11 ms·
I worked for a company that nearly acquired unroll.me. At the time, which was over three years ago, they had kept a copy of every single email of yours that you
by karlkatzke 9y ago
I worked for a company that nearly acquired unroll.me. At the time, which was over three years ago, they had kept a copy of every single email of yours that you sent or received while a part of their service. Those emails were kept in a series of poorly secured S3 buckets. A large part of Slice buying unroll.me was for access to those email archives. Specifically, they wanted to look for keyword trends and for receipts from online purchases.
The founders of unroll.me were pretty dishonest, which is a large part of why the company I worked for declined to purchase the company. As an example, one of the problems was how the founders had valued and then diluted equity shares that employees held. To make a long story short, there weren't any circumstances in which employees who held options or an equity stake would see any money.
I hope you weren't emailed any legal documents or passwords written in the clear.
- digitalzombie 9y ago... This is why I treat equity and ipo as monopoly money. It's ok that we pay you sub market salary because you get great ipo and equity. Yeaaaah no.
- meric 9y agoIt's comparative to the "espresso machine in the office" perk. When you bump into your colleagues in the morning you have an extra talking point.
- Natsu 9y agoIn terms only of capabilities, that makes me wonder a lot about Gmail. I don't see anything there that they couldn't do if they wished to do it on a far grander scale. Granted, I tend to think the people who run Gmail are more honest than that, but if someday the wrong people retired and others took over or what have you, I wonder just how suddenly that could change?
- Iv 9y agoWho knows? Maybe at one point people will realize the value of local mail storage and end to end cryptography.
- bluejekyll 9y agoDo you only use one device?
- mcculley 9y agoUsing multiple devices does not preclude one from using a server and end-to-end encryption.
- bluejekyll 9y agoThe reason I ask is about private key movement. I'm curious how you share that across devices. It's the biggest issue in e2e encryption imo. Just curious if you do anything novel there.
- mcculley 9y agoI don't do anything novel. I have my private key on three devices.
- Skuzzzy 9y agoHow do you get that private key on each of your devices, this is a real issue for a lot of less technical users.
- Natsu 9y agoUnless they're using an HSM, that would most likely be a matter of just copying a file. With an HSM, it would have to be marked as exportable (bad for security), or to happen via some proprietary HSM to HSM cloning method endorsed by the vendor. That said, I don't see that much HSM usage outside of the government or their contractors.
- cocktailpeanuts 9y agoGmail doesn't need to sell data to anyone, they use it for rest of the google suites like google.com, adsense, youtube, doubleclick, and all the other properties they own. In fact it would be a stupid idea for them to sell any of that data directly to a 3rd party. Instead they package them in user friendly (marketer/advertiser friendly) ways to capitalize. Some of these are shady and I'm not a fan but overall I think this approach is fine. The problem happens when you sell user data to a 3rd party. Here's an example: Let's say you start an email newsletter about travel. You get millions of subscribers. Then you start putting ads on your email. Maybe sometimes even send sponsored messages. This is kind of annoying but not "unethical". On the other hand, the same company could take all the email list and sell it to bunch of travel agencies. Then all the million users who subscribed suddenly start receiving spam emails from these travel agencies. This is unethical because they literally "sold" your email address. Of course this is more of an extreme example, but the pattern is the same.
- shostack 9y ago> "Instead they package them in user friendly (marketer/advertiser friendly) ways to capitalize." Yes, it is called Gmail Sponsored Promotions or "GSPs." Depending on the audience they can apparently be quite effective. [1] [1] http://marketingland.com/gmail-sponsored-promotions-everything-need-know-succeed-direct-response-gsp-part-1-120938 http://marketingland.com/gmail-sponsored-promotions-everythi...
- hgdude 9y agotech has become a cesspool of slimy founders + and unbridled capitalism - this needs to stop for the greater good
- alphonsegaston 9y agoI agree, but it won't until the bubble pops, and even that won't sort out the monopolists. As long as it's centered around VCs with more money than sense or morals, tech is going to continue unabated in its transformation into Wall Street 2.0
- gloverkcn 9y agoIn 20 years I haven't seen a time where this wasn't the case. Seed money is the first to take the risk and deserves the majority share of profit VC (series A,B,C) are putting in the most money and brining big hitters for the board and advisors. They clearly deserve the majority share. Founders do all the work and it's their idea so they deserve all the money. The second generation leaders productive, operationalize, and bring legitimacy to the company, so they deserve all the money. Whichever group has the leverage forces the table to tilt their direction. It doesn't matter how good the potential is, how sure the victory is, how close the first breakthrough customer is, if you don't trust someone, or there's a slimy/smarmy vibe then just walk away. It's not worth putting in years of effort to have to resort to contract lawyers to get paid.
