Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: GitHub now blocks aliased email addresses

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 48 posts

Re: Tell HN: GitHub now blocks aliased email addresses

#31

Post by sam_lowry_ »

function_seven wrote: post #23
iliketrains wrote: post #11

Earlier quoted context omitted.

I do the same as KMnO4 and I think I have never received an email to a random address that I haven't shared before. Currently the biggest volume of spam is coming to adobe@ and github@ (along with some dating sites). Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D

> Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D So something like this? From: bobby@tables.com To: myplanejustlandedcanyoucomepickmeup.thx@lastname.com Subject: Body:

Little Bobby Tables ;-)

You've made my evening!

Re: Tell HN: GitHub now blocks aliased email addresses

#32

Post by geoah »

cgb223 wrote: post #21
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

Do you have to set up a new email address for each website you sign up for or do you have software that automatically handles it? Sounds tedious if it’s the former

1password started doing this with fastmail, ux is not great as it's not easy to create one manually in 1p but only when you're autocompleting your email on a site, but I guess it will improve over time. https://1password.com/fastmail/

Re: Tell HN: GitHub now blocks aliased email addresses

#33

Post by kevincox »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

In practice this isn't very common. In most cases if you block the email that they got a hold of they will just give up rather than trying random addresses.

However it does happen a little. Because it sounded like fun I actually added a signature to my addresses. So it looks like github.com-abcdef@example. Then the spam filter will check the signature and if it is invalid it will give it a high spam weight. (Other than a few widely-published addresses that are accepted at neutral weight)

Re: Tell HN: GitHub now blocks aliased email addresses

#34

Post by bhhaskin »

mynameisvlad wrote: post #28
jasonjayr wrote: post #10

Earlier quoted context omitted.

Using random emails like that is a super easy way of getting caught up in a spam trap, which would get you blocked easily. One of our users used a throwaway a@apple.com, which earned us a complaint inside of an hour, just by sending a welcome/confirm message.

That's not really an issue for end users getting emails at @ , which is what the thread is about.

But it is for spammers. Which is why it doesn't make sense for spammers to do that.

Re: Tell HN: GitHub now blocks aliased email addresses

#35

Post by rOOb85 »

function_seven wrote: post #23
iliketrains wrote: post #11

Earlier quoted context omitted.

I do the same as KMnO4 and I think I have never received an email to a random address that I haven't shared before. Currently the biggest volume of spam is coming to adobe@ and github@ (along with some dating sites). Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D

> Actually, I did receive one, from my friend who typed the entire message in the name before the @ and left the body and subject empty :D So something like this? From: bobby@tables.com To: myplanejustlandedcanyoucomepickmeup.thx@lastname.com Subject: Body:

Reminds me of the classic bob wehadababyitsaboy https:/youtube.com/watch?v=9JxhTnWrKYs

Re: Tell HN: GitHub now blocks aliased email addresses

#36

Post by yunruse »

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

I do this too, but with the domain name instead (eg github.com@lastna.me). That way anything that doesn’t pass the simple glob (.) gets filtered off to the admin account for later checking-over.

Re: Tell HN: GitHub now blocks aliased email addresses

#37

Post by egberts1 »

LOL!

I redefined the '-'/'+' localpart separator of the username/localpart of my fully-qualified email address to be something else (it's a letter).

so, my own mail alias works just fine ... in commercial Git repos and many websites.

Google's GMail lets you use multiple periods as you see fit but that is easily stripped out (to get your username).

Just another cat-n-mouse in computer security.

Might make more sense for GitHub to enforce whitelisting.

more on this local-part separator: https://egbert.net/blog/articles/comparison-of-local-part-in...

(again, my hardened website cannot be viewed on only Chrome clients as these clients remain broken for intentionally ignoring my server-mandated HTTPv1.3/ChaCha-only).

Re: Tell HN: GitHub now blocks aliased email addresses

#38

Post by VancouverMan »

mdasen wrote: post #20
ackatz wrote: post #3

Is this to deter people from using GitHub Actions runners for bad things?

Possibly, but it might be more than that. I have to imagine that GitHub has to fight all sorts of spam. Issues (and comments on issues) in a popular repository can be SPAM. When Hacktoberfest offered a free t-shirt for making a pull request to any repo (regardless of the quality of the PR), maintainers were basically inundated with SPAM. Imagine someone spinning up lots of GitHub accounts to create issues and PRs whi…

This also prevents legitimate bug reports that are being submitted by people (such as myself) who have no interest in using GitHub to begin with, and even less interest in giving GitHub any kind of personal information.

There have been numerous times now where I'd like to quickly provide details about a problem affecting some GitHub-hosted open source project I'm using, sometimes along with a fix. But since I can't easily create a throwaway GitHub account, I'll just end up keeping the information and fix to myself. I wish that wasn't the case.

Re: Tell HN: GitHub now blocks aliased email addresses

#39

Post by egberts1 »

takoid wrote: post #4
KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

How do you prevent someone from spamming you with random usernames? For example: random1@lastname.com random2@lastname.com random3@lastname.com Do you have a whitelist as well?

Whitelist.

Re: Tell HN: GitHub now blocks aliased email addresses

#40

Post by Mountain_Skies »

KMnO4 wrote: post #2

I use an email catch all for everything. github@lastname.com, reddit@lastname.com, randomstore@lastname.com all direct to firstname@lastname.com. I rarely get spam these days, but when I do, I simply block the address and move on.

It's interesting to see who sold your email address by looking at the left side of the address. The most annoying one for me is that the email address I created for registering my transit pass was somehow passed along to a state political party, at which point it ended up on lots of political fundraising lists. Doubt the transit agency sold it to the political party, it was probably someone who worked for them who thought it would be good leads for their particular preferred party. At the other end of the spectrum was the place I used to get my hair cut selling (or losing through poor security) their email addresses to low quality spammer selling "Male performance enhancement" pills.

Most of the time, the email addresses only end up coming from the company they were given to, but a few hacks like LinkedIn continue to produce scams and spam emails.

Post reply on HN