Mailto header and IWP (addendum)

[Patrick Neame-2]

FMSA 8/Mac 10.4 server on Xserve with IWP enabled.

The Go to URL script step provides a workaround to the problem of not  
being able to use the Send Mail script step when users access  
FileMaker databases using IWP. But my research suggests that the  
Mailto: header is regarded favourably being something of a magnet to  
spambots. I can understand that this is indeed a serious consideration  
on a publicly accessible web site that is online all the time.

Should I be worried in this case where our members (IWP clients)  
access our FileMaker server on an occasional basis?

I should add that the user creates a found set, clicks a button which  
calls a looping script. This collects the email addresses across the  
found set and the mailto: header bungs them into the Bcc field. To and  
Cc are left blank.



Patrick Neame
07 957 463 933



_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Tim 'Webko' Booth]

On 21/08/2008, at 7:08 PM, Patrick Neame wrote:

> FMSA 8/Mac 10.4 server on Xserve with IWP enabled.
>
> The Go to URL script step provides a workaround to the problem of  
> not being able to use the Send Mail script step when users access  
> FileMaker databases using IWP. But my research suggests that the  
> Mailto: header is regarded favourably being something of a magnet to  
> spambots. I can understand that this is indeed a serious  
> consideration on a publicly accessible web site that is online all  
> the time.
>
> Should I be worried in this case where our members (IWP clients)  
> access our FileMaker server on an occasional basis?
>
> I should add that the user creates a found set, clicks a button  
> which calls a looping script. This collects the email addresses  
> across the found set and the mailto: header bungs them into the Bcc  
> field. To and Cc are left blank.

Do they have to log in to get to this point?

Cheers

Webko




_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Patrick Neame-2]

Yes

(my original message should read "regarded UNfavourably"!)

On Aug 22, 2008, at 12:06 am, Tim 'Webko' Booth wrote:

>
> On 21/08/2008, at 7:08 PM, Patrick Neame wrote:
>
>> FMSA 8/Mac 10.4 server on Xserve with IWP enabled.
>>
>> The Go to URL script step provides a workaround to the problem of  
>> not being able to use the Send Mail script step when users access  
>> FileMaker databases using IWP. But my research suggests that the  
>> Mailto: header is regarded favourably being something of a magnet  
>> to spambots. I can understand that this is indeed a serious  
>> consideration on a publicly accessible web site that is online all  
>> the time.
>>
>> Should I be worried in this case where our members (IWP clients)  
>> access our FileMaker server on an occasional basis?
>>
>> I should add that the user creates a found set, clicks a button  
>> which calls a looping script. This collects the email addresses  
>> across the found set and the mailto: header bungs them into the Bcc  
>> field. To and Cc are left blank.
>
> Do they have to log in to get to this point?
>
> Cheers
>
> Webko
>
>
>
>
> _______________________________________________
> FMPexperts mailing list
> FMPexperts@...
> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Lorne & Joan Walton]

But the spambots would presumably regard the Mailto: headers favourably.

Eye of the beholder.  ;-)

On Aug 22, 2008, at 1:55 AM, Patrick Neame wrote:

> (my original message should read "regarded UNfavourably"!)

--
Do not worry about your difficulties in mathematics, I assure you that  
mine are greater. [Einstein, Albert (1879-1955)]
Lorne & Joan Walton, Maple Ridge, BC

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[mikel-12]

Patrick,

I'm a bit unclear about the connection between Go To URL and a mailto: header..

The Go to URL script step is internal to FMkr. If Go to URL is
configured to use the mailto: syntax, it will take the information in
that syntax and create a message in your default email client.

A mailto: header is in the html of your web page.

A spambot will look at the html of your web page.

A spambot is unable to see the the contents of the Go to URL script step.

This is my understanding. If it is incorrect, I would appreciate
being corrected.

It is indeed the case that spambots will search for mailto: headers
as well as email addresses on web pages. Has your research indicated
a direct connection between spambots and scripts in FMkr?

To answer your question more directly: I don't think there is a
possibility for spambots to capture information from the mailto:
syntax within a Go to URL script step, therefore there is no need to
be concerned in this case.

Again, if any of this is incorrect, I would appreciate being corrected.

