Comments and Code – Obfuscator 2

As part of my ongoing online response to some great questions, I offer the following request by Colin Kuskie, webmaster for the Sunset Presbyterian Church:

How can I say no to a request like that? So I emailed Colin back with the response “… Colin, stop it, my ego is already ‘well maximized’ enough!” … Actually, that’s not what I said, but I thought it might be fun to share a little opera singer humor with you. Go ahead, ask your minister of music about their well-optimized ego … but I digress …

Actually, my first response to Colin was “Macro? For what system?.” This wasn’t out of any suspicion, but more out of curiosity, and more out of concern that my original obfuscator hack wouldn’t integrate all that well as it was built into an online form generated using CGI.PM. Colin responded that he intends to integrate the code behind the Mean Dean Anti-Spam E-Mail Obfuscator(MDA-SE-MO) into a macro for a Perl-based content manglement system (CMS) named WebGUI. A robust system I’ve played with once or twice before, but don’t let my ease-of-use fool you. This is one CMS that requires you know Perl, paths and your site map before you go shooting your foot off of with it … but I digress …

CMS sorties aside, Colin’s question reminded me of this sage advice she’d offer whenever I’d leave the house: “make sure you have on clean underwear.” Not that it would help if the last thing I ever saw was an oncoming cement truck … but I digress …

So, if I’m going to put my code ‘out there,’ I had better tidy it up a bit, and put it into a easy to deploy, use and maintain Perl module. This way, he could use it for WebGUI, and I could use it for an upcoming MovableType plug-in … unless one of you kind souls comes up with it first … but I digress …

I also figured if I as going to put it ‘out there,’ I might as well add an option that might really, truly drive spammer’s nutzo … that is to render the hyperlink as inline javascript. Yes, I know 12% of all browsers have Javascript disabled, but then again, how many people using wGet or Curl are actually interested in sending me email? That said, it is for such reasons that I have in the past advocated including a form-based email solution on your church or charity website. All the more so if you’re going to use the inline javascript option on Obfuscator … but perhaps this tangent is better left as a topic for later discussion?

Anyway, below is the code for the new perl module behind the slightly improved online demonstration of the MDA-SE-MO:

