Discourse notifications and Thunderbird's phishing filter
-
Hi,
wondered why my Thunderbird flagged all Discourse notification emails as phishing, until I had a closer look at the links...
To respond, reply to this email or visit http://what.thedailywtf.com/t/foo-bar/1337/42 in your browser.
But the link does not go to
*.thedailywtf.com/but tomandrillapp.com.Seems that Discourse/TheDailyWtf/whoever tries to track some click-through rates but is too lazy to use a link at the same second-level-domain for it, therefore triggering Thunderbird's phishing filter...
Probably somebody should fix this - or just remove the "link text" that looks like the link should go to the forum directly.
-
I think trying to get anybody to respond to a discourse topic is appropriately classified as a phishing scam.
-
I'm pretty sure I remember this subject coming up way back when Discurse was first rammed down our throats, but apparently click-tracking is more important to the Discodevs than appearing trustworthy.
-
It's only Thunderbird that complains about this, and who the hell wants to use Netscape Communicator's deadly email client spawnoff?
-
I thought it was something Alex could disable, but chooses not to?
-
In fact, Mandrill has an option to use a subdomain of your own (verified) domain as tracking domain by setting up a DNS entry, though I have no idea if that'd please Thunderbird.
-
I thought it was something Alex could disable, but chooses not to?
Could be; I don't remember. It was just one many issues we were finding back then, and I very quickly disabled email notifications and forgot all about it.
-
I have them disabled too. Not because of the Mandrill thing, just because I always have them disabled on forums.
-
Yeah, too much mail about stuff I was reading on the web anyway.
-
GMail also does funky stuff with Discourse emails - I have them all around main inbox, Communities, Offers and Spam.
-
I just exported one of the "phishing" emails as mbox and edited it so that the one problematic link points to "http://mandrillapp.thedailywtf.com/..." instead, and imported it again. No phishing warning. changing the link back to "http://mandrillapp.thedailyftw.com" made it get detected again. So a subdomain should help (in case you don't want to be detected as a phishing mail, that is).