Michael Larson
L&S Computing Resources
UC Berkeley

At 10:08 AM +0100 8/21/08, Patrick Neame wrote:

>FMSA 8/Mac 10.4 server on Xserve with IWP enabled.
>
>The Go to URL script step provides a workaround to the problem of
>not being able to use the Send Mail script step when users access
>FileMaker databases using IWP. But my research suggests that the
>Mailto: header is regarded [un]favourably being something of a
>magnet to spambots. I can understand that this is indeed a serious
>consideration on a publicly accessible web site that is online all
>the time.
>
>Should I be worried in this case where our members (IWP clients)
>access our FileMaker server on an occasional basis?
>
>I should add that the user creates a found set, clicks a button
>which calls a looping script. This collects the email addresses
>across the found set and the mailto: header bungs them into the Bcc
>field. To and Cc are left blank.
>
>
>
>Patrick Neame
>07 957 463 933
>
>
>
>_______________________________________________
>FMPexperts mailing list
>FMPexperts@...
>http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Beverly Voth-2]

Michael, let me see if I can clarify.

    1) if the email address is in a field and NOT plain text on the page
(either static or dynamically placed there from the field contents), then
the email address is NOT visible to anyone (spambots, humans, etc.).

    2) if there is a link that is calling a SCRIPT and it also does NOT have
the email address in the link or as the text of the link, the email address
is also NOT visible.

    3) if a link is "followed" by humans or non-humans AND the script is
calling a Go to URL and never passes the email information back to the
browser, it is *probably* not visible.

    [does the script open the user's email client? If so, it *may* be
possible capture by humans and non-humans.]

I often use an icon of an email and link to a script or other routine to
send the email directly with SMTP, so that the email address is never
exposed.

Beverly


On 8/22/08 12:44 PM, "mikel@..." <mikel@...> wrote
in whole or in part:

> Patrick,
>
> I'm a bit unclear about the connection between Go To URL and a mailto:
> header..
>
> The Go to URL script step is internal to FMkr. If Go to URL is
> configured to use the mailto: syntax, it will take the information in
> that syntax and create a message in your default email client.
>
> A mailto: header is in the html of your web page.
>
> A spambot will look at the html of your web page.
>
> A spambot is unable to see the the contents of the Go to URL script step.
>
> This is my understanding. If it is incorrect, I would appreciate
> being corrected.
>
> It is indeed the case that spambots will search for mailto: headers
> as well as email addresses on web pages. Has your research indicated
> a direct connection between spambots and scripts in FMkr?
>
> To answer your question more directly: I don't think there is a
> possibility for spambots to capture information from the mailto:
> syntax within a Go to URL script step, therefore there is no need to
> be concerned in this case.
>
> Again, if any of this is incorrect, I would appreciate being corrected.
>
> Michael Larson
> L&S Computing Resources
> UC Berkeley
>
> At 10:08 AM +0100 8/21/08, Patrick Neame wrote:
>> FMSA 8/Mac 10.4 server on Xserve with IWP enabled.
>>
>> The Go to URL script step provides a workaround to the problem of
>> not being able to use the Send Mail script step when users access
>> FileMaker databases using IWP. But my research suggests that the
>> Mailto: header is regarded [un]favourably being something of a
>> magnet to spambots. I can understand that this is indeed a serious
>> consideration on a publicly accessible web site that is online all
>> the time.
>>
>> Should I be worried in this case where our members (IWP clients)
>> access our FileMaker server on an occasional basis?
>>
>> I should add that the user creates a found set, clicks a button
>> which calls a looping script. This collects the email addresses
>> across the found set and the mailto: header bungs them into the Bcc
>> field. To and Cc are left blank.
>>
>>
>>
>> Patrick Neame
>> 07 957 463 933
>>
>>
>>
>> _______________________________________________
>> FMPexperts mailing list
>> FMPexperts@...
>> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au
>
> _______________________________________________
> FMPexperts mailing list
> FMPexperts@...
> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Patrick Neame-2]

My research indicated that web pages that are built by the  
inexperienced often contain a "Contact Me" link that uses the HTML  
mailto: header followed by an email address. It is that email address  
that the spambots are able to track down and harvest. Indeed a web  
site that I built for myself a few years ago contained just such a  
link and a little while after I launched it the spam started to pile  
up. (I could cope with this as I had another private email address. At  
least it was private until people at The Crescent Theatre started  
sending round robins with everybody's email address in the To or CC  
fields.)

The useful thing about using the Go to URL script step is that it gets  
round the fact that the Mail To script step doesn't work with IWP. I'm  
starting to develop the IWP side of things quite a bit because it's  
there, it works and it means I don't have to learn PHP or other fancy  
stuff. (I do need to learn some XMLSTXYZ or whatever it is but with  
one specific purpose in mind.) So far nothing in my research has  
indicated a problem with the Go to URL step but I thought it sensible  
to ask the exerts before getting too carried away. Your penultimate  
sentence is therefore most encouraging but if it is incorrect I hope  
someone will let us know.

