5 ms·

> letsencrypt emails don't have an Unsubscribe Technically, this is not true. You can "unsubscribe" (read "remove") your email via the Certbot client. Neverth

by flokoe 4y ago

> letsencrypt emails don't have an Unsubscribe Technically, this is not true. You can "unsubscribe" (read "remove") your email via the Certbot client. Nevertheless, I agree that this is far too complicated, and I do not understand why there is no form on their website. I wonder if this behavior is compliant with the GDPR.

nisegami 4y ago
I wonder if this is compliant with CAN-SPAM, let alone GDPR. Would like to see a web unsubscribe option added, though overall I'm not too upset about it.
- wonderbore 4y ago
  It’s not. Providing an unsubscribe link is one of the main points of the act. On Wikipedia is the first point listed.
  - kayodelycaon 4y ago
    It doesn't fall under CAN-SPAM. This is a "transactional or relationship message".
    - wonderbore 4y ago
      Yeah, anyone can think of their emails as "relationship message". The point is that I don't want your relationship emails either, especially if I'm no longer actually using the service. The problem is that this is junk messaging that no one reads nor needs.
afiori 4y ago
If you can only subscribe via certbot or otherwise using you private keys then it should be fair to require the same to unsubscribe. A justification could be that email notifications are a security feature and to disable them you need strong authentication (an unsubscribe link in the email could used by anyone you forward the email)
- Lex-2008 4y ago
  Sounds reasonable, but what if I lost the private key? Speaking from personal experience: I received 7 emails from them, for various "tag" parts of my email (username+tag@server.example). Two of them - for when I was playing with Caddy server many years ago (well before COVID) - and its "auto-https" feature. There's no chance I still have these keys - I likely `rm -rf`'d whole caddy directory.
  - afiori 4y ago
    My guess would be that it should be a similar process to how you handle creating a new certificate if your private key is compromised / gets lost. You probably would need to reauthenticate via DNS, create a new private key and then do what you wanted to do. EDIT: this is just a guess.
    - wonderbore 4y ago
      That does not sound practical nor necessary. An authentication should be required to disable a service, but is never necessary to stop notifications. In my view there’s only one thing to do when emails don’t contain an unsubscribe link: report spam — because it is, as described by CAN-SPAM.
      - afiori 4y ago
        There are many types of email notifications and for some read access is different than setup access. Consider an outage email containing a diagnostic report. You might be the relevant person on call for that email and based on the diagnostic you forward it to who should be most competent to fix the issue. This person/team has now read access to the email, but they should not be able to unsubscribe you from these notifications. In general unsubscribing should not be unduly harder than it needs to be. For marketing email the effort required should be zero; for critical security issues (like certificates) it should be more.
        toast0 4y ago
jrochkind1 4y ago
If you are a current user, it's possible GPDR actually requires them to send you notices of changes to policy and practices (where relevant to GPDR), without an opt-out? At any rate, it seems good practice to send such notifications. I don't believe you can usually opt out of "business communications" like this. Now, letsencrypt is a free service, and they may not be as good as they should about identifying who is a current user? If you don't have have certs that haven't expired, and they're still including you in business communications, then perhaps something isn't as targeted as it could be.
aaomidi 4y ago
Let’s encrypt doesn’t need to follow GDPR.

by flokoe 4y ago

nisegami 4y ago

I wonder if this is compliant with CAN-SPAM, let alone GDPR. Would like to see a web unsubscribe option added, though overall I'm not too upset about it.

wonderbore 4y ago
It’s not. Providing an unsubscribe link is one of the main points of the act. On Wikipedia is the first point listed.
- kayodelycaon 4y ago
  It doesn't fall under CAN-SPAM. This is a "transactional or relationship message".
  - wonderbore 4y ago
    Yeah, anyone can think of their emails as "relationship message". The point is that I don't want your relationship emails either, especially if I'm no longer actually using the service. The problem is that this is junk messaging that no one reads nor needs.

afiori 4y ago

If you can only subscribe via certbot or otherwise using you private keys then it should be fair to require the same to unsubscribe. A justification could be that email notifications are a security feature and to disable them you need strong authentication (an unsubscribe link in the email could used by anyone you forward the email)

Lex-2008 4y ago
Sounds reasonable, but what if I lost the private key? Speaking from personal experience: I received 7 emails from them, for various "tag" parts of my email (username+tag@server.example). Two of them - for when I was playing with Caddy server many years ago (well before COVID) - and its "auto-https" feature. There's no chance I still have these keys - I likely `rm -rf`'d whole caddy directory.
- afiori 4y ago
  My guess would be that it should be a similar process to how you handle creating a new certificate if your private key is compromised / gets lost. You probably would need to reauthenticate via DNS, create a new private key and then do what you wanted to do. EDIT: this is just a guess.
  - wonderbore 4y ago
    That does not sound practical nor necessary. An authentication should be required to disable a service, but is never necessary to stop notifications. In my view there’s only one thing to do when emails don’t contain an unsubscribe link: report spam — because it is, as described by CAN-SPAM.
    - afiori 4y ago
      There are many types of email notifications and for some read access is different than setup access. Consider an outage email containing a diagnostic report. You might be the relevant person on call for that email and based on the diagnostic you forward it to who should be most competent to fix the issue. This person/team has now read access to the email, but they should not be able to unsubscribe you from these notifications. In general unsubscribing should not be unduly harder than it needs to be. For marketing email the effort required should be zero; for critical security issues (like certificates) it should be more.
      - toast0 4y ago

jrochkind1 4y ago

If you are a current user, it's possible GPDR actually requires them to send you notices of changes to policy and practices (where relevant to GPDR), without an opt-out? At any rate, it seems good practice to send such notifications. I don't believe you can usually opt out of "business communications" like this. Now, letsencrypt is a free service, and they may not be as good as they should about identifying who is a current user? If you don't have have certs that haven't expired, and they're still including you in business communications, then perhaps something isn't as targeted as it could be.

aaomidi 4y ago

Let’s encrypt doesn’t need to follow GDPR.