6 ms·

To me the most important objection is that an email is a record of something, and needs to be self-contained and immutable for that reason. When I get an email

To me the most important objection is that an email is a record of something, and needs to be self-contained and immutable for that reason. When I get an email, I want to know that I can always come back to that exact email for reference, and that there's no way that it can have changed, or that the important information is externally referenced (and therefore also subject to change). I think this is one important reason that more and more emails are just links to some website with the information on it (often with a login required as well). It allows the company sending you the email to retain control of that information. If you email me a text or PDF invoice, I can always come back to it for my own reference. If you send me a link to one, there's no guarantee I can still access it later.

LoganDark 2y ago
> I think this is one important reason that more and more emails are just links to some website with the information on it (often with a login required as well). I hate this with all of my being. It's awful. Send me an email that tries to tell me how important the information is without actually giving me the information... and I won't read it, fuck you. You don't get to decide which information I find important.
- xp84 2y ago
  I agree wholeheartedly -- it's like getting a postcard saying "You have an important message from your doctor, go visit the doctor's office to find out what." I respect that some of this is ass-covering because of overreaching regulation (or in many cases probably overly-conservative readings of the vague regulations) especially with respect to HIPAA and Euro-style "Privacy" legislation, but personally I'd prefer to opt-out of all types of nanny-ism trying to 'protect my privacy' by sending me content-free email with links, that then require that I 'click to view' and then, 90% of the time now, return to my fucking email to retrieve a stupid code.
  - LoganDark 2y ago
    My doctor does it ("you have one new notification, log into our system to see it"), financial systems do it ("something something happened on your credit report, log into our system to see it"), legal systems do it ("you have something something communication, log in to download it"), etc. It's utterly infuriating.
    - SoftTalker 2y ago
      Some of these places are between a rock and a hard place. HIPAA or other rules may prevent a doctor from using email to send you personal medical information such as test results. For any of them, email isn't "secure" and they don't want to be accused of "leaking" personal or confidential information. GPG exists, but it's been a non-starter for the average user the entire time, so no reason to expect that it will suddenly become workable now.
      - briHass 2y ago
        Ironic, because it's assumed your email is insecure and visible to more than just you, but it's used as a password reset and/or 2FA mechanism for almost everything. It would be nice if sites had a checkbox that allowed you to affirm that your email is secure and private, so then detailed emails were sent.
        SoftTalker 2y ago
        There's no way to guarantee that. SMTP is not a secure protocol. Your message could be read by any intermediary along its delivery route.
        grayhatter 2y ago
        It is possible to deliver emails IFF the receiving server presents a valid TLS connection and cert. I don't think I've seen anyone actually enforce that though.
        2y ago
  - l72 2y ago
    I would happily go into my bank or medical provider and upload my pgp public key for them to encrypt emails with… Email is an incredibly important communication database and I expect my important communications to be there and be searchable.
ChuckMcM 2y ago
I believe this is exactly correct. Email is a 'paper trail' and being able to change that paper trail ex-post facto benefits the sender waaaaaaaaaaay more than it does the receiver. I met an engineer from Google who quit when they insisted on "dogfooding" this. They used the example, you send an email that says lets meet for dinner tonight at 6. You arrive and after 30 minutes begin to wonder, go back to your email and now it says meet "tommorow night" at 6. Are you crazy? Did you misremember? Or did the sender change the email after they sent it and you read it? How could you complain? As I understand it, it was met internally with "that isn't what we mean." But the ability to send HR important announcements and then change them after the fact is a capability that is just too tempting for HR to resist at some point.
- parl_match 2y ago
  > They used the example, you send an email that says lets meet for dinner tonight at 6. You arrive and after 30 minutes begin to wonder, go back to your email and now it says meet "tommorow night" at 6. Are you crazy? Did you misremember? Or did the sender change the email after they sent it and you read it? How could you complain? This is a calendar invite. And this is a completely valid use case, but it's useless if I don't have an edit log. It's crazy how many people miss that last part.
  - ChuckMcM 2y ago
    In current email you get ANOTHER email that says the invite has been updated. While it changes "automagically" on your Calendar. That second email is critical.
    - 5- 2y ago
      when i was forced (thankfully, briefly) to use outlook (web version), one of the big surprises was that rsvp'ing on the invite deleted the message. several times i came looking for that invite and felt gaslighted not to have it in my inbox.
      - 2y ago
albert_e 2y ago
Absoutely agree, Gmail started scraping all emails a decade ago. Amazon responded by removing all product and pricedetails from Order confirmation and Order shipping emails. We consumers lost out -- we dont have our own copy and archive of what we ordered. If Amazon links perish to link rot and we lose access to Amazon login, our past order and spend information is gone.
- joshstrange 2y ago
  When reconciling my budget (with YNAB) I often use gmail as my way to connect items to transactions [0]. I've found that I can just search for the amount that my card was charged in my email and find the Amazon email that relates to that order. Then, normally from the body, there is just barely enough information for me to know what I bought. That got annoying enough that I just wrote a chrome extension to scrape Amazon orders/transactions and auto-match and update my YNAB memo line with a summary of the items. That's a bit of a tangent just to say: yes, they nerfed their emails but not completely. [0] Yes, YNAB recommends that you enter transactions right as you make them, but that's not how I use it.
  - Fire-Dragon-DoL 2y ago