Patrick Neame
07 957 463 933

On Aug 22, 2008, at 5:44 pm, mikel@... wrote:

> Patrick,
>
> I'm a bit unclear about the connection between Go To URL and a  
> mailto: header..
>
> The Go to URL script step is internal to FMkr. If Go to URL is  
> configured to use the mailto: syntax, it will take the information  
> in that syntax and create a message in your default email client.
>
> A mailto: header is in the html of your web page.
>
> A spambot will look at the html of your web page.
>
> A spambot is unable to see the the contents of the Go to URL script  
> step.
>
> This is my understanding. If it is incorrect, I would appreciate  
> being corrected.
>
> It is indeed the case that spambots will search for mailto: headers  
> as well as email addresses on web pages. Has your research indicated  
> a direct connection between spambots and scripts in FMkr?
>
> To answer your question more directly: I don't think there is a  
> possibility for spambots to capture information from the mailto:  
> syntax within a Go to URL script step, therefore there is no need to  
> be concerned in this case.
>
> Again, if any of this is incorrect, I would appreciate being  
> corrected.
>
> Michael Larson
> L&S Computing Resources
> UC Berkeley
>

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Richard DeShong]

As Beverly Voth mentions:
    [does the script open the user's email client? If so, it *may* be
possible capture by humans and non-humans.]

If the script opens the clients email program, then the email *is* able to
be harvested.  It's just that most harvesters don't include the code to
capture and scrape that data stream.

--
Richard DeShong, Athletic Study Center, UCBerkeley



-----Original Message-----
From: fmpexperts-bounces@...
[mailto:fmpexperts-bounces@...] On Behalf Of Patrick Neame
Sent: Friday, August 22, 2008 11:09 AM
To: fmpexperts@...
Subject: Re: Mailto header and IWP (addendum)

My research indicated that web pages that are built by the  
inexperienced often contain a "Contact Me" link that uses the HTML  
mailto: header followed by an email address. It is that email address  
that the spambots are able to track down and harvest. Indeed a web  
site that I built for myself a few years ago contained just such a  
link and a little while after I launched it the spam started to pile  
up. (I could cope with this as I had another private email address. At  
least it was private until people at The Crescent Theatre started  
sending round robins with everybody's email address in the To or CC  
fields.)

The useful thing about using the Go to URL script step is that it gets  
round the fact that the Mail To script step doesn't work with IWP. I'm  
starting to develop the IWP side of things quite a bit because it's  
there, it works and it means I don't have to learn PHP or other fancy  
stuff. (I do need to learn some XMLSTXYZ or whatever it is but with  
one specific purpose in mind.) So far nothing in my research has  
indicated a problem with the Go to URL step but I thought it sensible  
to ask the exerts before getting too carried away. Your penultimate  
sentence is therefore most encouraging but if it is incorrect I hope  
someone will let us know.

Patrick Neame
07 957 463 933

On Aug 22, 2008, at 5:44 pm, mikel@... wrote:

> Patrick,
>
> I'm a bit unclear about the connection between Go To URL and a  
> mailto: header..
>
> The Go to URL script step is internal to FMkr. If Go to URL is  
> configured to use the mailto: syntax, it will take the information  
> in that syntax and create a message in your default email client.
>
> A mailto: header is in the html of your web page.
>
> A spambot will look at the html of your web page.
>
> A spambot is unable to see the the contents of the Go to URL script  
> step.
>
> This is my understanding. If it is incorrect, I would appreciate  
> being corrected.
>
> It is indeed the case that spambots will search for mailto: headers  
> as well as email addresses on web pages. Has your research indicated  
> a direct connection between spambots and scripts in FMkr?
>
> To answer your question more directly: I don't think there is a  
> possibility for spambots to capture information from the mailto:  
> syntax within a Go to URL script step, therefore there is no need to  
> be concerned in this case.
>
> Again, if any of this is incorrect, I would appreciate being  
> corrected.
>
> Michael Larson
> L&S Computing Resources
> UC Berkeley
>

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au


_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Patrick Neame-2]

Yes, the script does indeed open the user's email client. Just by way  
of further detail, as it loops through the found set it bungs each  
email address into a variable ($email). When it exits after last it  
goes to the Go To URL script step with the result:-

"mailto:?bcc="  & $Email

 From what's been written I'm feeling 90% comfortable about deploying  
this. Unfortunately the text of the message is likely to be different  
each time the script is run so there has to be a hiatus while the user  
types something. This might be anything from "Tonight's rehearsal is  
cancelled" to arrangements for the last night party.

