14 ms·

I'm dealing with this right now. Both my personal domain and rsync.net are on a distinct subnet, but that subnet is smaller than a /24 and someone on a differe

• vorpalhex 5y ago
  > We were also informed that our normal, business communications with paying customers should have unsubscribe notices appended to them. You should have an unsubscribe link. You should also have your business address and identify yourself. Even if it's not required by the letter of the law, you should add it. As an example: Amazon automatically opted me into an "alert" when a wishlist I viewed had a new viewer. Since it's an "alert" and a "business communication" it has no unsubscribe. This is spam - this is an ad hidden as a notification.
  • kazinator 5y ago
    Though that may be a nice opinion, your ISP has no business dictating that to you.
    • Godel_unicode 5y ago
      Abusix isn't their ISP, they're an email blocklist provider. Telling people what they need to do to not get blocked for being abusive is literally their job.
      • hansel_der 5y ago
        yea, in an ideal world, the blocklist provider would educate others in how to avoid beeing blocklisted. yet, if this course is met with success then the blocklist provider is out of business. there seems to be some conflict of interest here.
        • smf 5y ago
          Please see my comment below: https://news.ycombinator.com/item?id=30227886 https://news.ycombinator.com/item?id=30227886 and the subsequent threads below. Not all blocklist providers are the same.
          • hansel_der 5y ago
            terribly sorry that you felt personally implicated, that was not my intent. thou every security-for-profit scheme suffers from afromentioned conflict of interest.
  • thaumaturgy 5y ago
    ~rsync runs a storage service for offsite backups. You think they should add a one-click "unsubscribe" link to service alerts?
    • boopmaster 5y ago
      if the service is managed: customers should be able to manage notification preferences tailored to the severity of the issue, methinks.
      • thaumaturgy 5y ago
        That's not how unsubscribe links are supposed to work. Once the unsubscribe is activated -- and it's supposed to be very easy to activate -- then it's permanent. There's no "un-unsubscribe", "oops I clicked it again", "some other service glitched and clicked it for me". Further, there's a distinction made between "commercial" and "transactional" messages in both law and etiquette. The unsubscribe link is expected in commercial messages, not transactional ones. Abusix didn't know what they were talking about.
        • wl 5y ago
          > Further, there's a distinction made between "commercial" and "transactional" messages in both law and etiquette. The unsubscribe link is expected in commercial messages, not transactional ones. Most of the junk that gets through my spam filter are transactional or other "mandatory" messages intended for someone who fat fingered their email address. If those senders don't want to be marked as spam, they need to provide a way for me to make the messages stop.
          • thaumaturgy 5y ago
            Email confirmations should be standard but that's not what we're talking about here (and I'd expect that ~rsync is handling that properly). Unsubscribing from transactional emails eventually causes the following support conversation: "Hi, uhh, rsync? Yeah, so, I'm having trouble logging in to my account and we really really need our backups, our intern just nuked a database. Yeah, it's uhh... cto@company.com. What do you mean my account's not active? ... ... Why didn't you just tell me my card expired? Well yeah, of course I unsubscribed, but I still wanted to know my account was being shut down!" There's a scale of headaches happening here. At one end of the scale we have "nuisance", as in, "I'm getting too much email, or I have a stupid email address, or I don't know how to filter messages from reputable senders", and at the other end we have "job-ending cockup", as in, "I'm just now finding out that a critical part of our disaster recovery plan hasn't been working for a long time because somebody somewhere was inconvenienced by a notification, and I'm finding this out now because today happens to be the day we really need that disaster recovery plan". Pushing the needle away from the nuisance end moves it closer to the disaster end.
  • Shared404 5y ago
    For rsync however, it seems more likely that it's instead things like disc quota or expiring service. At least based on my understanding of rsync-the-company and rsync-the-hn-commenter.
  • rsync 5y ago
    "You should have an unsubscribe link. You should also have your business address and identify yourself." What would that even look like ? You're a paying customer of a service - they charge you every month - and you use that service ~daily ... and then you unsubscribe to emails ... So then what ? We just keep taking your money and when the service fails or there is an outage or critical notification we ... just don't send it ?
