38

Received this email:

enter image description here

Link sent me to https://false-mammal.glitch.me/

enter image description here

If this is truly your research then please put it under the SO domain. Otherwise it looks like a phishing attack and may cause the originating email to be flagged as spam.

Improve this question
18
  • When exactly did you get this email? When was it sent?
    – Shadow The GPT Wizard
    Aug 28, 2018 at 22:19
  • What makes you think that this originated from SO in the first place? Based on your observations of the domain name, it's likely it had nothing to do with SO at all.
    – Jason Bassford
    Aug 28, 2018 at 22:20
  • @stackoverflow.email is the email address we use for this sort of thing and this is a project we're working on.
    – Catija StaffMod
    Aug 28, 2018 at 22:21
  • 24
    @Catija you're going to get a very poor response among security-aware users. It looks exactly like a classic phishing attack. "From" addresses can be spoofed. Get it under the SO domain, please.
    – empty
    Aug 28, 2018 at 22:24
  • We're aware of the problem and are looking into it moving forward. My understanding is that the first batch of emails didn't get flagged as phishing, so we're not sure why this one did.
    – Catija StaffMod
    Aug 28, 2018 at 22:26
  • 8
    Agreed. This is totally wrong and if they go public with those emails, they risk marking their email domain as spam. (many people might mark those emails as spam/scam.)
    – Shadow The GPT Wizard
    Aug 28, 2018 at 22:27
  • 12
    @catija I manually identiied it as phishing because I am a security-aware developer. As are most good developers. Too late for me to participate in any case. Emails like that get destroyed.
    – empty
    Aug 28, 2018 at 22:27
  • @Catija it wasn't flagged as phishing by Gmail, the OP personally marked it as such.
    – Shadow The GPT Wizard
    Aug 28, 2018 at 22:31
  • @ShadowtheWelcomingWizard I thought it was possible that it might be legitimate so I didn't flag it as spam but posted here instead to prevent exactly the problem you detailed.
    – empty
    Aug 28, 2018 at 22:33
  • 2
    Cheers! I edited this to be a feature request.
    – Shadow The GPT Wizard
    Aug 28, 2018 at 22:40
  • 2
    @empty: I was going to upvote, but your rep is currently 386 and I couldn't bring myself to change it. If I happen to come by when your rep isn't such a nostalgic number, I'll give you a +1.
    – 3D1T0R
    Aug 28, 2018 at 23:55
  • 1
    @3D1T0R haha! it's safe now.
    – empty
    Aug 29, 2018 at 2:55
  • 1
    @3D1T0R my first was 486. ;)
    – Shadow The GPT Wizard
    Aug 29, 2018 at 6:01
  • Heh... Now it's 488, and I'm tempted to downvote to make it 486, but I know it'll change again, and by then I won't be able to change my vote unless you edit the Q, so I guess I'll give you your well deserved upvote now. (P.S. @ShadowtheWelcomingWizard: My first was also a 486, but even if it wasn't my first, 386 is still a nostalgic number to me.)
    – 3D1T0R
    Aug 30, 2018 at 1:11
  • 1
    8086 was my first. Yeah, I'm that old.
    – empty
    Aug 30, 2018 at 15:40

1 Answer 1

Reset to default
17

Thanks for the report, empty.

This e-mail is from us and we are in control of the URL you posted.

You're right, we should've taken a bit more care here. Unfortunately the deed's done on this cohort of participants. We'll do better on the next group in two weeks.

Sad Update (2018-09-25): Unfortunately we weren't able to move this from glitch to Stack Overflow infrastructure. Stack Overflow's infra is very heavy for short-term data labeling/collection tasks like these which is why we built this on glitch in the first place. When we tallied up the costs of retrofitting/moving it and the possibility of screwing something up that tainted the data (invalidating some of the work y'all have done) we chose not to. The final cohort of users is being invited today and then next week this code will be retired.

Improve this answer
15
  • 5
    So you'll move it to stackoverflow.com domain?
    – Shadow The GPT Wizard
    Aug 29, 2018 at 5:59
  • 2
    And maybe you could use OAuth so people don't have to login?
    – empty
    Aug 30, 2018 at 15:42
  • 2
    I just got an email about this... Linking to periodic-baseball.glitch.me. TL;DR: Nothing's changed.
    – Cerbrus
    Sep 25, 2018 at 12:15
  • @Cerbrus: Yeah that's correct. Unfortunately we weren't able to make it any better as none of the options were appealing. Stack Overflow's infrastructure is very heavy for one off data labeling/collection tasks like these. That's why we built it on glitch in the first place (no builds, no migrations, no possibility of borking Stack Overflow proper). SRE is working on a project to make things like this easier, but it's 6 months out minimum.
    – Jason Punyon
    Sep 25, 2018 at 13:00
  • 1
    Couldn't SE host a kind of proxy / alias, then? Or would that require too many hoops to be jumped?
    – Cerbrus
    Sep 25, 2018 at 13:03
  • Can you please put a status tag on this request?
    – Sonic the Anonymous Hedgehog
    Sep 25, 2018 at 13:10
  • @Cerbrus: Maybe something like that could've worked (I've got security bells going off in my head about your particular suggestion) but this code's only gonna live another week, so almost any hoops are too many hoops.
    – Jason Punyon
    Sep 25, 2018 at 13:18
  • @SonictheInclusiveWerehog: Done.
    – Jason Punyon
    Sep 25, 2018 at 13:19
  • I got a link to actually-voyage.glitch.me today for this. Weird URL for sure.
    – Alexis Olson
    Sep 25, 2018 at 21:02
  • @JasonPunyon Would a comments 86400 IN CNAME false-mammal.glitch.me. on the stackoverflow.com DNS not work?
    – ArtOfCode
    Sep 25, 2018 at 23:48
  • @ArtOfCode That's fine DNS, but it would also leak stack overflow session cookies to glitch.
    – Jason Punyon
    Sep 26, 2018 at 0:26
  • @AlexisOlson We are in control of that URL.
    – Jason Punyon
    Sep 26, 2018 at 0:27
  • 2
    That is indeed a problem... What if you did it on the stackoverflow.blog or .email domains? Still clearly SO-controlled, but no session leakage.
    – ArtOfCode
    Sep 26, 2018 at 0:29
  • Reading this answer before reading the original question makes for a very good volte-face when you read the OP's handle.
    – Félix Gagnon-Grenier
    Sep 26, 2018 at 5:01
  • @JasonPunyon Given that they want SO authentication anyway, why would that be a problem?
    – Bergi
    Sep 26, 2018 at 18:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .