3 ms·

Are you sure that 100% of companies have not sold unsubscribed users information? As if there is even single counter-example you should just automatically mark

by Ekaros 3y ago

Are you sure that 100% of companies have not sold unsubscribed users information? As if there is even single counter-example you should just automatically mark it spam and then email providers should blacklist the domain.

arp242 3y ago
That hugely draconian. Are you 100% sure you never just signed up for a newsletter and forgot about it? Are you 100% sure your email didn't end up there in some other way? I used to send out some newsletters for my website; just a programming blog thingy. It was just a form with a simple program on the server to collect email addresses. Wrote everything myself; no external service or whatnot involved. I got some pretty aggressive replies about people who insisted that I was spamming them. Did they forget (I didn't send out the newsletter very often)? Did someone typo their email and end up at the wrong person? Did some bot maybe fill in the form and pass the little captcha I added? Who knows. All I know is that there was a legit POST /subscribe request. And as someone who also worked with spam prevention: it's this kind of stuff that also makes legit spam detection harder than it needs to be. The "Report spam" button is not a "fuck you" button, but unfortunately many people seem to use it as such.
- Ekaros 3y ago
  With email spam it has been long proven that best way to act is to treat all actors as malicious. As there is enough malicious actors around. And it took me a minute to find phishing mail with unsubscribe link. Which entirely proves my original point. Sure those sending phishing mails won't stop the mails I probably ordered somewhere?
  - arp242 3y ago
    > And it took me a minute to find phishing mail with unsubscribe link. Which entirely proves my original point You weren't talking about phishing before. You're shifting this to something radically different.
    - Ekaros 3y ago
      I originally replied to comment stating: > Yeah no. Emails which include an unsubscribe link are legit enough to not do that. Actual spammers don't bother to include an unsubscribe link. I found a phishing email with unsubscribe link. Thus I think we can generalize that emails containing unsubscribe in general are not legit nearly enough of times to trust that. Thus only correct and safe way is to mark them as spam and let the email provider eventually to handle them correctly for everyone.
- gpderetta 3y ago
  You do not need to be 100% sure. 99% of the time you explicitly unsubscribed from all categories, but the sender just added a new one and helpfully opted you in. So, yes, "fuck you".
  - arp242 3y ago
    And that other 1%[1] is just collateral damage? "Sucks to be you!" Please note they were suggesting that a single email should "blacklist the domain". You are pretty much suggesting the very thing Microsoft is doing here. This is not a serious suggestion in any shape or form. [1]: A number I have serious doubts about by the way, but we'll use it for now.
    - gpderetta 3y ago
      There is a very simple solution to the collateral damage: don't send anything that can be construed as spam.
      - arp242 3y ago
        Collateral damage is by definition damage to innocents – people who have done nothing wrong. As I mentioned before, even with the best of intentions people can "construe your email as spam". People mark emails as spam as "fuck you". Bad support? Spam! Argument with a friend? Spam! Yes, people really do this. People can abuse your platforms in way you didn't foresee: either an outright security flaw or a "logic flaw" (e.g. one system I worked on the rate-limiter could be bypassed by using Cc, which was of course quickly solved, but people did unfortunately use it to send out spam). If you have any sort of "sign-up", even if paid only, people will try to abuse it to send spam. People's computers get hacked, and while botnet spam is less of an issue due to residential ISPs blocking SMTP traffic, abusing the hacked machine's Outlook or whatnot still happens. There's tons of cases where regular well-intentioned people send out spam. Anyone who claims any different has never seriously worked on any kind of anti-spam system with real-world usage. If this was an easy problem it would be a solved problem, but it's not, because it's a hard problem.
- justinclift 3y ago
  > Are you 100% sure you never just signed up for a newsletter and forgot about it? For me, I can be pretty sure as I have extensive email archives. Before claiming I've not signed up for stuff I check them first. :)
safety1st 3y ago
You're absolutely incorrect about this. What you're saying may have been true a long time ago but it's 100% wrong now. In 2023/2024 you should click unsubscribe links. No matter how spammy a sender is, an unsubscribe click is a big signal that they don't want to contact that email account again. It takes time and money to warm up a domain, prepare it for outbound email, and keep it from being blacklisted when you're sending out a high volume of mail. The days where someone can just spin up an email server in a couple of minutes and blast hundreds of thousands of people with spam are over. If you don't manage your reputation you'll get blacklisted in a matter of hours. The #1 way as a mailer to manage your reputation is to respect unsubscribe requests. Yes, clicking the unsubscribe link indicates that there's a real human checking the mailbox. But data resellers have many ways to verify the validity of a mailbox that are more effective than this one. And unlike this one, they don't indicate that the person dislikes receiving unsolicited email. So very few data resellers use unsubscribe clicks as a way to verify email validity, because if they do they'll be polluting their product with the emails of people who are likely to get pissed off by unsolicited mail, report it and get a customer's domain blacklisted. If the data reseller is selling "verified" data that is getting his customers blacklisted - he won't be in business for much longer. It's worth pointing out that not all unsolicited mail is illegal. There are exceptions carved out in US CAN-SPAM and in other jurisdictions. If you're a business in the US the law is basically that people can send you unsolicited marketing emails whether you like it or not, as long as they provide an unsubscribe link and respect your request if you click it. To not use the mechanism that is explicitly required by the law for your protection is shortsighted.
- tomjen3 3y ago
  I don’t know how often I have clicked the unsubscribe link only to find I am not unsubscribed. Plus the link is always at the bottom in a tiny footer. The mark as spam button has no such issue and hurts the sender to boot.
  - duckmysick 3y ago
    Another data point: since 2021, every time I clicked the unsubscribe link, I stopped receiving emails from those services. I also haven't seen those email addresses passed on to someone else (I use unique aliases).

