6 ms·

Isn't this spying on the user without user's consent? Me opening dev tools to view the source is a private activity. Is it okay to collect this kind of info and

Isn't this spying on the user without user's consent? Me opening dev tools to view the source is a private activity. Is it okay to collect this kind of info and use it to block access? Are there no regulations against this?

AlchemistCamp 4y ago
If it were a "private activity", they wouldn't know you did it. If your computer sends requests to their server about it, then it's not really fair of you to expect them not to be aware of it.
- eminent101 4y ago
  Does the computer really send requests to their server when I open dev tools? I checked and I couldn't find any request that was sent from Firefox or Chrome when I opened dev tools. Aren't they using a JavaScript based detection mechanism like listening for browser events on the client side or latching on to debugger to pull this information? Sounds to me like they are going out of their way to pull private information from my system that I or my system or my browser had no intention of sharing with them.
  - jibe 4y ago
    Check your console instead of the network tab - it will load css.map and js.map files. I never noticed until now, but .map requests don’t show in the network requests.
javajosh 4y ago
> Isn't this spying on the user without user's consent? Yes. > Is it okay to collect this kind of info and use it to block access? No. It's not okay. > Are there no regulations against this? Probably not. In this case the remedy is to just use another service, or DIY. And I also think that's a pretty reasonable remedy, which will send a message to others considering such actions. FWIW I would like to see regulations around intrusive spying on client machines via the browser or any other path. Ideally we'd get new, specific legislation around it. Something might also be done at the executive level at the FCC. Legislation is unlikely because of America's current flirtation with 3rd world style politics. In terms of advocacy, I would assume that the EFF is of a similar view. Other human rights groups would be supportive of such measures, since in addition to protecting consumers, they protect journalists and their sources as well. The people against will be state security services and all businesses powered by a targeted ad engine.
- JohnBooty 4y ago
  I'm not defending MailChimp (this devtools thing is pretty awful) but "just DIY it" is a bit glib. DIY'ing what MailChimp provides is... a lot. I wrote a sort of "DIY MailChimp" for a marketer back in the ancient days of the early 2000s. I did the tracking and email content bits. I did not handle the email servers themselves. Lot of work staying off of blacklists. It was something close to a fulltime job back then, and from what folks have told me it might be more like multiple fulltime jobs these days. Lots of anti-spam regulations to adhere to, and one or two false steps and you're going to wind up in an absolute hell where other email providers (Yahoo, Gmail, whoever) are not going to talk to your servers. Also need to figure out email templates that render consistently across webmail providers and browsers and mail clients. That is also a loooot. Making a consumer-friendly UI like Mailchimp is another massive task, but I guess you can skip that for your "DIY" solution. Again, I'm not defending Mailchimp. I hope I never have to dip my toes into this area again. It is hell.
  - javajosh 4y ago
    The users of mailchimp don't need to make another mailchimp. They just need to handle their own email needs. That's a big difference. It's still not easy, and I would never be glib about it, especially since I've never run my own mail server on my own domain name before. But...several full-time jobs? How much mail do you need to send before postfix on a $5 VPS falls over? In terms of composing html mail that looks good, that would take some time to learn. A day to get something passable, especially with LLM help? As for tracking, I am against image/pixel tracking in emails, I think it undermines trust, so I wouldn't implement it (or use it).
    - kxrm 4y ago
      > But...several full-time jobs? I think it depends on how important delivery is to your business. If your business team expects near 100% delivery and they want all the tracking features that give them insight into their promotional campaigns, then running email promotions on your own is quite a steep hill to climb. I run my own MTA on my own domain and only use it for verification purposes and I still have to fight with the free email providers every few weeks. It's definitely not a full-time job but I also have the joy of just not caring if a user doesn't get an email from my system. A agree with you somewhat that people reach for mass mail services too quickly sometimes but I also understand the perspective of engineers who have things like deadlines and other work to do where if I have the choice of working on truly new things to help grow the business I work for or handling email logistics, I know where I will point the my company.
karaterobot 4y ago
I don't know how they're doing it, but I assume they're using data given to them by your browser, e.g. measuring the difference in height/width between the window and the viewport. Either that, or (as someone upthread suggested) they're reading a request your browser sends for mapping files, which would again be information you provided. If anything, I guess your browser is the one spying on you, by providing this information. But, realistically, I don't think it counts as spying either way. Hostile behavior on Mailchimp's part, yes. Dumb idea, yes.

