4 ms·

Sounds reasonable, but what if I lost the private key? Speaking from personal experience: I received 7 emails from them, for various "tag" parts of my email (u

by Lex-2008 4y ago

Sounds reasonable, but what if I lost the private key? Speaking from personal experience: I received 7 emails from them, for various "tag" parts of my email (username+tag@server.example). Two of them - for when I was playing with Caddy server many years ago (well before COVID) - and its "auto-https" feature. There's no chance I still have these keys - I likely `rm -rf`'d whole caddy directory.

afiori 4y ago
My guess would be that it should be a similar process to how you handle creating a new certificate if your private key is compromised / gets lost. You probably would need to reauthenticate via DNS, create a new private key and then do what you wanted to do. EDIT: this is just a guess.
- wonderbore 4y ago
  That does not sound practical nor necessary. An authentication should be required to disable a service, but is never necessary to stop notifications. In my view there’s only one thing to do when emails don’t contain an unsubscribe link: report spam — because it is, as described by CAN-SPAM.
  - afiori 4y ago
    There are many types of email notifications and for some read access is different than setup access. Consider an outage email containing a diagnostic report. You might be the relevant person on call for that email and based on the diagnostic you forward it to who should be most competent to fix the issue. This person/team has now read access to the email, but they should not be able to unsubscribe you from these notifications. In general unsubscribing should not be unduly harder than it needs to be. For marketing email the effort required should be zero; for critical security issues (like certificates) it should be more.
    - toast0 4y ago
      You could reasonably have an unsubscribe form that needs a token from the email and requests the address to avoid unintentional unsubscriptions, or you could have a double confirmation sent by email. If it's a mailing list, it's still the case that anyone on the list could unsubscribe, but everyone would know it had been done.
    - wonderbore 4y ago
      > Consider an outage email containing a diagnostic report So, here's the problem, I don't care. I left the company. I cannot access the account anymore. The project is dead. There are a million reasons why I just don't want your emails so there's no excuse to not add an unsubscribe link. The only messages that don't have to include such link are those that if missed/ignored lead to fees, fines, death, imprisonment and other real-life consequences. An update to your privacy policy does not fall into that category.
      - afiori 4y ago
        > there's no excuse to not add an unsubscribe link My point was not that you should keep receiving those emails, it was an example of the necessity of having sometimes other mechanisms. An unsubscribe email address could work better (assuming that if you can send arbitrary emails from an address then you control it).

afiori 4y ago

My guess would be that it should be a similar process to how you handle creating a new certificate if your private key is compromised / gets lost. You probably would need to reauthenticate via DNS, create a new private key and then do what you wanted to do. EDIT: this is just a guess.

wonderbore 4y ago
That does not sound practical nor necessary. An authentication should be required to disable a service, but is never necessary to stop notifications. In my view there’s only one thing to do when emails don’t contain an unsubscribe link: report spam — because it is, as described by CAN-SPAM.
- afiori 4y ago
  There are many types of email notifications and for some read access is different than setup access. Consider an outage email containing a diagnostic report. You might be the relevant person on call for that email and based on the diagnostic you forward it to who should be most competent to fix the issue. This person/team has now read access to the email, but they should not be able to unsubscribe you from these notifications. In general unsubscribing should not be unduly harder than it needs to be. For marketing email the effort required should be zero; for critical security issues (like certificates) it should be more.
  - toast0 4y ago
    You could reasonably have an unsubscribe form that needs a token from the email and requests the address to avoid unintentional unsubscriptions, or you could have a double confirmation sent by email. If it's a mailing list, it's still the case that anyone on the list could unsubscribe, but everyone would know it had been done.
  - wonderbore 4y ago
    > Consider an outage email containing a diagnostic report So, here's the problem, I don't care. I left the company. I cannot access the account anymore. The project is dead. There are a million reasons why I just don't want your emails so there's no excuse to not add an unsubscribe link. The only messages that don't have to include such link are those that if missed/ignored lead to fees, fines, death, imprisonment and other real-life consequences. An update to your privacy policy does not fall into that category.
    - afiori 4y ago
      > there's no excuse to not add an unsubscribe link My point was not that you should keep receiving those emails, it was an example of the necessity of having sometimes other mechanisms. An unsubscribe email address could work better (assuming that if you can send arbitrary emails from an address then you control it).