearly dimmed. Some detective work suggests that it was a service performed on behalf of a competitor, to get our price list (bear in mind that our catalog has a few hundred thousand products). We were really annoyed that rather than just ask us, they had launched what amounted to a DDOS attack…
Probably written in ruby - most crap code is!
Re: How to get gmail.com banned (2011)
#26"Thousands of people use Mailinator everyday, so clearly, its a useful tool that many sites accept" How many of you would have an outright revolt on your hands from your QA/QE folks if you banned mailinator? I think everyplace I worked would experience this same issue if we did this.
Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.
This is how we do it, with a predefined string after the first plus. Makes it easy to prune test accounts from the members db.
Re: How to get gmail.com banned (2011)
#27Earlier quoted context omitted.
Could use + in the first part of email such as: youremail+blahblah@example.com to create throwaways. most sites consider those to be different email address then youremail@example.com for account purposes but email service, who respect the rfc, will threat them as the same.
Many sites won't accept email addresses with + in them, because many devs have extremely wrongheaded ideas about validation. I used to have a first.m.last@university.edu address and that one was touch-and-go as well due to the fact that the mailbox had two .'s in it. I actually had to file a support request to get Amazon Student to accept it, even. Nobody from a university with that scheme ever registered before? For…
My favorite is e-mails with three dots in them. Which is actually not a valid address - the RFC specifies that you must have a valid textual character between dots[1]. However, because of poor decisions by Japanese telcoms, a substantial chunk of their users have 'e-mails' associated with their mobile phones with three dots, breaking goddamn every sensible validation script.
Re: How to get gmail.com banned (2011)
#28One way to get around a domain blacklist is to point your own domain to Mailinator. Heck, since last year you can even get your own private Mailinator...
http://mailinator.blogspot.com/2014/10/mailinator-launches-p...
Re: How to get gmail.com banned (2011)
#29Wow. Do my daily HN scan for the day and find an article you wrote ~4 years at #1. I hadn't read that in many years, and what fun to do a re-read. Thanks Internet - don't stop being you.
I was sad to see that the link to the domain generator was broken. The new one on the home page is a div that's generated server-side. I hope you don't mind that I wrote a quick one-liner to see if you're still detecting bots... @bobmail.info @zippymail.info @thisisnotmyrealemail.com @spamhereplease.com @safetymail.info @suremail.info @mailinator2.com @spamherelots.com @mailinator2.com @spamhereplease.com @spamherelo…
I saw the same, but just by refreshing a bunch of times.
Re: How to get gmail.com banned (2011)
#30A few years back we came into work one morning to find that some bot was scanning our site so hard that it seemed the lights nearly dimmed. Some detective work suggests that it was a service performed on behalf of a competitor, to get our price list (bear in mind that our catalog has a few hundred thousand products). We were really annoyed that rather than just ask us, they had launched what amounted to a DDOS attack…
I built a system called caltrops that did almost exactly that. As a given session's requests grew more and more suspicious, their data would skew from reality further and further. A real user on the line would notice immediately (and the more real-looking the user interactions, the more it would reduce suspicion), but competitors scraping our data would get pretty deliciously bunk data.
to deal with similar problems, kickstarter built a pretty useful tool called rack-attack https://github.com/kickstarter/rack-attack