    • zamadatix 5y ago
      Yes, just because I use your service doesn't mean I want to see every outage notification status update as an email. Preferably email subscription status would be granular so I can select what I want to get not what some idealized average user would want to get.
      • cbm-vic-20 5y ago
        I've been a paying customer of rsync's service for more than a decade. The only mail I get is the monthly invoice, and roughly once-per-year notice of infrastructure changes that may temporarily affect availability.
        • zamadatix 5y ago
          Oh I have no doubts whatsoever the volume is low and the messages sent intended to be genuinely important to the vast majority of customers, rsync seems very reputable based on what I've heard over the years on HN. It's still nice to have granular subscription though even for rare things you think 95% of users may like to hear about e.g. I've been using a similar service since 2015 and I have 0 interest in receiving their downtime or scheduled maintenance notifications as I don't care enough to take a special action for a failed sync or two in the first place so... I don't opt to receive them and I appreciate that option. I don't get the invoices emailed so I haven't had to think about it one way or the other there.
    • scarface74 5y ago
      Yes. I explicitly told you I didn’t want any emails from you.
• dredmorbius 5y ago
  Those unsubscribe links should be there, for several reasons. - The service-based economy means that entities (individuals and businesses) have numerous relationships. For the typical individual the number of password-based accounts crossed the 100 threshold years ago, at a doubling rate of every 2--3 years. - Responsibilities can be transferred. The person who signed up for your service 5 years ago may no longer be at the company. - List purging is a Real Thing. A few years back I'd worked for an organisation that had ... numerous relationships ... with individuals and corporations. These received regular email messages. Nominally, requested. Included amongst these was a major Wall Street financial firm whose implosion years earlier hit lead news and headlines worldwide. Despite not existing for years, there remained hundreds if not thousands of addresses being sent email on a regular ongoing basis. - Mail can be forwarded. It's quite possible that you're sending mail to one address that is is being forwarded, manually or automatically, to others. This raises issues in unsubscribe requests, but might at the least be an opportunity to reach out to your customer to clarify the situation. - I don't know if revisiting email contact approval on a regular basis (say once every year or two) is yet a recommended practice, but I'd strongly suggest that it be so. Your hat may be less blisteringly white than you presume.
  • contravariant 5y ago
    I've also had email from the wrong person delivered to me some times. One company in particular kept sending updates for a service I had no way of using. An unsubscribe link would have been handy, though confirming email addresses before linking them to an account would also be a good idea, probably.
  • rsync 5y ago
    Everything you've said makes perfect sense - for a contact management function. We have that. You can change contact info, set owner/technical/emergency contacts, alert thresholds, etc. But unsubscribe means something totally different: When I click on unsubscribe I want it to be the end of all communications. Period. In this case, that makes no sense. Ceasing communications for all purposes implies service cancellation and, in our case, service cancellation implies a human interaction confirming data destruction. How would we confirm data destruction for your implied cancellation if no further contact is permitted ? You, and the blacklist operators, have become so jaded by the abuse you've suffered that you've forgotten that legitimate, paid services exist. I'm sorry.
• wl 5y ago
  > We were also informed that our normal, business communications with paying customers should have unsubscribe notices appended to them. Which is to say, you're a paying customer of a service and we send you some kind of alert or critical announcement ... and it should have an unsubscribe link. You absolutely should. The amount of junk I get because someone else signed up for something and fat fingered their email address is ridiculous. "Mandatory communication" with a company I've never dealt with gets flagged as spam.