    Amazon has a "Transactions" tab in the payments section of your account that makes this easier (YNAB user here)
- mattzito 2y ago
  FWIW, as far as I'm aware, it wasn't gmail scraping that was the cause of Amazon pulling that information. It was third-party plugins that read people's inboxes to provide them with coupons, discounts, etc., and those companies would sometimes sell the pricing data. I assume Amazon wasn't thrilled about that, but there wasn't anything they (or gmail) could do about it as long as the user was granting them access to their inbox. But also - I just ordered something off of amazon and I noticed that the confirmation had the item that I ordered in it, albeit in a shortened/summarized way? So maybe they brought it back, figuring that with just part of the name, there's not much someone can do with the pricing information? Or maybe they just don't care anymore? (disclosure: I work at google, but not on this, but worked adjacent to the gmail team for a few years and am going off of my memory. I'll also tap the sign that Google doesn't mine your gmail for ads, for both consumer AND paying customers).
mcv 2y ago
> more and more emails are just links to some website with the information on it (often with a login required as well) And a 2FA SMS sent to your phone. > If you email me a text or PDF invoice, I can always come back to it for my own reference. If you send me a link to one, there's no guarantee I can still access it later. Download it. It sucks having to do that and maintaining your own archive instead of trusting your mailbox, but I guess there's some advantages to that as well.
- Nifty3929 2y ago
  Sure, I can download it if they send it as an attachment. Not so easy when it's an external reference. I guess I could login to the website and download... the web page? Well anyway I'm not going to.
m463 2y ago
> immutable I swear years ago I had a mail client where you could type into a received message and alter it. Maybe sun mail or early apple mail? they finally made the message pane immutable.
- andirk 2y ago
  I remember AOL email to AOL email had an "unsend" feature for a while.
maronato 2y ago
Does anyone remember PlutoMail[1], the client that let you send self destructing and editable emails? [1]: https://techcrunch.com/2014/06/18/pluto-mail/ https://techcrunch.com/2014/06/18/pluto-mail/
mschuster91 2y ago
> I think this is one important reason that more and more emails are just links to some website with the information on it (often with a login required as well). That's an unfortunate requirement these days. For one, in Europe concerns around GDPR: e-mail is not guaranteed (!) to be encrypted or protected against modification in transit so it might get snooped up on its way, which makes it a no-go for sensitive stuff such as healthcare information or other highly protected classes of PII, unless PDF encryption or other ways of encryption are used... but these have the issue that UX around many of them is horrible. A link to a portal however? Easy, and provides automatically the guarantee that the other person is who they claim to be. The second problem is deliverability: more than enough email providers still have laughably low limits (sometimes < 3MB), virus scanners don't like PDFs or ZIPs that they can't read (because they don't know the password, obviously), and on top of that come the usual anti-spam concerns. IMHO, the best way to go would be an extra header field, think like "X-External-Attachments: https://foo.com/<uuid>.pdf https://foo.com/<uuid>.pdf <hash-alg> <hash-value>"... this could be used by MUAs to prompt the user if they wish to download and store the file, provide cryptographic checks of the file, and sidestep the issue of dumbass middleboxes yeeting password-protected files, as the files can be scanned on the endpoint side.
- Nifty3929 2y ago
  I hate these EU requirements. They do nothing to help real users, and really make everything worse. Like, is it helpful that every single website now has an added banner that we have to click, but which still nobody reads and doesn't really help anything? All to avoid cookies, which are not really the source of the problem these laws were meant to address? ARRRGHHH! As far as the file size - does that critically important message need to be embedded in a 10MB PDF? Maybe we should go back to 50k limits and force them to put that one-liner in plain text in the email. ARRRGHHH! And get off my lawn! ARRRGHHH
  - __d 1y ago
    I think so. I click on “reject all”, and at worst “manage settings” and disable a bunch of stuff. I didn’t have that option before.
rajnathani 2y ago
But with remotely loaded img tags (automated emails don’t send images as static base64) that email is far from an immutable paper trail like how a PDF is.
- jasonfarnon 2y ago
  I agree, the ship sailed a long time ago. I have been archiving my emails since the 90s. Sometime around 2010 all the remotely loading emails came along, and since then I've several times gone back to look at an invite or announcement and find nothing but an html tag. I guess an archiver that would need print all my emails to a pdf or image file to preserve it, like the emails that show up in litigation. The tools I was using, gmvault or google's takeout, aren't made for this path we're on.
  - philsnow 2y ago
    I'm commenting on this way way too late for anybody to read it except for jasonfarnon, but: Doesn't gmail prefetch / proxy img srcs, in order to not give away tracking/open information to the sender? Or is that something they did a while back but then turned off... Anyway, it would be so lovely when you do a takeout of your gmail data, if they could give you both the original and also a version that had the src rewritten to either a base64-encoded copy of the image or a local file that's included in the takeout dump.
    - jasonfarnon 1y ago
      Yeah that would be cleaner than print to PDF. Basically a simplified version of the "Save webpage (complete)" option in modern browsers. As to the state of email tracking I'm not sure where that stands now, either.
- Nifty3929 2y ago
  Yes, of course, and that's why it's best not to put the important information into and image. Of course, many senders do this anyway, but at least it requires them to send me an image. No different really than sending me a link to the important information as I mentioned in my post. But let's not make this even easier or default please. It's bad enough as-is. A nice improvement would be for prominent clients like gmail to default to NOT display images. This would force bulk-senders (including legitimate ones) to stop putting the important info in images most of the time. Ditto with links - maybe the clients should stop making them clickable, forcing the user to copy-paste the link. Not sure about this one...