Thanks to everyone who's replied to this question. As far as out  
little organisation is concerned IWP is starting to become a very  
useful feature of FileMaker.


On Aug 22, 2008, at 9:10 pm, Richard DeShong wrote:

> As Beverly Voth mentions:
>   [does the script open the user's email client? If so, it *may* be
> possible capture by humans and non-humans.]
>
> If the script opens the clients email program, then the email *is*  
> able to
> be harvested.  It's just that most harvesters don't include the code  
> to
> capture and scrape that data stream.
>
> --
> Richard DeShong, Athletic Study Center, UCBerkeley
>
>
>
> -----Original Message-----
> From: fmpexperts-bounces@...
> [mailto:fmpexperts-bounces@...] On Behalf Of  
> Patrick Neame
> Sent: Friday, August 22, 2008 11:09 AM
> To: fmpexperts@...
> Subject: Re: Mailto header and IWP (addendum)
>
> My research indicated that web pages that are built by the
> inexperienced often contain a "Contact Me" link that uses the HTML
> mailto: header followed by an email address. It is that email address
> that the spambots are able to track down and harvest. Indeed a web
> site that I built for myself a few years ago contained just such a
> link and a little while after I launched it the spam started to pile
> up. (I could cope with this as I had another private email address. At
> least it was private until people at The Crescent Theatre started
> sending round robins with everybody's email address in the To or CC
> fields.)
>
> The useful thing about using the Go to URL script step is that it gets
> round the fact that the Mail To script step doesn't work with IWP. I'm
> starting to develop the IWP side of things quite a bit because it's
> there, it works and it means I don't have to learn PHP or other fancy
> stuff. (I do need to learn some XMLSTXYZ or whatever it is but with
> one specific purpose in mind.) So far nothing in my research has
> indicated a problem with the Go to URL step but I thought it sensible
> to ask the exerts before getting too carried away. Your penultimate
> sentence is therefore most encouraging but if it is incorrect I hope
> someone will let us know.
>
> Patrick Neame
> 07 957 463 933
>
> On Aug 22, 2008, at 5:44 pm, mikel@... wrote:
>
>> Patrick,
>>
>> I'm a bit unclear about the connection between Go To URL and a
>> mailto: header..
>>
>> The Go to URL script step is internal to FMkr. If Go to URL is
>> configured to use the mailto: syntax, it will take the information
>> in that syntax and create a message in your default email client.
>>
>> A mailto: header is in the html of your web page.
>>
>> A spambot will look at the html of your web page.
>>
>> A spambot is unable to see the the contents of the Go to URL script
>> step.
>>
>> This is my understanding. If it is incorrect, I would appreciate
>> being corrected.
>>
>> It is indeed the case that spambots will search for mailto: headers
>> as well as email addresses on web pages. Has your research indicated
>> a direct connection between spambots and scripts in FMkr?
>>
>> To answer your question more directly: I don't think there is a
>> possibility for spambots to capture information from the mailto:
>> syntax within a Go to URL script step, therefore there is no need to
>> be concerned in this case.
>>
>> Again, if any of this is incorrect, I would appreciate being
>> corrected.
>>
>> Michael Larson
>> L&S Computing Resources
>> UC Berkeley
>>
>
> _______________________________________________
> FMPexperts mailing list
> FMPexperts@...
> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au
>
>
> _______________________________________________
> FMPexperts mailing list
> FMPexperts@...
> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Jonathan Fletcher]

On Aug 23, 2008, at 9:06 AM, Patrick Neame wrote:

> As far as out little organisation is concerned IWP is starting to  
> become a very useful feature of FileMaker.


Web purists turn up their noses at IWP, but there is no easier--or  
faster--way in the world to put up a complex data driven site.

--
Jonathan Fletcher
jfletch@...
Project Foreman
NewMedia Construction Co.


_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Patrick Neame-2]

You're right and, although it's not without it's glitches, these are  
pretty easily addressed. Even my Access using brother in law is  
mightily impressed. The Instant Web publishing guide from FileMaker is  
very helpful.