  • derefr 5y ago
    That's a (very legitimate and important) reason to do double opt-in unilaterally for all email communications. Companies should make 100% sure that the person who signed up, and the person receiving the email, are the same person, before they associate the email with the account. Otherwise, malicious people can sign up arbitrary third parties for tons of random crap. But it's not a good reason for adding unsubscribe links unilaterally to all email communications. Remember, unsub links are machine-automatable; Gmail at least offers to follow any embedded unsubscribe links for you if you mark a message as spam. (Which, with hotkeys enabled, is one accidental keypress away.) So consider the extreme case: what if the user fat-fingers an unsubscribe (without realizing) to their local electric company's e-invoices, which is what they've been relying on to prod them to log onto the site and pay the bill? If it's clear that "bills you need to react to or your power will be shut off" shouldn't have an unsubscribe link, then clearly there's some sort of line that must be drawn somewhere. (Note, I'm not arguing against the use of "Manage your Mail Preferences" links in these cases — the kind that act as magic sign-in links and take you directly to a page on which you can un-check a "mail me about X" checkbox. It makes sense to include those. I'm just arguing specifically against unilaterally including "Unsubscribe" links — the kind where following the link unsubscribes you with no further confirmation needed.)
    • wl 5y ago
      > So consider the extreme case: what if the user fat-fingers an unsubscribe (without realizing) to their local electric company's e-invoices, which is what been relying on to prod them to log onto the site and pay the bill? To name a specific example of this problem, I want Gulf Power of Florida to stop sending exactly the kind of email you speak of. Bills. Nastygrams when the person falls behind on the bills. Unwanted power saving tips. Calling the company and sending them postal mail has not helped. It all gets marked as spam these days. If they had an unsubscribe button, it wouldn't. If the email is so damn important, they can go back to sending postal mail to the service address when someone unsubscribes.
• thaumaturgy 5y ago
  FWIW, Mailgun has worked pretty well for me in the past as an alternative to handling delivery myself. You might not be able to go this route if your customers have some expectations about how your email is handled, in which case this recommendation is here for anyone else that might read this and need another thing to try.
• zamadatix 5y ago
  The inability to generate IP reputation smaller than a /24 is inherent to the way internet routing works. Nothing smaller than a /24 can be publicly assigned or advertised to prevent the route table from becoming too bloated. On IPv6 the smallest advertise able block is a /48 for the same reason. Privately managed assignments in shared or further split subnets aren't publicly visible, verifiable, or accountable to anything but the organization owning and advertising the /24 (or larger). As such the reputation score of a subnet is the reputation of the entity advertising itself as publicly controlling and maintaining that network, not the reputation of individual sub entities inside that subnet (which is known only to the controlling entity). If that entity is constantly allowing bad actors onto their block then that block is considered poor reputation.
  • the_biot 5y ago
    > The inability to generate IP reputation smaller than a /24 is inherent to the way internet routing works. Nonsense. SMTP is not internet routing, and there is no reason at all why some "reputation" system should be constrained by the same /24 limit that the global routing table ended up with. I find it telling that these "reputation" outfits tend to serve up this sort of poor excuse to justify their businesses; whereas they're often plain old protection rackets. Like the one described in the article clearly is. They take money to solve the problem they created!
    • zamadatix 5y ago
      I think you're thinking domain based email reputation lists but commenting on the IP reputation conversation while also conflating what Abusix is doing in this comment chain with what UCEPROTECT is doing in the post and forming a conclusion from hand picked pieces of the conglomerate. For the Abusix portion related to this thread check out their response here as it goes into much better detail with what I originally described https://news.ycombinator.com/item?id=30227886 https://news.ycombinator.com/item?id=30227886 (note: I'm unaffiliated, I work for a generic network VAR and we don't even sell their service for email). These domain based lists are also a thing but you need to have a pretty sizable volume to become trusted in those lists as anyone can register a domain in seconds, none of the above will have gained trust on them. The whitelist payment option for arbitrary hosts (which Abusix doesn't offer) is a workaround to create a publicly registered identity with some stake to tie the reputation to. I mean it can be other things to, scammy rackets exist too, but you can't just claim it's a poor excuse without offering a better answer that solves the same problem. Speaking of spammers are the ones that created the problem because people started using individual network block lists before companies started aggregating and mediating them. You're welcome to make your own community replacement solution but the problem is the replacement has to be reliable enough other mail administrators want to use it not just nice for the occasional legitimate guy that wants to run email out of his house and be trusted by default. Also it's a lot of work to mediate.
