Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub now blocks aliased email addresses

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 48 posts

Re: Tell HN: GitHub now blocks aliased email addresses

#11

Post by iliketrains »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

I do the same as KMnO4 and I think I have never received an email to a random address that I haven't shared before. Currently the biggest volume of spam is coming to adobe@ and github@ (along with some dating sites).

Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D

Re: Tell HN: GitHub now blocks aliased email addresses

#12

Post by wkrsz »

takoid wrote: post #7
sigstoat wrote: post #5

Earlier quoted context omitted.

in my experience that sort of "send some spam to addresses we have no reason to believe exist" behavior takes the form of sending stuff to $commonfirstname@domain not $service@domain nobody is sending email to alsdkjfadf@domain

You are right. But I think using a catch all with a separate username for each service/business is becoming an increasingly common practice so I would imagine it’s only a matter of time before spammers catch on and begin exploiting this.

Then we adapt.

Re: Tell HN: GitHub now blocks aliased email addresses

#13

Post by [deleted] »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

[deleted]

Re: Tell HN: GitHub now blocks aliased email addresses

#14

Post by TonyTrapp »

iliketrains wrote: post #11
takoid wrote: post #4

Earlier quoted context omitted.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

I do the same as KMnO4 and I think I have never received an email to a random address that I haven't shared before. Currently the biggest volume of spam is coming to adobe@ and github@ (along with some dating sites). Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D

I do the same and I did receive a few, to some addresses that looked like UUIDs. It was just a handful of addresses, so they were easy enough to block.

Re: Tell HN: GitHub now blocks aliased email addresses

#15

Post by hk1337 »

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

yeah, I started using Fastmail's masked email to create emails for services that route to my inbox. Initially I did it with my email domain then figured because my email domain has my name in it that it seemed semi-pointless so I switched to just using Fastmail's domain.

Re: Tell HN: GitHub now blocks aliased email addresses

#17

Post by ylk »

sigstoat wrote: post #5
takoid wrote: post #4

Earlier quoted context omitted.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

in my experience that sort of "send some spam to addresses we have no reason to believe exist" behavior takes the form of sending stuff to $commonfirstname@domain not $service@domain nobody is sending email to alsdkjfadf@domain

> nobody is sending email to alsdkjfadf@domain

That’s actually the kind of spam I used to receive on a very short domain with a catch-all.

I guess they loop through short domain names and then try to brute-force the local part.

Re: Tell HN: GitHub now blocks aliased email addresses

#19

Post by tablespoon »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

> How do you prevent someone from spamming you with random usernames? For example:

You don't, but spammers don't care that much to do what you describe.

Think like a spammer. Why would a spammer motivated by profit to do that on a small personal domain? It makes sense on large service (e.g. gmail, yahoo, comcast), because they might increase their audience, but on a personal domain they're just going to swamp someone's inbox in a way that makes it even less likely they'd bite.

Re: Tell HN: GitHub now blocks aliased email addresses

#20

Post by mdasen »

ackatz wrote: post #3

Is this to deter people from using GitHub Actions runners for bad things?

Possibly, but it might be more than that. I have to imagine that GitHub has to fight all sorts of spam. Issues (and comments on issues) in a popular repository can be SPAM. When Hacktoberfest offered a free t-shirt for making a pull request to any repo (regardless of the quality of the PR), maintainers were basically inundated with SPAM. Imagine someone spinning up lots of GitHub accounts to create issues and PRs which are basically just SPAM messages about some crypto scam - PRs proposing changing the readme to their message, issues talking about how they could fund themselves with that crypto, etc. Even if they're deleted by 99% of people, they've served their purpose. Someone thinks they should do what the message says and money is made.
Post reply on HN