LoganDark 2y ago

> I think this is one important reason that more and more emails are just links to some website with the information on it (often with a login required as well). I hate this with all of my being. It's awful. Send me an email that tries to tell me how important the information is without actually giving me the information... and I won't read it, fuck you. You don't get to decide which information I find important.

xp84 2y ago
I agree wholeheartedly -- it's like getting a postcard saying "You have an important message from your doctor, go visit the doctor's office to find out what." I respect that some of this is ass-covering because of overreaching regulation (or in many cases probably overly-conservative readings of the vague regulations) especially with respect to HIPAA and Euro-style "Privacy" legislation, but personally I'd prefer to opt-out of all types of nanny-ism trying to 'protect my privacy' by sending me content-free email with links, that then require that I 'click to view' and then, 90% of the time now, return to my fucking email to retrieve a stupid code.
- LoganDark 2y ago
  My doctor does it ("you have one new notification, log into our system to see it"), financial systems do it ("something something happened on your credit report, log into our system to see it"), legal systems do it ("you have something something communication, log in to download it"), etc. It's utterly infuriating.
  - SoftTalker 2y ago
    Some of these places are between a rock and a hard place. HIPAA or other rules may prevent a doctor from using email to send you personal medical information such as test results. For any of them, email isn't "secure" and they don't want to be accused of "leaking" personal or confidential information. GPG exists, but it's been a non-starter for the average user the entire time, so no reason to expect that it will suddenly become workable now.
    - briHass 2y ago
      Ironic, because it's assumed your email is insecure and visible to more than just you, but it's used as a password reset and/or 2FA mechanism for almost everything. It would be nice if sites had a checkbox that allowed you to affirm that your email is secure and private, so then detailed emails were sent.
      - SoftTalker 2y ago
        There's no way to guarantee that. SMTP is not a secure protocol. Your message could be read by any intermediary along its delivery route.
        grayhatter 2y ago
        It is possible to deliver emails IFF the receiving server presents a valid TLS connection and cert. I don't think I've seen anyone actually enforce that though.
        2y ago
- l72 2y ago
  I would happily go into my bank or medical provider and upload my pgp public key for them to encrypt emails with… Email is an incredibly important communication database and I expect my important communications to be there and be searchable.

ChuckMcM 2y ago

I believe this is exactly correct. Email is a 'paper trail' and being able to change that paper trail ex-post facto benefits the sender waaaaaaaaaaay more than it does the receiver. I met an engineer from Google who quit when they insisted on "dogfooding" this. They used the example, you send an email that says lets meet for dinner tonight at 6. You arrive and after 30 minutes begin to wonder, go back to your email and now it says meet "tommorow night" at 6. Are you crazy? Did you misremember? Or did the sender change the email after they sent it and you read it? How could you complain? As I understand it, it was met internally with "that isn't what we mean." But the ability to send HR important announcements and then change them after the fact is a capability that is just too tempting for HR to resist at some point.

parl_match 2y ago
> They used the example, you send an email that says lets meet for dinner tonight at 6. You arrive and after 30 minutes begin to wonder, go back to your email and now it says meet "tommorow night" at 6. Are you crazy? Did you misremember? Or did the sender change the email after they sent it and you read it? How could you complain? This is a calendar invite. And this is a completely valid use case, but it's useless if I don't have an edit log. It's crazy how many people miss that last part.
- ChuckMcM 2y ago
  In current email you get ANOTHER email that says the invite has been updated. While it changes "automagically" on your Calendar. That second email is critical.
  - 5- 2y ago
    when i was forced (thankfully, briefly) to use outlook (web version), one of the big surprises was that rsvp'ing on the invite deleted the message. several times i came looking for that invite and felt gaslighted not to have it in my inbox.
    - 2y ago

albert_e 2y ago

Absoutely agree, Gmail started scraping all emails a decade ago. Amazon responded by removing all product and pricedetails from Order confirmation and Order shipping emails. We consumers lost out -- we dont have our own copy and archive of what we ordered. If Amazon links perish to link rot and we lose access to Amazon login, our past order and spend information is gone.

joshstrange 2y ago
When reconciling my budget (with YNAB) I often use gmail as my way to connect items to transactions [0]. I've found that I can just search for the amount that my card was charged in my email and find the Amazon email that relates to that order. Then, normally from the body, there is just barely enough information for me to know what I bought. That got annoying enough that I just wrote a chrome extension to scrape Amazon orders/transactions and auto-match and update my YNAB memo line with a summary of the items. That's a bit of a tangent just to say: yes, they nerfed their emails but not completely. [0] Yes, YNAB recommends that you enter transactions right as you make them, but that's not how I use it.
- Fire-Dragon-DoL 2y ago
  Amazon has a "Transactions" tab in the payments section of your account that makes this easier (YNAB user here)
mattzito 2y ago
FWIW, as far as I'm aware, it wasn't gmail scraping that was the cause of Amazon pulling that information. It was third-party plugins that read people's inboxes to provide them with coupons, discounts, etc., and those companies would sometimes sell the pricing data. I assume Amazon wasn't thrilled about that, but there wasn't anything they (or gmail) could do about it as long as the user was granting them access to their inbox. But also - I just ordered something off of amazon and I noticed that the confirmation had the item that I ordered in it, albeit in a shortened/summarized way? So maybe they brought it back, figuring that with just part of the name, there's not much someone can do with the pricing information? Or maybe they just don't care anymore? (disclosure: I work at google, but not on this, but worked adjacent to the gmail team for a few years and am going off of my memory. I'll also tap the sign that Google doesn't mine your gmail for ads, for both consumer AND paying customers).

mcv 2y ago

> more and more emails are just links to some website with the information on it (often with a login required as well) And a 2FA SMS sent to your phone. > If you email me a text or PDF invoice, I can always come back to it for my own reference. If you send me a link to one, there's no guarantee I can still access it later. Download it. It sucks having to do that and maintaining your own archive instead of trusting your mailbox, but I guess there's some advantages to that as well.