by Ekaros 3y ago

arp242 3y ago

That hugely draconian. Are you 100% sure you never just signed up for a newsletter and forgot about it? Are you 100% sure your email didn't end up there in some other way? I used to send out some newsletters for my website; just a programming blog thingy. It was just a form with a simple program on the server to collect email addresses. Wrote everything myself; no external service or whatnot involved. I got some pretty aggressive replies about people who insisted that I was spamming them. Did they forget (I didn't send out the newsletter very often)? Did someone typo their email and end up at the wrong person? Did some bot maybe fill in the form and pass the little captcha I added? Who knows. All I know is that there was a legit POST /subscribe request. And as someone who also worked with spam prevention: it's this kind of stuff that also makes legit spam detection harder than it needs to be. The "Report spam" button is not a "fuck you" button, but unfortunately many people seem to use it as such.

Ekaros 3y ago
With email spam it has been long proven that best way to act is to treat all actors as malicious. As there is enough malicious actors around. And it took me a minute to find phishing mail with unsubscribe link. Which entirely proves my original point. Sure those sending phishing mails won't stop the mails I probably ordered somewhere?
- arp242 3y ago
  > And it took me a minute to find phishing mail with unsubscribe link. Which entirely proves my original point You weren't talking about phishing before. You're shifting this to something radically different.
  - Ekaros 3y ago
    I originally replied to comment stating: > Yeah no. Emails which include an unsubscribe link are legit enough to not do that. Actual spammers don't bother to include an unsubscribe link. I found a phishing email with unsubscribe link. Thus I think we can generalize that emails containing unsubscribe in general are not legit nearly enough of times to trust that. Thus only correct and safe way is to mark them as spam and let the email provider eventually to handle them correctly for everyone.
gpderetta 3y ago
You do not need to be 100% sure. 99% of the time you explicitly unsubscribed from all categories, but the sender just added a new one and helpfully opted you in. So, yes, "fuck you".
- arp242 3y ago
  And that other 1%[1] is just collateral damage? "Sucks to be you!" Please note they were suggesting that a single email should "blacklist the domain". You are pretty much suggesting the very thing Microsoft is doing here. This is not a serious suggestion in any shape or form. [1]: A number I have serious doubts about by the way, but we'll use it for now.
  - gpderetta 3y ago
    There is a very simple solution to the collateral damage: don't send anything that can be construed as spam.
    - arp242 3y ago
      Collateral damage is by definition damage to innocents – people who have done nothing wrong. As I mentioned before, even with the best of intentions people can "construe your email as spam". People mark emails as spam as "fuck you". Bad support? Spam! Argument with a friend? Spam! Yes, people really do this. People can abuse your platforms in way you didn't foresee: either an outright security flaw or a "logic flaw" (e.g. one system I worked on the rate-limiter could be bypassed by using Cc, which was of course quickly solved, but people did unfortunately use it to send out spam). If you have any sort of "sign-up", even if paid only, people will try to abuse it to send spam. People's computers get hacked, and while botnet spam is less of an issue due to residential ISPs blocking SMTP traffic, abusing the hacked machine's Outlook or whatnot still happens. There's tons of cases where regular well-intentioned people send out spam. Anyone who claims any different has never seriously worked on any kind of anti-spam system with real-world usage. If this was an easy problem it would be a solved problem, but it's not, because it's a hard problem.
justinclift 3y ago
> Are you 100% sure you never just signed up for a newsletter and forgot about it? For me, I can be pretty sure as I have extensive email archives. Before claiming I've not signed up for stuff I check them first. :)

safety1st 3y ago

You're absolutely incorrect about this. What you're saying may have been true a long time ago but it's 100% wrong now. In 2023/2024 you should click unsubscribe links. No matter how spammy a sender is, an unsubscribe click is a big signal that they don't want to contact that email account again. It takes time and money to warm up a domain, prepare it for outbound email, and keep it from being blacklisted when you're sending out a high volume of mail. The days where someone can just spin up an email server in a couple of minutes and blast hundreds of thousands of people with spam are over. If you don't manage your reputation you'll get blacklisted in a matter of hours. The #1 way as a mailer to manage your reputation is to respect unsubscribe requests. Yes, clicking the unsubscribe link indicates that there's a real human checking the mailbox. But data resellers have many ways to verify the validity of a mailbox that are more effective than this one. And unlike this one, they don't indicate that the person dislikes receiving unsolicited email. So very few data resellers use unsubscribe clicks as a way to verify email validity, because if they do they'll be polluting their product with the emails of people who are likely to get pissed off by unsolicited mail, report it and get a customer's domain blacklisted. If the data reseller is selling "verified" data that is getting his customers blacklisted - he won't be in business for much longer. It's worth pointing out that not all unsolicited mail is illegal. There are exceptions carved out in US CAN-SPAM and in other jurisdictions. If you're a business in the US the law is basically that people can send you unsolicited marketing emails whether you like it or not, as long as they provide an unsubscribe link and respect your request if you click it. To not use the mechanism that is explicitly required by the law for your protection is shortsighted.

tomjen3 3y ago
I don’t know how often I have clicked the unsubscribe link only to find I am not unsubscribed. Plus the link is always at the bottom in a tiny footer. The mark as spam button has no such issue and hurts the sender to boot.
- duckmysick 3y ago
  Another data point: since 2021, every time I clicked the unsubscribe link, I stopped receiving emails from those services. I also haven't seen those email addresses passed on to someone else (I use unique aliases).