The standard file with packaging instructions (setup.py with setuptools) for Python contains an author_email field. Such a package can then be published to PyPI, but the code is also available publicly on github.

Am I unnecessarily cautious if I want to obfuscate the email address in the setup.py file (e.g. by calling a base64.decodebytes())?

It seems superfluous to have the address as "john.doe[at]gmail.com" (with brackets) in a README file, but as plain text legit email in a python file, but I have seen no one obfuscating their setup.py address.

Nowadays, spam filters perform well, but is there some interest in doing what I suggest? Or does it just make my code look like virus?

  • Why would you want to do this? I'm not seeing a security angle here. Just an annoyance angle (don't want spam).
    – schroeder
    Jan 13, 2020 at 22:25
  • 1
    The reason why obfuscation with things like [at] works is because they're usually in a long free text field, and the email is lost among other text, so it's really hard to write a parser that can just catch email address without getting lots of false positives. In this case, since this field is an email address field, it's much simpler to write a transformation function that can undo most of the transforms people would do while still making the email readable for humans. Especially if you're going to use common mail domains like gmail.com.
    – Lie Ryan
    Jan 14, 2020 at 3:19
  • 1
    If you're worried about spam, I'd suggest instead to use a business/second email address, rather than giving your primary address.
    – Lie Ryan
    Jan 14, 2020 at 3:20
  • Good points. @LieRyan, what do you mean "it's much simpler to write a transformation function [...]" ? You mean to write a scraper finding the author_email field and undoing all my obfuscation? Jan 14, 2020 at 9:02
  • @PlasmaBintorung: yes, there are only so many variations of email_address.replace("[at]", "@"), it wouldn't really be that difficult to write a scraper than can undo all the common obfuscations if you already know that the field must be an email address. It's a much easier problem than finding an obfuscated email address in a free text field.
    – Lie Ryan
    Jan 14, 2020 at 9:31


You must log in to answer this question.

Browse other questions tagged .