Spammers have started abusing other application to send their spam. This works like this:

The application has some form that allows to send e-mails to arbitrary users. This can be something like a newsletter sign-up with a double-opt in, a registration confirmation e-mail (or even password reset e-mail), or something similar.
The e-mail also includes some reflected text. For example, a user may be able to give their name, and the name is used within the e-mail. The spammer will then abuse that text to include his advertisment.

Potential counter measures are:

Add a captcha.
Rate limit the sign-up or password-reset.
Do not reflect arbitrary text.

Tobias Kraze

makandra.de

Say thanks

Last edit

Over 5 years ago

Tobias Kraze

License

Source code in this card is licensed under the MIT License.

Delivering Carrierwave attachments to authorized users only

Preparation

To attach files to your records, you will need a new database column representing the filename of the file. To do this, add a new migration (rails g migration <name>) with the following content:

class AddAttachmentToNotes...

Async control flow in JavaScript: Promises, Microtasks, async/await

Slides for Henning's talk on Sep 21st 2017.

Understanding sync vs. async control flow

Talking to synchronous (or "blocking") API

print('script start')
html = get('/foo')
print(html)
print('s...

Posted by Tobias Kraze to makandra dev (2019-01-21 08:14)

How not to turn your application into a spam relay

Related cards:

Preparation

Understanding sync vs. async control flow

Talking to synchronous (or "blocking") API

Introduction

Summary