Obfuscator.pm (now javascript flavored (optionally))
</p> <p>package Obfuscator;<br /> ##############################################################<br /> # Obfuscator (c) 2002-2003 #<br /> # Dean Peters #<br /> # http://www.healyourchurchwebsite.com/obfuscator/ #<br /> # #<br /> # use Obfuscator; #<br /> # print “Problems? Questions? “. #<br /> # OB_encode( “obfuscater\@healyourchurchwebsite.org”, #<br /> # “drop me a line.”, #<br /> # “Problem? Praise? Email Me”, true); #<br /> # #<br /> ##############################################################<br /> # This package obfuscates email #<br /> ##############################################################</p> <p>require Exporter;<br /> @ISA = qw(Exporter);<br /> @EXPORT = qw(OB_encode OB_validmail);</p> <p>use vars qw($volumes $books $versions);</p> <p>sub OB_encode {<br /> my($email, $prompt, $title, $usejs) = @_;</p> <p> # return if email doesn’t validate<br /> return if( $email !~ /[\w\-\[\]<>\+]+(\@|\-at\-)[\w\-\[\]<>]+(\.|\-dot\-)[\w\-]+/i);</p> <p> # mangle address — character at a time –except \@<br /> $email =~ s/(:)([^\s])/$1 $2/;<br /> $email =~ s/([a-zA-Z0-9:\s_\-.])/&OB_randlet($1)/eg;</p> <p> my $at = &OB_randlet(“\@”);<br /> my ($ename, $edomain) = split(/\@/, $email);<br /> my $link = $ename.$at.$edomain;</p> <p> # want address only? no problem.<br /> return $link if !($prompt || $title);</p> <p> # put a space between mailto: and the address (drives spammers crazy)<br /> my($mailto) = &OB_ascape(“mailto:”).&OB_hexape(” “);</p> <p> # build hyperlink based on use javascript argument (or not)<br /> $link = $usejs ?<br /> “javascript:var e1=’$edomain’,e2=’$mailto’, e3=’$ename’;var e0=e2+e3+’$at’+e1;(window.location?window.location.replace(e0):document.write(e0));” :<br /> $mailto.$link;</p> <p> # try to use a title, but when you can’t …<br /> $prompt = &OB_ascape($prompt);<br /> return qq~<a href="$link">$prompt</a>~ if !($title);</p> <p> # got title?<br /> $title = &OB_ascape($title);<br /> return qq~<a href="$link" title="$title">$prompt</a>~;<br /> }</p> <p># http://ironbark.bendigo.latrobe.edu.au/subjects/bitwen/lectures/w08.d/l15.d/slide3.html<br /> sub OB_validmail {<br /> my($email) = @_;<br /> return ( $email =~ /^([\w\-._]+\@[\w\-.]+)$/ );<br /> }</p> <p># 2 randoms, 1st for hex vs ascii, then again for ascii vs plain<br /> sub OB_randlet {<br /> my($l) = @_;<br /> my($r) = &OB_round(rand());<br /> return sprintf(“%%%02x”,ord($l)) if $r;<br /> $r = &OB_round(rand());<br /> return sprintf(“&#%03d;”,ord($l)) if $r;<br /> return $l;<br /> }</p> <p># real numbers only<br /> sub OB_round {<br /> my($n) = @_;<br /> return int($n + .5 * ($n <=> 0));<br /> }</p> <p># ascii escape codes<br /> sub OB_ascape {<br /> my($s) = @_;<br /> $s =~ s/([a-zA-Z0-9:\s\@_\-.])/uc sprintf(“&#%03d;”,ord($1))/eg;<br /> return $s;<br /> }</p> <p># hex it up a bit<br /> sub OB_hexape {<br /> my($s) = @_;<br /> $s =~ s/([a-zA-Z0-9:\s\@_\-.])/uc sprintf(“%%%02x”,ord($1))/eg;<br /> return $s;<br /> }</p> <p>1;<br /> __END__</p> <p>=head1 NAME</p> <p>Obfuscator – mangles email addresses to fool dumb spambots</p> <p>=head1 SYNOPSIS</p> <p>use Obfuscator;<br /> print OB_encode($email, $prompt, $title, $usejs) if OB_validmail($email);</p> <p>$email – required string representing an email address, remember, in Perl<br /> it’s my $email = “foo\@bar.com” … note the slash<br /> $prompt – optional string of the prompt you want between the <a>..</a> tags<br /> $title – optional string that is used for title argument of <a> tag<br /> $usejs – renders obfuscated hyperlink as a javascript link</p> <p>=head1 DESCRIPTION</p> <p>Obfuscator randomly converts your entries into a combination of numeric and<br /> hexadecimal encodings, as well as a salting of some non-converted characters<br /> that will either hide your e-mail address from spambots and/or cause their<br /> mailers to gag because they’re not expecting all three encoding in radom.<br /> This program also obfuscates the prompts to give spambots less key words to<br /> search, find and filche.</p> <p>=head1 IMPROVEMENTS<br /> * n/a</p> <p>=head1 BUGS<br /> * n/a</p> <p>=head1 AUTHOR<br /> Dean Peters <http://www.healyourchurchwebsite.com/obfuscator/></p> <p>=head1 EXAMPLE</p> <p>use Obfuscator;<br /> my $email = “obfuscater\@healyourchurchwebsite.org”;<br /> print “Problems? Questions? “.<br /> OB_encode($email, “drop me a line.”,<br /> “Problem? Praise? Email Me”, true)<br /> if OB_validmail($email);</p> <p>=head1 COPYRIGHT and LICENSE</p> <p>Copyright (c) 2002-2003<br /> Dean Peters <http://www.healyourchurchwebsite.com/obfuscator/></p> <p>Permission is hereby granted, free of charge, to any person obtaining a<br /> copy of this software and associated documentation files (the “Software”),<br /> to deal in the Software without restriction, including without limitation<br /> the rights to use, copy, modify, merge, publish, distribute, sublicense,<br /> and/or sell copies of the Software, and to permit persons to whom the<br /> Software is furnished to do so, subject to the following conditions:</p> <p>The above copyright notice and this permission notice shall be included in<br /> all copies or substantial portions of the Software.</p> <p>The Software is not included in any commercial application or publication<br /> without the expressed written permission of Dean Peters.</p> <p>The Software is provided “as is”, without warranty of any kind, express or<br /> implied, including but not limited to the warranties of merchantability,<br /> fitness for a particular purpose and noninfringement. In no event shall<br /> the authors or copyright holders be liable for any claim, damages or other<br /> liability, whether in an action of contract, tort or otherwise, arising<br /> from, out of or in connection with the Software or the use or other<br /> dealings in the Software.</p> <p>=cut</p> <p>

Yes, this obfuscator isn’t nearly as dastardly as the very cool and very effective online offering from HiveWare (hat tip to Mark Pilgrim) … perhaps by putting the Obfuscator.pm code ‘out there’ … someone will come up with an elegant “<noscript>” solution. I’ve already got one person who’s keen on optimizing the regular expressions … Colin, thank you.