Hacker News Reader

Comment by dangrossman | Hacker News Reader

I get so much spam from this site.

Nearly every day, I get 4 copies of a bunch of spam trying to sell me Shopify inventory management, Shopify store marketing, Shopify product feed management, Shopify shipping services, etc.

Why Shopify? Because there's a script tag on my sites with the word "shopify" in it. I don't run any Shopify stores.

Why 4 copies of every mail? Because I have 4 sites with that tag.

BuiltWith sells my contact info in their list of "Shopify websites", which these people toss into MailChimp and spam away, despite the fact that unsolicited mailings are a ToS violation there and everywhere else. I know BuiltWith is the source since one of them named their MailChimp list "BuiltWith Shopify US".

It's a brilliantly simple and profitable site that I wish I had come up with, but the fact that the business model they ended up at is basically "harvested e-mail vendor for spam" kinda sucks.

View on HN

Apologies Dan I've totally removed your website from the system - anyone can do this via http://builtwith.com/removals

Off topic: Kudos on a successful one man show! ...quite in the league of duckduckgo & SublimeText...

PS: I am also trying to do that at a smaller scale/success position as of now... :-)

"BuiltWith sells my contact info in their list of "Shopify websites", which these people toss into MailChimp and spam away, despite the fact that unsolicited mailings are a ToS violation there and everywhere else."

I was modded down a few months back for calling MailChimp a spamming service. Well, now we know they are. "Transactional e-mail delivery". Yeah, right.

I don't think even MailChimp claims to be for transactional emails as they specifically have a separate product for that called Mandrill.

MailChimp is 100% intended for marketing emails. Though I'm sure they at least try to have their customers not be spammers.

Mailchimp allows direct import of email addresses, rather than requiring a new opt-in through their platform as some similar services do. Direct list import = spam = more revenue for MailChimp.

While this may be abused by spammers, it's also a tool for legitimate users who want to transition to MailChimp with their existing subscribers.

I used to work for a company that had built up it's subscriber list over 10 years, we tried moving to a few other services but didn't get very far because they required actual physical proof that the user had opted-in to our mailing list, which we couldn't do (because nothing other than the email was ever logged). The only way to do it would have been to "resubscribe" all of the users to the new provider and hope they chose to opt in again. This likely would have lost us a significant percentage of our mailing list. There was no such requirement from Mailchimp, so you can guess who got our business.

How would you prove an opt-in, even if you had more info than just the email address? I mean, would a timestamp column suffice? What did they expect to see exactly?

In my experience they probably handle it based on the spam reports they get. They get feedback from all the major providers so if someone clicks the spam button they know.

If you import a huge list for spamming they will find out the first time you send out email and block your account.

1) Transactional email is Mandrill, not MailChimp. Different brands from the same company.

2) The only way to spam with MailChimp is to lie to MailChimp as you have to use the bulk/direct import. [e.g. There is a checkbox saying it was an opt-in only list, or at least there used to be]

How is MC a spamming service? How could they resolve this issue?

> How could they resolve this issue?

They can't. By definition they are email marketing aka spamming.

Email marketing and spamming are not the same thing. The difference is, if I signed up for it, it's not spam. If I didn't sign up for it, it is spam.

Unless you're trying to claim that the very concept of sending solicited marketing messages via email is inherently bad (which seems a ludicrous position to take), then calling MailChimp a spamming service seems like libel.

The problem is that 99.9% of people DIDN'T sign up even remotely voluntarily.

Most people provide an email address only because they get extorted if they don't, and the company they are providing it to makes it egregiously hard to find the "No, don't spam me you assholes" choice.

I know since I run my own email server. I can give out a unique address to every single company that demands it, and I am actively aggressive about the "No don't bug me" button.

I have 432 pieces of junk scattered across 22 unique email addresses that have been sold. THAT'S JUST TODAY

If Mailchimp wants to convince people that it's not just enabling a bunch of spammers, it's really easy--simply put an X-Mailchimp: line in every email. If that doesn't turn into an anti-spam keyword, they're not spammers.

Oh, whoops, we already did this experiment. They actually had to remove MailChimp identification from email blasts for exactly that reason.

You seem to be deliberately blaming MailChimp for something that is completely not their fault. I can't imagine how any marketing email vendor would possibly be able to distinguish between a legitimate email list (of people who signed up for it) and a list of people who didn't, given that the list is (presumably) provided by the company that wants to send the marketing email.

If you get spam that's sent via MailChimp, that's not MailChimp's fault, that's the spammer's fault. If a spammer sent you unsolicited email using their computer's built-in mail client, would you blame that mail client for the spam? No, you'd blame the spammer. So I don't get why you're trying to pin the blame here on MailChimp.

As for the X-Mailchimp suggestion, your assertion here is laughable. Of course they don't want to identify messages sent by them! Even though spamming is not their fault, they still recognize that a certain percentage of emails they sent are actually spam (they just have no way to identify that percentage ahead of time). And if they are sending enough spam, then any common identification for their emails is going to end up getting flagged as a spam indicator, which will cause all of their email to get filtered as spam (even though a lot of it isn't spam). And since their business is sending email, having all their email filtered as spam is obviously not compatible with their business.