Nifty3929 2y ago
Sure, I can download it if they send it as an attachment. Not so easy when it's an external reference. I guess I could login to the website and download... the web page? Well anyway I'm not going to.

m463 2y ago

> immutable I swear years ago I had a mail client where you could type into a received message and alter it. Maybe sun mail or early apple mail? they finally made the message pane immutable.

andirk 2y ago
I remember AOL email to AOL email had an "unsend" feature for a while.

maronato 2y ago

Does anyone remember PlutoMail[1], the client that let you send self destructing and editable emails? [1]: https://techcrunch.com/2014/06/18/pluto-mail/ https://techcrunch.com/2014/06/18/pluto-mail/

mschuster91 2y ago

> I think this is one important reason that more and more emails are just links to some website with the information on it (often with a login required as well). That's an unfortunate requirement these days. For one, in Europe concerns around GDPR: e-mail is not guaranteed (!) to be encrypted or protected against modification in transit so it might get snooped up on its way, which makes it a no-go for sensitive stuff such as healthcare information or other highly protected classes of PII, unless PDF encryption or other ways of encryption are used... but these have the issue that UX around many of them is horrible. A link to a portal however? Easy, and provides automatically the guarantee that the other person is who they claim to be. The second problem is deliverability: more than enough email providers still have laughably low limits (sometimes < 3MB), virus scanners don't like PDFs or ZIPs that they can't read (because they don't know the password, obviously), and on top of that come the usual anti-spam concerns. IMHO, the best way to go would be an extra header field, think like "X-External-Attachments: https://foo.com/<uuid>.pdf https://foo.com/<uuid>.pdf <hash-alg> <hash-value>"... this could be used by MUAs to prompt the user if they wish to download and store the file, provide cryptographic checks of the file, and sidestep the issue of dumbass middleboxes yeeting password-protected files, as the files can be scanned on the endpoint side.

Nifty3929 2y ago
I hate these EU requirements. They do nothing to help real users, and really make everything worse. Like, is it helpful that every single website now has an added banner that we have to click, but which still nobody reads and doesn't really help anything? All to avoid cookies, which are not really the source of the problem these laws were meant to address? ARRRGHHH! As far as the file size - does that critically important message need to be embedded in a 10MB PDF? Maybe we should go back to 50k limits and force them to put that one-liner in plain text in the email. ARRRGHHH! And get off my lawn! ARRRGHHH
- __d 1y ago
  I think so. I click on “reject all”, and at worst “manage settings” and disable a bunch of stuff. I didn’t have that option before.

rajnathani 2y ago

But with remotely loaded img tags (automated emails don’t send images as static base64) that email is far from an immutable paper trail like how a PDF is.

jasonfarnon 2y ago
I agree, the ship sailed a long time ago. I have been archiving my emails since the 90s. Sometime around 2010 all the remotely loading emails came along, and since then I've several times gone back to look at an invite or announcement and find nothing but an html tag. I guess an archiver that would need print all my emails to a pdf or image file to preserve it, like the emails that show up in litigation. The tools I was using, gmvault or google's takeout, aren't made for this path we're on.
- philsnow 2y ago
  I'm commenting on this way way too late for anybody to read it except for jasonfarnon, but: Doesn't gmail prefetch / proxy img srcs, in order to not give away tracking/open information to the sender? Or is that something they did a while back but then turned off... Anyway, it would be so lovely when you do a takeout of your gmail data, if they could give you both the original and also a version that had the src rewritten to either a base64-encoded copy of the image or a local file that's included in the takeout dump.
  - jasonfarnon 1y ago
    Yeah that would be cleaner than print to PDF. Basically a simplified version of the "Save webpage (complete)" option in modern browsers. As to the state of email tracking I'm not sure where that stands now, either.
Nifty3929 2y ago
Yes, of course, and that's why it's best not to put the important information into and image. Of course, many senders do this anyway, but at least it requires them to send me an image. No different really than sending me a link to the important information as I mentioned in my post. But let's not make this even easier or default please. It's bad enough as-is. A nice improvement would be for prominent clients like gmail to default to NOT display images. This would force bulk-senders (including legitimate ones) to stop putting the important info in images most of the time. Ditto with links - maybe the clients should stop making them clickable, forcing the user to copy-paste the link. Not sure about this one...