xml-dev - URNs and SPAM

[Paul Prescod <paul@prescod.net>]

John Cowan noted that an email-based URN mechanism could be harvested by
both current and future spam-address collectors. There are three possible
levels of defence that could be used separately or combined:

 1. don't worry about it. We'll have other URN mechanisms soon and today's
harvesters won't recognize urn:urn-22:foo@bar.com:blah anyhow.

 2. Slightly obfuscate the syntax: e.g. change the "@" to a ":" Perhaps
reverse the order of the domain name and the user name.

 3. Massively obfuscate the syntax: use crypt. Even URN-smart bots won't
be able to uncrypt them. Downside: this is complex and there is a really,
really really, tiny chance of two email addresses generating the same
crypted text.

I am leaning toward option 2. By the time spammers have heard of "URNs"
and figured out that some have email addresses in them we will have a
bunch of other URN-definition mechanisms. They will probably be harder to
use but will not have this particular flaw. Those who are worried about
the flaw can use those other mechanisms. And of course we can update the
spec. if it became a problem anyhow.

-- 
 Paul Prescod  - ISOGEN Consulting Engineer speaking for only himself
 http://itrc.uwaterloo.ca/~papresco

"Silence," wrote Melville, "is the only Voice of God." The assertion,
like its subject, cuts both ways, negating and affirming, implying both
absence and presence, offering us a choice; it's a line that the Society
of American Atheists could put on its letterhead and the Society of
Friends could silently endorse while waiting to be moved by the spirit
to speak. - Listening for Silence by Mark Slouka, Apr. 1999, Harper's

xml-dev: A list for W3C XML Developers. To post, mailto:xml-dev@ic.ac.uk
Archived as: http://www.lists.ic.ac.uk/hypermail/xml-dev/ and on CD-ROM/ISBN 981-02-3594-1
To (un)subscribe, mailto:majordomo@ic.ac.uk the following message;
(un)subscribe xml-dev
To subscribe to the digests, mailto:majordomo@ic.ac.uk the following message;
subscribe xml-dev-digest
List coordinator, Henry Rzepa (mailto:rzepa@ic.ac.uk)