Comments on: petitions.pm.gov.uk Leak Your Email Address

By: Andy

Andy — Sat, 05 Jan 2008 00:52:58 +0000

Oh no, Nia; it’s *your* comments, and they fell into *my* spam filter!

I did chop out all of the email before forwarding it to them to try to prevent that, but hey-ho.

By: Nia

Nia — Fri, 04 Jan 2008 20:09:31 +0000

Your email probably fell at the pmo.gov.uk spam filter!

(3rd time lucky? It _feels_ like its been a long two day week!)

By: Nia

Nia — Fri, 04 Jan 2008 20:08:46 +0000

YOUR email even

By: Nia

Nia — Fri, 04 Jan 2008 20:08:26 +0000

You email probably fell that the pmo.gov.uk spam filter!

By: Andy

Andy — Sun, 30 Dec 2007 23:41:29 +0000

Good point on the Hall of Shame – perhaps I expect so little that I so rarely check your site.

I think the filters just eat every html tag that isn’t pre-approved, so it’ll eat things with angled brackets but not html entities. It’s not exactly rocket science but it does the job. You could argue that unknown tags should get escaped and white-listed html tags get left as-is, I suppose.

But as to your original point, I get lots of spam, and I so I see what dictionary words are being used. ‘Sales’ appears to be the only one, along with a load of random personal names. Never any other nouns. I never heard back from the pmo.gov.uk guys, which makes them cretins in my opinion – at least they could have told me to bog off.

By: Sam

Sam — Sun, 30 Dec 2007 21:32:20 +0000

heh, I can beat your filters… The above post should say in the first line “@[redacted].co.uk

By: Sam

Sam — Sun, 30 Dec 2007 21:31:25 +0000

oh god, why on earth do you sanitise

By: Sam

Sam — Sun, 30 Dec 2007 21:29:48 +0000

“Petitions” is a word. It is possible that the spammers are sending to @[redacted].co.uk as this actually happens quite often to domains.

The only way to conclusively prove that it’s the Petitions site that is doing it, is to assign them something that isn’t a real word as an email address. If you want to make it recognisable, by all means use petitions.12Asdfr@[redacted].co.uk but definitely put some random data that will survive a dictionary attack in there.

Side Note: Why haven’t I made it to the Hall of Shame yet?

By: Eddie

Eddie — Thu, 13 Dec 2007 10:21:34 +0000

Peterborough City Council are one of the sources of spam that I know about. They are the only leak that i have caught so far. Its so significant now that the email address given to them will be in my blacklist soon….