- BoiledCabbage 9y agoIt boils down to this: Capitalism is not the goal of society, it is a tool. Somewhere in the past few decades we've conflated the two - and a larger portion of our population believe that Capitalism is the goal. It's not, it's a way to achieve our goals. It is efficient, it is effective, it will always have little to no morals and consolidate in the hands of the few. That is not a judgement of the system it is an assessment. No different than stating a hammer will will work well with nails and poorly with screws. We as a world society (and particularly an American socienty) need to refocus on what our goals of society are. And actively decided when to use and when to rein in specific tools to achieve our goals. Absent of focusing on goals, our tools become our goals and we get the results we're seeing today.
- partisan 9y agoYou might have been and possibly still are under an NDA from the acquisition process. I'm not sure it is worthwhile detailing all of this in a public forum.
- bcjordan 9y agoAnd if they signed up to try Unroll.me they might have violated it already!
- karlkatzke 9y agoThanks. I'll let it stand for now. I haven't been a part of that company for several years now, and did not have any legal agreements or first party relationship with either of the companies named above, and since the deal closed since with Slice it would be difficult for anyone to allege damages. I should also be clear that everything I said is hearsay. I wasn't personally privy to the terms of the deal or involved in due diligence, which is why I am fairly sure that I am not under NDA from unroll.me. (My former employer may be a different situation, but I'm pretty confident that none of the information disclosed above is or was a trade secret at this point.)
- newsat13 9y agoJust so you know, you have been quotes on gruber's article. Be careful about what you say on careful forum especially since your profile gives your contact information.
- karlkatzke 9y agoThanks. I'll let it stand for now. I haven't been a part of that company for several years now, and did not have any legal agreements or first party relationship with either of the companies named above, and since the deal closed since with Slice it would be difficult for anyone to allege damages. On top of that, it should be very clear that everything I said is hearsay at best. If I had known the attention this would receive, I would have been clearer about it.
- jacquesm 9y agoNo, but you did just point a whole pile of nasties at a very juicy and poorly secured target.
- karlkatzke 9y agoI would hope that Slice secured it after the acquisition.
- jacquesm 9y agoYou can't be sure of that.
- yuhong 9y agoI wonder how expensive it would be to keep full text of all modern multi-gig mailboxes anyway.
- jacquesm 9y agoThat's so far outside of what is acceptable that it should be actionable in some way and I sincerely hope Google cuts them off at the knees. Aren't you breaking an NDA by posting this? (If so, extra kudos to you!)
- karlkatzke 9y agoI'll quote what I said elsewhere: > I haven't been a part of that company for several years now, and did not have any legal agreements or first party relationship with either of the companies named above, and since the deal closed since with Slice it would be difficult for anyone to allege damages. And if all this disappears, then yes, someone did attack me legally over it. I don't like the business culture that has built up around this kind of thing -- reputation is important, so let's defend it with lots of lawyers and NDAs, but it's too much effort to be up front about business practices that might give us a bad reputation. That's bullshit.
- jacquesm 9y agoI totally agree. But, and this is a very big but: companies would no longer be open to potential acquisition partners during the due diligence phase of an acquisition if professionals in this space would talk publicly (or even at all) about what they find. I'm seriously conflicted about this because I too have seen some extremely horrible stuff in the last couple of years, some of which I'm quite sure would rock the world orders of magnitude worse than what unroll.me has been up to and that was secured roughly in the same way (or maybe even worse) and with data best qualified as 'radioactive'. I do sign NDAs and I stick to them religiously but it is very hard at times to do that. Even so I understand that I'd make life miserable for those that employ me if I'd ever break an NDA.
- karlkatzke 9y agoYep. Working in Systems as I do, my word that I'll keep my employer's secrets is pretty precious. Still, we share war stories over libations with our peers. These stories have value; they're how we know as a community what products to use and what employers to seek or to avoid. While I didn't intend for this to get quite the audience that it's getting, I will own up to having shared the story. My boundary, and the legal boundary that NDAs (even despite what is written in them) are generally held to is "trade secrets." I would hope that everything in my post is three or more years out of date, and would no longer qualify as such.
- nilkn 9y agoIs this answer on their FAQ an outright lie, then? https://unrollme.zendesk.com/hc/en-us/articles/200243036-If-I-delete-my-Unroll-Me-account-what-will-happen-to-all-of-my-previously-rolled-up-emails- https://unrollme.zendesk.com/hc/en-us/articles/200243036-If-... > we don't store any of your emails on our servers. Either way, I just deleted my Unroll.me account and revoked access to my Gmail account. I don't think there's anything the company can do to ever get me back as a user.
