Programming/wilderness adventures/cybersecurity/livable cities
Formerly: CTO @ YourStake.org
Brooklyn, NY 🇨🇭🇺🇸
| Website | https://a.drien.com |
| Github | https://github.com/drien |
I've found it interesting to check the realtime USGS stream gauge data during big storms ever since weathering Sandy in NYC, but not used to seeing multiple at or near the limits of what they can measure. #wx #helene
So interesting to see what comes through after turning on catch-all emails for my domains.
This message is 100%, indisputable, straight-up spam from NextDoor. They invented an email address at my business domain that has never, ever existed ([email protected]) to try to get me to sign up. They even got my address correct, but.... I already have an account, and my name is, as far as I know, unique in the US.
I have real email addresses public on my work (https://incinc.io) and personal (https://a.drien.com) websites, but somehow their spam software decided to generate this new address. They must bounce an extraordinary volume of these signup invites.
Not the first time my email domain catchalls have gotten things they shouldn't from random companies' automated test suites. This time it's a login code!
Perhaps just the result of a typo, but either way, devs shouldn't be using arbitrary domains in their tests, and test environments (or is this prod?? who knows) should only be able to email allowlisted domains.
If your seed data creates test users with email addresses, assume it's going to get run on an internet-accessible environment at some point and only use domains that you fully control. #appsec