7 ms·

I moved from letsencrypt over to AWS ACM, but the letsencrypt emails don't have an Unsubscribe :(

tux2bsd 4y ago
> the letsencrypt emails don't have an Unsubscribe Yes and that is really stupid, especially from a group of people who are otherwise very clever.
- deleted 4y ago
  [deleted]
- afiori 4y ago
  Newsletters or notifications?
  - tux2bsd 4y ago
    Irrelevant. Think of it this way, Let's Encrypt could be emailing a dead person and you can't tell them to fuck off.
- dicknuckle 4y ago
  Except that it does, just not via email. You have to unsubscribe the same way you subscribed.
  - wonderbore 4y ago
    That’s not enough. CAN-SPAM is nearly 20-years-old now, it’s not even a GDPR matter. The rule is pretty clear in having to provide an unsubscribe link in every email. It’s really quite annoying that companies have taken this “you can’t unsubscribe from service emails” approach and I wish this act would get a refresh 20 years later.
    - kayodelycaon 4y ago
      CAN-SPAM explicitly exempts "transactional or relationship messages". This email would qualify.
- jghn 4y ago
  I keep getting emails from them addressed to PERSON+ORG@MY_PERSONAL_DOMAIN. I've never heard of the person nor their org. I don't know why Let's Encrypt has their email the way they do. But I can't unsubscribe, nor do I want to invest the effort to track this person down.
  - toast0 4y ago
    As far as I recall, Let's Encrypt doesn't verify control of an email address before using it, so anyone can sign up with your personal domain. If you can, I'd set that address to be undeliverable in your MX, so their outgoing service will bounce it. Or mark as spam, because outside of sending verification mails, sending mail to unverified addresses is spam.
    - jghn 4y ago
      A while back I set a catchall address forwarding to my day to day gmail account, as part of a transition away from using my personal domain. TBH the only reason I noticed this. I've also been amused at some of the spam I receive now, messages to random nonexistent accounts telling them they need to log into DOMAIN.
flokoe 4y ago
> letsencrypt emails don't have an Unsubscribe Technically, this is not true. You can "unsubscribe" (read "remove") your email via the Certbot client. Nevertheless, I agree that this is far too complicated, and I do not understand why there is no form on their website. I wonder if this behavior is compliant with the GDPR.
- nisegami 4y ago
  I wonder if this is compliant with CAN-SPAM, let alone GDPR. Would like to see a web unsubscribe option added, though overall I'm not too upset about it.
  - wonderbore 4y ago
    It’s not. Providing an unsubscribe link is one of the main points of the act. On Wikipedia is the first point listed.
    - kayodelycaon 4y ago
      It doesn't fall under CAN-SPAM. This is a "transactional or relationship message".
      - wonderbore 4y ago
        Yeah, anyone can think of their emails as "relationship message". The point is that I don't want your relationship emails either, especially if I'm no longer actually using the service. The problem is that this is junk messaging that no one reads nor needs.
- afiori 4y ago
  If you can only subscribe via certbot or otherwise using you private keys then it should be fair to require the same to unsubscribe. A justification could be that email notifications are a security feature and to disable them you need strong authentication (an unsubscribe link in the email could used by anyone you forward the email)
db48x 4y ago
I think it happens automatically if you don’t have any active domains for a time, though I cannot recall where I read that.
cypress66 4y ago
To be fair they send less than 1 email a year (aside from notifying you if a domain is expiring because of incorrect configuration).
- BrandoElFollito 4y ago
  It does not have to be necessarily because of bad configuration. There are plenty of subdomains I abandonned and I am happy to see that LE cares enough to remind me that they will expire.

> the letsencrypt emails don't have an Unsubscribe Yes and that is really stupid, especially from a group of people who are otherwise very clever.

deleted 4y ago
[deleted]
afiori 4y ago
Newsletters or notifications?
- tux2bsd 4y ago
  Irrelevant. Think of it this way, Let's Encrypt could be emailing a dead person and you can't tell them to fuck off.
dicknuckle 4y ago
Except that it does, just not via email. You have to unsubscribe the same way you subscribed.
- wonderbore 4y ago
  That’s not enough. CAN-SPAM is nearly 20-years-old now, it’s not even a GDPR matter. The rule is pretty clear in having to provide an unsubscribe link in every email. It’s really quite annoying that companies have taken this “you can’t unsubscribe from service emails” approach and I wish this act would get a refresh 20 years later.
  - kayodelycaon 4y ago
    CAN-SPAM explicitly exempts "transactional or relationship messages". This email would qualify.
jghn 4y ago
I keep getting emails from them addressed to PERSON+ORG@MY_PERSONAL_DOMAIN. I've never heard of the person nor their org. I don't know why Let's Encrypt has their email the way they do. But I can't unsubscribe, nor do I want to invest the effort to track this person down.
- toast0 4y ago
  As far as I recall, Let's Encrypt doesn't verify control of an email address before using it, so anyone can sign up with your personal domain. If you can, I'd set that address to be undeliverable in your MX, so their outgoing service will bounce it. Or mark as spam, because outside of sending verification mails, sending mail to unverified addresses is spam.
  - jghn 4y ago
    A while back I set a catchall address forwarding to my day to day gmail account, as part of a transition away from using my personal domain. TBH the only reason I noticed this. I've also been amused at some of the spam I receive now, messages to random nonexistent accounts telling them they need to log into DOMAIN.

flokoe 4y ago

> letsencrypt emails don't have an Unsubscribe Technically, this is not true. You can "unsubscribe" (read "remove") your email via the Certbot client. Nevertheless, I agree that this is far too complicated, and I do not understand why there is no form on their website. I wonder if this behavior is compliant with the GDPR.

nisegami 4y ago
I wonder if this is compliant with CAN-SPAM, let alone GDPR. Would like to see a web unsubscribe option added, though overall I'm not too upset about it.
- wonderbore 4y ago
  It’s not. Providing an unsubscribe link is one of the main points of the act. On Wikipedia is the first point listed.
  - kayodelycaon 4y ago
    It doesn't fall under CAN-SPAM. This is a "transactional or relationship message".
    - wonderbore 4y ago
      Yeah, anyone can think of their emails as "relationship message". The point is that I don't want your relationship emails either, especially if I'm no longer actually using the service. The problem is that this is junk messaging that no one reads nor needs.
afiori 4y ago
If you can only subscribe via certbot or otherwise using you private keys then it should be fair to require the same to unsubscribe. A justification could be that email notifications are a security feature and to disable them you need strong authentication (an unsubscribe link in the email could used by anyone you forward the email)

db48x 4y ago

I think it happens automatically if you don’t have any active domains for a time, though I cannot recall where I read that.

cypress66 4y ago

To be fair they send less than 1 email a year (aside from notifying you if a domain is expiring because of incorrect configuration).

BrandoElFollito 4y ago
It does not have to be necessarily because of bad configuration. There are plenty of subdomains I abandonned and I am happy to see that LE cares enough to remind me that they will expire.