37

Received this email:

enter image description here

Link sent me to https://false-mammal.glitch.me/

enter image description here

If this is truly your research then please put it under the SO domain. Otherwise it looks like a phishing attack and may cause the originating email to be flagged as spam.

  • When exactly did you get this email? When was it sent? – Shadow The Curly Braced Wizard Aug 28 '18 at 22:19
  • What makes you think that this originated from SO in the first place? Based on your observations of the domain name, it's likely it had nothing to do with SO at all. – Jason Bassford Aug 28 '18 at 22:20
  • @stackoverflow.email is the email address we use for this sort of thing and this is a project we're working on. – Catija Aug 28 '18 at 22:21
  • 24
    @Catija you're going to get a very poor response among security-aware users. It looks exactly like a classic phishing attack. "From" addresses can be spoofed. Get it under the SO domain, please. – empty Aug 28 '18 at 22:24
  • We're aware of the problem and are looking into it moving forward. My understanding is that the first batch of emails didn't get flagged as phishing, so we're not sure why this one did. – Catija Aug 28 '18 at 22:26
  • 8
    Agreed. This is totally wrong and if they go public with those emails, they risk marking their email domain as spam. (many people might mark those emails as spam/scam.) – Shadow The Curly Braced Wizard Aug 28 '18 at 22:27
  • 12
    @catija I manually identiied it as phishing because I am a security-aware developer. As are most good developers. Too late for me to participate in any case. Emails like that get destroyed. – empty Aug 28 '18 at 22:27
  • @Catija it wasn't flagged as phishing by Gmail, the OP personally marked it as such. – Shadow The Curly Braced Wizard Aug 28 '18 at 22:31
  • @ShadowtheWelcomingWizard I thought it was possible that it might be legitimate so I didn't flag it as spam but posted here instead to prevent exactly the problem you detailed. – empty Aug 28 '18 at 22:33
  • 2
    Cheers! I edited this to be a feature request. – Shadow The Curly Braced Wizard Aug 28 '18 at 22:40
  • 2
    @empty: I was going to upvote, but your rep is currently 386 and I couldn't bring myself to change it. If I happen to come by when your rep isn't such a nostalgic number, I'll give you a +1. – 3D1T0R Aug 28 '18 at 23:55
  • 1
    @3D1T0R haha! it's safe now. – empty Aug 29 '18 at 2:55
  • 1
    @3D1T0R my first was 486. ;) – Shadow The Curly Braced Wizard Aug 29 '18 at 6:01
  • Heh... Now it's 488, and I'm tempted to downvote to make it 486, but I know it'll change again, and by then I won't be able to change my vote unless you edit the Q, so I guess I'll give you your well deserved upvote now. (P.S. @ShadowtheWelcomingWizard: My first was also a 486, but even if it wasn't my first, 386 is still a nostalgic number to me.) – 3D1T0R Aug 30 '18 at 1:11
  • 1
    8086 was my first. Yeah, I'm that old. – empty Aug 30 '18 at 15:40
16

Thanks for the report, empty.

This e-mail is from us and we are in control of the URL you posted.

You're right, we should've taken a bit more care here. Unfortunately the deed's done on this cohort of participants. We'll do better on the next group in two weeks.

Sad Update (2018-09-25): Unfortunately we weren't able to move this from glitch to Stack Overflow infrastructure. Stack Overflow's infra is very heavy for short-term data labeling/collection tasks like these which is why we built this on glitch in the first place. When we tallied up the costs of retrofitting/moving it and the possibility of screwing something up that tainted the data (invalidating some of the work y'all have done) we chose not to. The final cohort of users is being invited today and then next week this code will be retired.

  • 5
    So you'll move it to stackoverflow.com domain? – Shadow The Curly Braced Wizard Aug 29 '18 at 5:59
  • 2
    And maybe you could use OAuth so people don't have to login? – empty Aug 30 '18 at 15:42
  • 2
    I just got an email about this... Linking to periodic-baseball.glitch.me. TL;DR: Nothing's changed. – Cerbrus Sep 25 '18 at 12:15
  • @Cerbrus: Yeah that's correct. Unfortunately we weren't able to make it any better as none of the options were appealing. Stack Overflow's infrastructure is very heavy for one off data labeling/collection tasks like these. That's why we built it on glitch in the first place (no builds, no migrations, no possibility of borking Stack Overflow proper). SRE is working on a project to make things like this easier, but it's 6 months out minimum. – Jason Punyon Sep 25 '18 at 13:00
  • 1
    Couldn't SE host a kind of proxy / alias, then? Or would that require too many hoops to be jumped? – Cerbrus Sep 25 '18 at 13:03
  • Can you please put a status tag on this request? – Sonic the Bracketed Hedgehog Sep 25 '18 at 13:10
  • @Cerbrus: Maybe something like that could've worked (I've got security bells going off in my head about your particular suggestion) but this code's only gonna live another week, so almost any hoops are too many hoops. – Jason Punyon Sep 25 '18 at 13:18
  • @SonictheInclusiveWerehog: Done. – Jason Punyon Sep 25 '18 at 13:19
  • I got a link to actually-voyage.glitch.me today for this. Weird URL for sure. – Alexis Olson Sep 25 '18 at 21:02
  • @JasonPunyon Would a comments 86400 IN CNAME false-mammal.glitch.me. on the stackoverflow.com DNS not work? – ArtOfCode Sep 25 '18 at 23:48
  • @ArtOfCode That's fine DNS, but it would also leak stack overflow session cookies to glitch. – Jason Punyon Sep 26 '18 at 0:26
  • @AlexisOlson We are in control of that URL. – Jason Punyon Sep 26 '18 at 0:27
  • 2
    That is indeed a problem... What if you did it on the stackoverflow.blog or .email domains? Still clearly SO-controlled, but no session leakage. – ArtOfCode Sep 26 '18 at 0:29
  • Reading this answer before reading the original question makes for a very good volte-face when you read the OP's handle. – Félix Gagnon-Grenier Sep 26 '18 at 5:01
  • @JasonPunyon Given that they want SO authentication anyway, why would that be a problem? – Bergi Sep 26 '18 at 18:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .