4 ms·

It sounds like the emails were mostly HTML mail that fetched external images. HTML mail is a terrible thing that should be stopped, and HTML mail that fetches

It sounds like the emails were mostly HTML mail that fetched external images. HTML mail is a terrible thing that should be stopped, and HTML mail that fetches anything external is a security problem. It's nice to know that these Fab people were thinking about their customers, but the bigger picture here is that HTML mail was being abused to violate those same customers' privacy. It may have been for a good reason, but it was still a bad thing to do and legitimizing the practice will make it easier to carry out attacks via email. The solution to inbox clutter is filtering. If users are too lazy to make filters, then the problem is with the effort required to make filters.

encoderer 14y ago
Obviously you're entitled to your opinion. But I think the fact that users opt-in to HTML emails and engage with them far more frequently than text opt-in and engagement indicates that your opinion is an outlier. I like HTML email. I opt-in only to companies that interest me enough to do so. Those times when I'm opted-in accidentally by not unchecking a box or whatever during checkout I just unsubscribe from and move on. What I have left is useful content in my inbox, some of it more directly sales oriented, the rest more generally informational. Similarly, for certain senders, I chose to tell Gmail to always load their images — including tracking pixels. It's not a violation of my privacy any more than the numerous pixels on any other website I read.
- betterunix 14y ago
  I have little doubt that I am an outlier, since most users have no idea what HTML even is. I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox. HTML mail itself is a security problem. It has been used for fairly sophisticated phishing attacks in the past: http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attached-html-forms-instead-of-embedded-urls/ http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache... It is almost certainly being used for phishing attacks now. It makes it difficult to give users visual cues about which emails can be trusted, since the sender could have embedded HTML in the message to present that same queue. An attacker might give the user the idea that a message was digitally signed by using HTML mail. Security with HTML mail is a serious enough concern that the DoD will sometimes convert all incoming HTML mail to plaintext as a precaution: http://it.slashdot.org/story/06/12/24/1922216/department-of-defense-now-blocking-html-email http://it.slashdot.org/story/06/12/24/1922216/department-of-... "It's not a violation of my privacy any more than the numerous pixels on any other website I read." In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation.
  - eric-hu 14y ago
    > In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation. So...the web at large violates people's privacy. I can agree to that, but I prefer a world where everyone has easy access to large amounts of information. If the available communication mediums are only those that are secure but difficult to use, then the ecosystems of many sites would be much smaller. I can't imagine trying to browse Facebook or Yelp over a TOR connection. It's feasible but annoying to me. That tells me most of my friends and family would simply consider this process unfeasible and not use it.
    - betterunix 14y ago
      You know, there was a time when browsing the web did not entail constant violations of your privacy. The web has always been open and has always been giving people easy access to information, since its very inception; the assault on privacy came later, when greedy advertisers showed up and took advantage of security problems and user ignorance. While Tor is fairly annoying for most people (even myself), other privacy-protecting systems are less annoying. I have yet to hear someone complain about using ABP, which I would classify as privacy protecting (it blocks a large number of common tracking systems). I suspect nobody would complain about Firefox blocking tracking cookies by default either. Really, we can live in a world where privacy is respected if we are willing to do so and willing to deploy the necessary technologies. One of my side projects is to develop a system that allows targeted ads to be delivered in a privacy-preserving fashion, so that advertisers can know which ads are successful without knowing whether any individual person actually viewed or clicked on their ads (using cryptographic techniques). My point is that there is no need to violate privacy and that better technologies can be developed and deployed.
      - encoderer 14y ago
        You know, the "Greedy Advertisers" showed up when "Greedy Website Operators" decided that they didn't want to pay out of pocket to provide people with information. And that, actually, they'd like to make a buck or two doing it. The web today has far more information and functionality than ever before. Much of this free to me because of advertising. You act like the advertisers some how force things down your throat. If you don't want to deal with advertising, the answer is simple: Avoid websites that rely on advertising dollars.
dasil003 14y ago
I understand where you're coming from, but you're swimming upstream in a raging torrent and being carried away at 100x the speed of your progress. The filter side can always be better, sure, but HTML is tremendously successful and it only annoys a tiny minority. It's not going anywhere, accepting this will create less cognitive dissonance for yourself.
- betterunix 14y ago
  I am fine swimming upstream. I browse with Javascript disabled, I am not on any social networking sites, I do not have a smartphone, etc. I do not get too stressed about these things as long as I can keep doing things my way. Ultimately, I think filtering is going to win. The problems with HTML mail are going to become more severe, not less. Phishing attacks are becoming more and more of a problem, and HTML mail makes phishing attacks much easier to carry out. The sort of tracking that Fab used to detect who was actually reading their mail could just as easily be used to identify potential targets for scams, or in a coordinated attack of some kind. We cannot continue to leave ourselves open to such attacks -- eventually we are going to have to start blocking HTML mail or at least blocking external images/etc. Filters that are good enough to reduce clutter are already starting to be deployed e.g. GMail's Priority Inbox, and GMail already blocks external images by default.
pyre 14y ago
| HTML mail is a terrible thing that should be stopped How so? Obviously the full set of HTML isn't optimal, but just using a subset of HTML formatting for things like headings, etc isn't that bad.
- betterunix 14y ago
  Anything other than basic text formatting is at least a major security problem. The simplest scenario is a phishing attack that disguises itself as a plaintext message, with blue underlined URLs that are actually links to the attacker's site. There have also be CSRF attacks carried out by HTML mail. More sophisticated attacks are also possible: http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attached-html-forms-instead-of-embedded-urls/ http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache... Even more sophisticated attacks could be imagined. Suppose you train users to look for a digital signature check; an HTML message could be used to create something that looks like such a check, tricking people into believing they received a signed message. The sort of monitoring used to unsubscribe Fab's readers could have been used to determine when people are at their desks in a particular office, or who is more likely to read a scam message. It is a no-brainer: HTML mail allows the sender of a message to render things of their choosing on your screen, and potentially execute code they have written on your computer (similar things can be said about the web; the difference is that setting up a website is useless if nobody visits it, but with email you get to send someone the message without waiting for them to request it). There are other complaints about HTML mail, but the security angle is biggest in my opinion.
DanBC 14y ago
> HTML mail is a terrible thing that should be stopped, Yes. Really, yes. Please, if you offer email please also offer plain text email.
benihana 14y ago
betterunix has spoken folks. If we just do what he thinks is best, the world would be a better place. Your little 'opinions' are cute but they ultimately don't matter, because betterunix has decided what is best, and that is that HTML mail is terrible and should be stopped. TEXT FOR US ALL.
- raylu 14y ago
  Would you have not chosen an ad hominem attack if he had prefixed his opinion with "in my opinion?" Would you demand that everyone post that way?
  - nwienert 14y ago
    Sometimes I think people use these logical classifications to downplay others too liberally. In this case benihana's sarcasm is effective because it uses ad hominem. It's meant to point out that perhaps his response is too absolutist given it's a not widely held opinion.
    - raylu 14y ago
      Again, should any opinion posted here that is not widely held be prefixed with "in my opinion?" Does that make it more acceptable?

encoderer 14y ago

Obviously you're entitled to your opinion. But I think the fact that users opt-in to HTML emails and engage with them far more frequently than text opt-in and engagement indicates that your opinion is an outlier. I like HTML email. I opt-in only to companies that interest me enough to do so. Those times when I'm opted-in accidentally by not unchecking a box or whatever during checkout I just unsubscribe from and move on. What I have left is useful content in my inbox, some of it more directly sales oriented, the rest more generally informational. Similarly, for certain senders, I chose to tell Gmail to always load their images — including tracking pixels. It's not a violation of my privacy any more than the numerous pixels on any other website I read.

betterunix 14y ago
I have little doubt that I am an outlier, since most users have no idea what HTML even is. I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox. HTML mail itself is a security problem. It has been used for fairly sophisticated phishing attacks in the past: http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attached-html-forms-instead-of-embedded-urls/ http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache... It is almost certainly being used for phishing attacks now. It makes it difficult to give users visual cues about which emails can be trusted, since the sender could have embedded HTML in the message to present that same queue. An attacker might give the user the idea that a message was digitally signed by using HTML mail. Security with HTML mail is a serious enough concern that the DoD will sometimes convert all incoming HTML mail to plaintext as a precaution: http://it.slashdot.org/story/06/12/24/1922216/department-of-defense-now-blocking-html-email http://it.slashdot.org/story/06/12/24/1922216/department-of-... "It's not a violation of my privacy any more than the numerous pixels on any other website I read." In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation.
- eric-hu 14y ago
  > In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation. So...the web at large violates people's privacy. I can agree to that, but I prefer a world where everyone has easy access to large amounts of information. If the available communication mediums are only those that are secure but difficult to use, then the ecosystems of many sites would be much smaller. I can't imagine trying to browse Facebook or Yelp over a TOR connection. It's feasible but annoying to me. That tells me most of my friends and family would simply consider this process unfeasible and not use it.
  - betterunix 14y ago
    You know, there was a time when browsing the web did not entail constant violations of your privacy. The web has always been open and has always been giving people easy access to information, since its very inception; the assault on privacy came later, when greedy advertisers showed up and took advantage of security problems and user ignorance. While Tor is fairly annoying for most people (even myself), other privacy-protecting systems are less annoying. I have yet to hear someone complain about using ABP, which I would classify as privacy protecting (it blocks a large number of common tracking systems). I suspect nobody would complain about Firefox blocking tracking cookies by default either. Really, we can live in a world where privacy is respected if we are willing to do so and willing to deploy the necessary technologies. One of my side projects is to develop a system that allows targeted ads to be delivered in a privacy-preserving fashion, so that advertisers can know which ads are successful without knowing whether any individual person actually viewed or clicked on their ads (using cryptographic techniques). My point is that there is no need to violate privacy and that better technologies can be developed and deployed.
    - encoderer 14y ago
      You know, the "Greedy Advertisers" showed up when "Greedy Website Operators" decided that they didn't want to pay out of pocket to provide people with information. And that, actually, they'd like to make a buck or two doing it. The web today has far more information and functionality than ever before. Much of this free to me because of advertising. You act like the advertisers some how force things down your throat. If you don't want to deal with advertising, the answer is simple: Avoid websites that rely on advertising dollars.

dasil003 14y ago

I understand where you're coming from, but you're swimming upstream in a raging torrent and being carried away at 100x the speed of your progress. The filter side can always be better, sure, but HTML is tremendously successful and it only annoys a tiny minority. It's not going anywhere, accepting this will create less cognitive dissonance for yourself.

betterunix 14y ago
I am fine swimming upstream. I browse with Javascript disabled, I am not on any social networking sites, I do not have a smartphone, etc. I do not get too stressed about these things as long as I can keep doing things my way. Ultimately, I think filtering is going to win. The problems with HTML mail are going to become more severe, not less. Phishing attacks are becoming more and more of a problem, and HTML mail makes phishing attacks much easier to carry out. The sort of tracking that Fab used to detect who was actually reading their mail could just as easily be used to identify potential targets for scams, or in a coordinated attack of some kind. We cannot continue to leave ourselves open to such attacks -- eventually we are going to have to start blocking HTML mail or at least blocking external images/etc. Filters that are good enough to reduce clutter are already starting to be deployed e.g. GMail's Priority Inbox, and GMail already blocks external images by default.

pyre 14y ago

| HTML mail is a terrible thing that should be stopped How so? Obviously the full set of HTML isn't optimal, but just using a subset of HTML formatting for things like headings, etc isn't that bad.

betterunix 14y ago
Anything other than basic text formatting is at least a major security problem. The simplest scenario is a phishing attack that disguises itself as a plaintext message, with blue underlined URLs that are actually links to the attacker's site. There have also be CSRF attacks carried out by HTML mail. More sophisticated attacks are also possible: http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attached-html-forms-instead-of-embedded-urls/ http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache... Even more sophisticated attacks could be imagined. Suppose you train users to look for a digital signature check; an HTML message could be used to create something that looks like such a check, tricking people into believing they received a signed message. The sort of monitoring used to unsubscribe Fab's readers could have been used to determine when people are at their desks in a particular office, or who is more likely to read a scam message. It is a no-brainer: HTML mail allows the sender of a message to render things of their choosing on your screen, and potentially execute code they have written on your computer (similar things can be said about the web; the difference is that setting up a website is useless if nobody visits it, but with email you get to send someone the message without waiting for them to request it). There are other complaints about HTML mail, but the security angle is biggest in my opinion.

DanBC 14y ago

> HTML mail is a terrible thing that should be stopped, Yes. Really, yes. Please, if you offer email please also offer plain text email.

benihana 14y ago

betterunix has spoken folks. If we just do what he thinks is best, the world would be a better place. Your little 'opinions' are cute but they ultimately don't matter, because betterunix has decided what is best, and that is that HTML mail is terrible and should be stopped. TEXT FOR US ALL.

raylu 14y ago
Would you have not chosen an ad hominem attack if he had prefixed his opinion with "in my opinion?" Would you demand that everyone post that way?
- nwienert 14y ago
  Sometimes I think people use these logical classifications to downplay others too liberally. In this case benihana's sarcasm is effective because it uses ad hominem. It's meant to point out that perhaps his response is too absolutist given it's a not widely held opinion.
  - raylu 14y ago
    Again, should any opinion posted here that is not widely held be prefixed with "in my opinion?" Does that make it more acceptable?