- dingo_bat 9y agoI guess it's not a lie since they store it on Amazon's servers?
- nickonline 9y agoThe store them on amazon's...
- karlkatzke 9y agoI'm not sure I can answer that in detail, or that it hasn't changed since the details were originally shared with me. That might also be a case of an article that's written from the point of view of one feature ("what happens if I delete") and not what's going on under the hood. There are other references to deleting data stored with unroll.me, e.g. When you go through the delete steps you need to do it in a particular order so that data on their side is removed, as discussed in another comment thread.
- kkyryl 9y agosituations like this is what makes it really hard for others in this space to survive. I run https://clean.email https://clean.email (and we don't store/retain/sell any data, just charge people to use it) and the biggest issue we have is lack of trust because of news like this. although every day someone would still email with a question "why you are not free like unroll.me".. sigh.
- kkyryl 9y agoit's kinda funny how ~50 people who came from this thread to our service illustrated the point of the lack trust – not a single person registered :)
- CamelCaseName 9y agoI don't see how that indicates a lack of trust. People may not be in the mood to change, or need to do more research before they do, especially since it is very late in the evening for the Western world. Also, it's only been 30 minutes since your first post, and 50 is a small sample size.
- kkyryl 9y agothat's just a joke – I was not really hoping to get users from here :) I was actually surprised with 50 even clicking the link.
- gogopuppygogo 9y agoI clicked, I read your value prop, I just can't see myself paying $95+ /year for less obnoxious email in my inbox. It's really not that big of a problem to me.
- kkyryl 9y agough. I have "Yearly pricing to the homepage" sitting in my to-do list for a few weeks :) so – there's yearly pricing (and it starts with 14.99 / year (I know, this looks really weird, but it took us some time to get to this pricing). now, whether it's valuable enough to justify the price – depends a lot on how you use your email. we've got users managing 3-5 accounts with hundreds of thousands of emails each and they use our labeling/organization more than removal. think of it as of a way to act upon a group of emails no matter what the size of the group is. (and I kinda think our website is not really good at communicating this – our traffic is mostly coming from android app right now and we've been putting website work off. who knew!).
- rubicon33 9y agoThere is a phrase which I live by - If it's free, you're the product.
- qzervaas 9y agoThat's all well and good - and many people realise and accept this - but the degree to which you're the product can clearly vary wildly. That's the real issue.
- rubicon33 9y agoOf course it varies. It's up to you to decide/deduce/infer what the "cost" of using a free service likely is. Understanding that there IS a cost is really the first step, one which a good portion of the population seems to not understand.
- ianwalter 9y agoTo be fair Unroll.me shows you ads in their emails to you so a user may think thats how they monetise and be ok with that. Its another thing altogether when the company sells all of your email data directly to buyers.
- kkyryl 9y agoI wish more people thought like that. with everything being free it's really hard to actually charge people for something.
- Tanegashima 9y agoWell, this site is free...what's the catch?
- ThrustVectoring 9y agoThis is clearly and explicitly content marketing that attempts to fill YCombinator's venture capital deal funnel.
- 9y ago
- gogopuppygogo 9y agoThanks for the heads up. If anyone else wants to delete their account you can follow these instructions: https://unrollme.zendesk.com/hc/en-us/articles/200165526-How-do-I-delete-my-Unroll-Me-account- https://unrollme.zendesk.com/hc/en-us/articles/200165526-How...
- aphexcx 9y agoAm I correct in thinking this is class-action lawsuit-able?
- robschia 9y agoSo, should I change my email address because all of my emails were read and archived by Unroll.me on their servers?
- FabianBeiner 9y agoProbably (and hopefully) only a matter of time until someone starts to work on an Open Source version of Unroll.me.
- caarlos0 9y agoSuggestion: delete Unroll.me account, fill reasons with "Other", and then "Privacy! https://news.ycombinator.com/item?id=14180463" https://news.ycombinator.com/item?id=14180463"
- bethebutterfly 9y agoWith all due respect you were a consultant for 8 months at Returnpath and know nothing about why that deal didn't happen and you certainly weren't important enough there to know anything about the equity structure of the company. Returnpath is also a data company that buys companies for data collected from services provided to the user. Ask Josh Baer. That's why they bought his company. Also spreading unfounded rumors about data storage practices you know zero about is really irresponsible.
- bethebutterfly 9y agoAND I can tell you as a co-founder of the company this is 100% false.
- kjs3 9y agoSo you don't store files in S3? Haven't diluted away your employees? Haven't been completely called out and had your execs admit the same? So we're way below 100%...what's left that actually is false?