On Aug 23, 2008, at 3:18 pm, Jonathan Fletcher wrote:

> On Aug 23, 2008, at 9:06 AM, Patrick Neame wrote:
>
>> As far as out little organisation is concerned IWP is starting to  
>> become a very useful feature of FileMaker.
>
>
> Web purists turn up their noses at IWP, but there is no easier--or  
> faster--way in the world to put up a complex data driven site.
>
> --
> Jonathan Fletcher
> jfletch@...
> Project Foreman
> NewMedia Construction Co.
>
>
> _______________________________________________
> FMPexperts mailing list
> FMPexperts@...
> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Beverly Voth-2]

On 8/23/08 10:18 AM, "Jonathan Fletcher" <jfletch@...> wrote
in whole or in part:

> On Aug 23, 2008, at 9:06 AM, Patrick Neame wrote:
>
>> As far as out little organisation is concerned IWP is starting to
>> become a very useful feature of FileMaker.
>
>
> Web purists turn up their noses at IWP, but there is no easier--or
> faster--way in the world to put up a complex data driven site.

Now, Jonathan! I'm a web developer and proud of it. I'm also a internet
hosting company.

I use IWP and I set up IWP for clients. It's great at what it does with
relatively little fuss. I use it as far as the product will go. If IWP is
not sufficient, there are other options.

When users get on a list and *complain* that IWP doesn't do what they want,
I draw the line in the sand and hope that the solution is:

    1) cross-over to use plug-ins to enhance the IWP (in this case an SMTP
plug-in to bypass email client)
    or
    2) cross-over to make it CWP (which may have SMTP built-in)

Patrick was given options within the scope of using IWP. If that is NOT
secure enough, one hopes he can cross-over. One would also hope that the
noses don't turn northward with whatever choice he makes. ;D

--
Beverly Voth                       Tier3 Data & Web Services Group, LLC
606-864-0041                            http://www.tier3web.com/xml.htm

             Web Design & Hosting * Apple: CAN, ACN & ADC
   Certified FileMaker 7 & 9 Developer * FileMaker Business Alliance
    Coldfusion, Witango, PHP, MS SQL, MySQL, FMP, XML/XSLT, CSS
   Over 14 years experience integrating databases and the internet!


_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

[Jonathan Fletcher]

I did say "purists." Obviously well-rounded web professionals such as  
yourself understand the strengths and weaknesses of the various  
options. I was merely referring to those who complain that IWP is not  
good because it won't do this or that. I think it does a LOT and I  
have come to feel it's underrated--by some who won't see it for the  
uniquely impressive solution that it is.

j.



On Aug 23, 2008, at 1:08 PM, Beverly Voth wrote:

> On 8/23/08 10:18 AM, "Jonathan Fletcher"  
> <jfletch@...> wrote
> in whole or in part:
>
>> On Aug 23, 2008, at 9:06 AM, Patrick Neame wrote:
>>
>>> As far as out little organisation is concerned IWP is starting to
>>> become a very useful feature of FileMaker.
>>
>>
>> Web purists turn up their noses at IWP, but there is no easier--or
>> faster--way in the world to put up a complex data driven site.
>
> Now, Jonathan! I'm a web developer and proud of it. I'm also a  
> internet
> hosting company.
>
> I use IWP and I set up IWP for clients. It's great at what it does  
> with
> relatively little fuss. I use it as far as the product will go. If  
> IWP is
> not sufficient, there are other options.
>
> When users get on a list and *complain* that IWP doesn't do what  
> they want,
> I draw the line in the sand and hope that the solution is:
>
>    1) cross-over to use plug-ins to enhance the IWP (in this case an  
> SMTP
> plug-in to bypass email client)
>    or
>    2) cross-over to make it CWP (which may have SMTP built-in)
>
> Patrick was given options within the scope of using IWP. If that is  
> NOT
> secure enough, one hopes he can cross-over. One would also hope that  
> the
> noses don't turn northward with whatever choice he makes. ;D
>
> --
> Beverly Voth                       Tier3 Data & Web Services Group,  
> LLC
> 606-864-0041                            http://www.tier3web.com/ 
> xml.htm
>
>             Web Design & Hosting * Apple: CAN, ACN & ADC
>   Certified FileMaker 7 & 9 Developer * FileMaker Business Alliance
>    Coldfusion, Witango, PHP, MS SQL, MySQL, FMP, XML/XSLT, CSS
>   Over 14 years experience integrating databases and the internet!
>
>
> _______________________________________________
> FMPexperts mailing list
> FMPexperts@...
> http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au

--
Jonathan Fletcher
jfletch@...
Project Foreman
NewMedia Construction Co.


_______________________________________________
FMPexperts mailing list
FMPexperts@...
http://lists.ironclad.net.au/listinfo.cgi/fmpexperts-ironclad.net.au