AlchemistCamp 4y ago

If it were a "private activity", they wouldn't know you did it. If your computer sends requests to their server about it, then it's not really fair of you to expect them not to be aware of it.

eminent101 4y ago
Does the computer really send requests to their server when I open dev tools? I checked and I couldn't find any request that was sent from Firefox or Chrome when I opened dev tools. Aren't they using a JavaScript based detection mechanism like listening for browser events on the client side or latching on to debugger to pull this information? Sounds to me like they are going out of their way to pull private information from my system that I or my system or my browser had no intention of sharing with them.
- jibe 4y ago
  Check your console instead of the network tab - it will load css.map and js.map files. I never noticed until now, but .map requests don’t show in the network requests.

javajosh 4y ago

> Isn't this spying on the user without user's consent? Yes. > Is it okay to collect this kind of info and use it to block access? No. It's not okay. > Are there no regulations against this? Probably not. In this case the remedy is to just use another service, or DIY. And I also think that's a pretty reasonable remedy, which will send a message to others considering such actions. FWIW I would like to see regulations around intrusive spying on client machines via the browser or any other path. Ideally we'd get new, specific legislation around it. Something might also be done at the executive level at the FCC. Legislation is unlikely because of America's current flirtation with 3rd world style politics. In terms of advocacy, I would assume that the EFF is of a similar view. Other human rights groups would be supportive of such measures, since in addition to protecting consumers, they protect journalists and their sources as well. The people against will be state security services and all businesses powered by a targeted ad engine.

JohnBooty 4y ago
I'm not defending MailChimp (this devtools thing is pretty awful) but "just DIY it" is a bit glib. DIY'ing what MailChimp provides is... a lot. I wrote a sort of "DIY MailChimp" for a marketer back in the ancient days of the early 2000s. I did the tracking and email content bits. I did not handle the email servers themselves. Lot of work staying off of blacklists. It was something close to a fulltime job back then, and from what folks have told me it might be more like multiple fulltime jobs these days. Lots of anti-spam regulations to adhere to, and one or two false steps and you're going to wind up in an absolute hell where other email providers (Yahoo, Gmail, whoever) are not going to talk to your servers. Also need to figure out email templates that render consistently across webmail providers and browsers and mail clients. That is also a loooot. Making a consumer-friendly UI like Mailchimp is another massive task, but I guess you can skip that for your "DIY" solution. Again, I'm not defending Mailchimp. I hope I never have to dip my toes into this area again. It is hell.
- javajosh 4y ago
  The users of mailchimp don't need to make another mailchimp. They just need to handle their own email needs. That's a big difference. It's still not easy, and I would never be glib about it, especially since I've never run my own mail server on my own domain name before. But...several full-time jobs? How much mail do you need to send before postfix on a $5 VPS falls over? In terms of composing html mail that looks good, that would take some time to learn. A day to get something passable, especially with LLM help? As for tracking, I am against image/pixel tracking in emails, I think it undermines trust, so I wouldn't implement it (or use it).
  - kxrm 4y ago
    > But...several full-time jobs? I think it depends on how important delivery is to your business. If your business team expects near 100% delivery and they want all the tracking features that give them insight into their promotional campaigns, then running email promotions on your own is quite a steep hill to climb. I run my own MTA on my own domain and only use it for verification purposes and I still have to fight with the free email providers every few weeks. It's definitely not a full-time job but I also have the joy of just not caring if a user doesn't get an email from my system. A agree with you somewhat that people reach for mass mail services too quickly sometimes but I also understand the perspective of engineers who have things like deadlines and other work to do where if I have the choice of working on truly new things to help grow the business I work for or handling email logistics, I know where I will point the my company.

karaterobot 4y ago

I don't know how they're doing it, but I assume they're using data given to them by your browser, e.g. measuring the difference in height/width between the window and the viewport. Either that, or (as someone upthread suggested) they're reading a request your browser sends for mapping files, which would again be information you provided. If anything, I guess your browser is the one spying on you, by providing this information. But, realistically, I don't think it counts as spying either way. Hostile behavior on Mailchimp's part, yes. Dumb idea, yes.