• smf 5y ago
  I'm the Abusix engineer in question (and actually the architect of the system in question), and you're being somewhat "economical" with what actually happened here. Here's the actual chain of events in question: - You recently switched ISPs and that meant you moved to a new IP block. - The IP block in question is owned by Hurricane Internet and unfortunately contains a host which persistently sends out a lot of junk (https://lookup.abusix.com/search?q=216.218.240.46 https://lookup.abusix.com/search?q=216.218.240.46) - Without going into massive details on how our infra works, but when we have the most serious level of listing (e.g. hitting our most secure traps as in this case), we treat the same /24 more aggressively than we normally would (because of things like snoeshoe spam that would normally spread traffic across a wide range of IPs). We use /24s only where we cannot determine different ownership of the IPs by looking at the abuse contact registered at the RIR e.g. if the IPs are different contacts then we don't bundle them into the same bucket. In this case Hurricane Internet owns the entire range, so the /24 is used. We do this because there is no other way to do it that isn't completely abuseable by a bad actor e.g. rDNS is completely trivial to forge and to claim multiple fake entities. If someone has a fool-proof way to do this, then I'm all ears. Then we get to your failings in this case: - You don't have proper, working bounce handling. You were repeatedly sending mail to an old customer and we were rejecting 100% of the email you sent to that address - stating that you should stop sending to it in the rejection message. We always reject traffic on traps we are building so that bounce handling removes them automatically over time. - You decided to send a marketing message to a bunch of users, including to the address described above "We (rsync.net) are experimenting with a lifetime prepayment option". This message provided no List-Unsubscribe option at all, so I could not unsubscribe it without exposing the trap to your engineer (which is my primary concern as it takes years to build traps properly). - Your engineer said to me "we took down 600 old accounts and are reviewing our contact policies going forward" and "there are still plenty of other customers who are listed generically as bouncing so we will have work to do here". That tells me that you knew that you were sending to old accounts and that your bounce handling was either not great or non-existent. I take our role very seriously and I and my team go out of our way to help anyone who finds themselves listed by providing evidence and advice and we always try to find a good resolution for all legitimate senders. That is exactly what I did here with your engineer, the problem is resolved as the specific account was removed and you know now what you were doing wrong and how to fix it so that it never happens again. Your engineer was appreciative and I said if there are any further issues in the meantime whilst you fix things on your end, then we would help by exempting your traffic whilst you did those changes. I can't see how we could have done anything more in this case. On our website, we provide blog posts and videos, we take part in conferences and workshops to give advice on how to do things properly so you never have blocklisting issues. I can easily summarise here what everyone should do to avoid issues: - Have proper rDNS for your sending IPs that is part of your administrative domain (e.g. don't use your providers generic rDNS that contains the entire IP in the hostname). If someone visits the domain name, make sure there is a website present that has contact details as a minimum. - Make sure your abuse@domain and postmaster@domain accounts actually go to a responsible person. - If you send any marketing mail at all, make sure it has a working List-Unsubscribe header (preferably HTTP that allows someone to unsubscribe without having to contact you). Important note: If you use a mailto: unsubscribe, then I cannot unsubscribe a trap, even if I wanted to. - Make sure you have working bounce handling. If you repeatedly send to an account and it either bounces or is hard rejected, then you need to stop sending to it and mark it as bad. No excuses. - Don't send to addresses where you have not contacted them or had any interaction at all for > 1 year. If you haven't kept in touch with your customers, then that is on you. - If you have a web form that when submitted, sends a message to an external user, then you MUST a) validate all of the input fields and disallow URLs unless the field required it and b) prevent automated submission via the use of a CAPTCHA. - When collecting email addresses for mailing lists, always use confirm opt-in e.g. send a message containing a link that they have to click to activate the subscription. Do not send any further messages to them until this has been completed. - Make sure you separate IP addresses being used for outbound mail from those used for outbound NAT pool. Block outbound port 25 from the NAT pools and make your firewall notify you of any port 25 activity from any hosts as this could indicate they are infected. - When provisioning a new mail server IP, don't send more than 30 messages per minute (e.g. 0.5 messages/sec) for the first day and then increase the volume over the following week. I'm sure some will disagree with some of these, but I guarantee that if you follow all of these, then you'll never have an issue with a blocklist like ours. I hope this helps.