bug#14811: Debbugs <at> spam countermeasure inadequate

[Glenn Morris]

address@hidden wrote:

> On 2013 April 22 I filed an emacs bug using an email address
> specifically generated for that purpose and used for nothing else.
>
> On 2013 May 18 I started receiving spam messages on that email
> address. The most likely explanation is that an email address
> harvester is overcoming the <at> countermeasure.

I can mainly repeat my comments from

http://debbugs.gnu.org/cgi/bugreport.cgi?bug=13194

I'm sympathetic. I don't like spam, and we should certainly not make it
totally trivial to harvest addresses (like bugs.debian.org does), but I
feel that in this day and age everyone has to expect some spam and have
a method for dealing with it. Based on the data I mention in bug#13194,
it feels to me like the simple "at" solution we have in place eliminates
say ~ 99% of the spam (this is a qualitative feeling).

Emacs bug reports appear on several other sites that are not under our
control, and further obscuring debbugs.gnu.org will have zero impact on
them. For example, the gnu.emacs.bugs newsgroup (how I wish it would go
away), and gmane.org, which uses the same <at> mechanism.

So no matter what we do on debbugs.gnu.org, we cannot promise that
reporting an Emacs bug will never lead to you getting a spam email.
Sorry.

If you want to do an experiment, make another totally new address and
use it to send mail to address@hidden This should not get
sent on to any other site. Then wait and see if that new address gets
spam.

I don't mind tweaking the obscuration method if someone has a
suggestion, but I doubt it will make much difference, for the reasons I
mention above.