Forum Moderators: open
What is the best way?
1. Just unlink all email addresses, so those who are REALLY interested in emailing you have to copy or paste into their email program rather than just clicking. This seems to be a sensible wolution at first thought, very easy to implement.
2. USe js, (not sure exactly how to do that) disadvantages.. some non-js enabled set ups wont work with it, and make such users frustrated and think your page is broke!
3. Direct all hyperlinked email addresses to our mail form, or even a new form (system) where the email address appears in the "send to" field when they get there?
Which of these do you suggest, or are there any other quick and dirty solutions?
If you are feeling less technical you could keep the addresses on the page but swap key parts of them for the entity codes e.g. one example of this would be;
mailto:root@example.com
Using 109 as the ascii code for "m", 64 = "@" and 46 = ".", essentially makes pattern matching an email address in page source next to impossible unless you decode the entire page.
This method is not totally foolproof but thankfully 99% of the programs designed to scrape addresses off sites are written for speed rather than complexity and so they wont bother to do the decoding and so wont see something they understand as an email address.
Thankfully most browsers (inc. lynx) understand that the page needs decoding, and so what the user sees makes perfect sense and acts exactly like the original code did!
- Tony
p.s. I have a feeling that there are other variations of the character encoding which may work better than just plain ascii
You can also use something like this: [chepd.mq.edu.au...]
[alicorna.com ]
Since we added this to our pages we haven't had any new spam mail.
ratman
If you only make a small number of important character swaps a real person seeing the raw data will be less puzzled, the only real danger is that if you choose *really* common swap-outs an email scraper could notice that a lot of people swap characters X & Y and with a minor tweak you are vulnerable again!
*If* I designed these sorts of things I'd consider running one replace, possibly two but beyond that the work involved would start to slow that "X,000 a minute" email extractor down a little which would loose me a selling point, which for the sake of getting a handful of unreceptive people would not be worth it.
Why unreceptive?
Simple swaps can be done by anyone (swap @ for <blah>) and so if I were to grab their addresses they might be potentially receptive as they could just have read a tip on how to stop spam which they have used blindly.
But when people start doing complex mungs or swaps then the chances of actually getting a result out of them is going to be really low, plus the chances of them complaining (and complaining to the right people in the right way is increased dramatically) increases a fair bit!
- Tony
I tried looking for other ways to hide the email address but all of the others I found involved the use of Javascript.
I understand your point Dreamquick, and have been looking for an alternative but obfuscating has worked for me and I haven't had any complaints (yet!), so it is an option if nothing else works.
You can also set up your email software or server software to filter out and return any messages containing certain words, but this can obviously backfire. See the following (entertaining) post for some suggestions.
ratman
I've had contact details on my site since day #1 partially obfuscated and I get maybe a piece of spam every month on the those accounts (touch wood).
The main difference is that I also run obfuscation in tandem with a server-side ruleset which returns a gibberish address to anything which is obviously an email harvesting bot so even if they do manage to decode correctly then they get something which is worthless to them. :)
That said, stopping the wrong people getting the address in the first place is only half the game - you need to make their lives that little harder if they manage to deliver spam. This should discourage people from trying to use that list the next time given how badly the last attempt went.
(Okay fortunately the only address they seem to routinely find ATM is the one for technical and security list subscriptions and so sending spam to those sorts of addresses *guarantees* massive amounts of complaints etc.)
- Tony
<a href="mailto:postmaster@[127.0.0.1]"></a>
...for a little hand-wringing nya ha ha. I'm sure some mail harvesters are clued in, but the thought of even a few getting stuck is satisfying.
If harvested and used this will effectively spam the spammer. :)
I have had success with using a .gif image of the email address (for visual
branding) linked to JavaScript pop-up window that contains the simple mailto
form. The mailto form does contain the actual address but since it is only
linked by JS, this html page is not bot accessible.
Pseudo code:
page:
<script type="text/javascript">foo('ma','inquires','domain')</script>
external file:
function foo (a,b,c) {
document.write('<a href="'+ a + 'il.........);
}
found this link in the generic java script message. it is a javascript to assemble an email address
[hivelogic.com...]
The best method is a contact form, but it's not for all budgets
I can write a simple contact form in 10 minutes. I don't much use them because I find that being presented with a contact form instead of an e-mail address feels less personal. That and I haven't found a browser yet that will let you plug a decent editor into the textarea.
(Hey, programming project - write a plug-in that'll let me embed Emacs in Galeon textareas. As if I didn't have enough projects in mind already.)
Another thing they mentioned was that in order to prevent their program from trapping legitimate SE spiders and the like they add the robots exclusion meta tag to pages generated by the program. From the sounds of it, a lot of the more sophisticated e-mail harvesting softwares are now following the robots exclusion meta tags to avoid running into one of these honeypots. Maybe it's also a good idea to add these tags to your pages with e-mail addresses on them?
ANTI- SPAM PING JPEG MAKER 1.0
Both freeware at [assmaker.mybravenet.com...]
<<script type="text/JavaScript"> var n='user'; var d='domain.tld';
document.write('<a href=\"mailto:' + n + '@' + d + '\">');</script>
user at domain.tld
<script type="text/JavaScript"> document.write('<\/a>');</script>>
Users with JavaScript enabled will see a clickable <user at domain.tld> while other users see at least a <user at domain.tld>, which is not clickable but recognizable, and which I hope is not understandable for spam bots.
Regards,
R.
From what I've read so far in this topic, it sounds like the encoding is not foolproof and that email harvesters are getting much smarter.
I've read all the replies using javascript, contact forms, etc. Is there anyone here who has a surefire way to prevent the harvesting? Is the ascii format not enough?
Is the ascii format not enough?
I used to obfuscate my email address from spam harvesters by separating the email address inside table elements. Like "firstname" in one TD../TD followed by "@domain.com" in the next TD../TD. That worked well for a couple years, but during the last year, spam is worsening anyway. I wonder if anyone here can comment about that, whether harvesters are known to be able to figure that out.
Anyway, I've changed recently to do this:
' firstname "@" domain.com ', which requires even more thought, unfortunately, and probably fools too many humans too. I'm starting to like the ".gif" idea more and more.
[OT: The first time I talked to my current boss about making web pages more friendly to the disabled, she assumed I was talking about stuck-in-a-wheelchair type disabilities, and couldn't figure out why all these things were more important to disabled users. She's on-board now that she knows what I'm talking about, though.]
Thanks again.
Jim