Given all that, not identifying their emails as being sent by them is not some sign that they're doing something nefarious, it's simply common sense.

> And if they are sending enough spam, then any common identification for their emails is going to end up getting flagged as a spam indicator, which will cause all of their email to get filtered as spam (even though a lot of it isn't spam).

Postfix clearly identifies itself in email headers. Thunderbird clearly identifies itself in email headers. The ratio of non-spam to spam is high enough that the Bayesian filters don't train to recognize those as a spam keyword.

If MailChimp were a legitimate tool, it would fare the same. The fact that MailChimp doesn't meet that ratio means that too many people mark what is sent using it as spam.

Postfix isn't a marketing email tool. It's a general-purpose MTA. Thunderbird isn't a marketing email tool. It's a desktop email client. These are not at all analogous.

And you're continuing to ignore the distinction between a tool that is commonly used to send spam even though that's not its purpose, and a tool whose purpose is to send spam. MailChimp is the former, but you're treating it like the latter.

> As for the X-Mailchimp suggestion, your assertion here is laughable. Of course they don't want to identify messages sent by them! ... obviously not compatible with their business.

MailChimp does identify every message sent by them, and they do it with X-MailChimp type headers. http://i.imgur.com/a9bzEtG.png

Try to be more civil when disagreeing with someone. What's worse than being wrong? Being super arrogant and insulting while wrong. That was unnecessary.

I was going to make an excuse, but, you know what, I'm just wrong.

I checked my own Bayesian and MailChimp does keyword as a medium spam indicator, but not enough for an immediate dump.

Okay, I was wrong again.

When I went to look for MailChimp emails, I found that I didn't have any. Apparently, MailChimp's servers are actually blacklisted on my server. And apparently it was done by hand by me about 4 years ago (yay for revision control on config files--boo for terse log comments).

Something major happened about 4 years ago with MailChimp for me to actually construct a permanent blacklist entry by hand rather than let the keywords filter, but I guess I don't remember properly what the issue was anymore.

I trusted bsder's claim that they aren't identifying themselves, and made assumptions that it was because it was too high of a spam indicator. If they are identifying themselves, then apparently it's not high enough of a spam indicator, which just means that MailChimp doesn't send as much spam as people are assuming.

> What's worse than being wrong? Being super arrogant and insulting while wrong. That was unnecessary

No, what's unnecessary was that. You're being deliberately offensive here. I took bsder's claim in good faith, and you're calling me "super arrogant and insulting" for doing that. That was completely uncalled-for.

The issue with your comment isn't the subject matter of the discussion, or the correctness of your statements, it's the way you spoke to bsder. I respectfully disagree that my comment was uncalled for.

> your assertion here is laughable

This is an insult. That's what laughable means: his claim is so ludicrous that you could laugh about it. If you don't intend to insult someone who's not on stage delivering a comedy routine, then you shouldn't call their ideas laughable.

> Of course they don't

You purposely emphasized words in a way that, if emphasized by tone in speech, would come across as very condescending.

> obviously not compatible

Telling someone that it's "obvious" what they claimed is incorrect is arrogant. If it was obvious to them, they wouldn't have said it.

I really don't get what you're trying to accomplish here, besides being repeatedly insulting. This is not productive, this is not appropriate, and nobody asked you to do it. You know what's arrogant and condescending? You, right now, with your comments. Please stop.

You can black-list their IP's! Just make sure you do it via your smtp so that false-positive's at least know that their e-mails are not getting trhough.

Oh, I already did some of that. I've already killed about a dozen email addresses permanently, and anything sent to those triggers a black-list of the IP for an exponentially increasing amount of time.

I worked on a large UK domain sellers mail platform for a couple of years and I'd definitely consider pretty much all marketing mail as spam. The landscape has been so destroyed by tricks that it's near impossible to tell if anyone actually wanted your mail.

Examples:-

a) Opt-in unchecked. These guys are "doing it right" except they usually have this box right next to a probably completely unnecessary TOS box that's also unchecked. Anyone who isn't paying attention will just check all the boxes to get to the next stage.

b) Opt-in checked by default. Fuckers.

c) Opt-out checked by default. Praying on folks that uncheck anything with "opt" into it.

d) Opt-out unchecked by default. Praying on folks not paying attention.

Basically the only way you're not a spammer is probably if signing up for mail is seperate from the sign up process. The problem is, I think this is a proven way to generate more revenue so companies are not going to stop fiddling with it.

If companies are going to spam me I'd rather they did use MailChimp. At least they handle unsubscribes properly and seem to actually honour them.

Not necessarily...

Here are the CAN SPAM rules... . But following the law isn’t complicated. Here’s a rundown of CAN-SPAM’s main requirements:

Don’t use false or misleading header information. Your “From,” “To,” “Reply-To,” and routing information – including the originating domain name and email address – must be accurate and identify the person or business who initiated the message. Don’t use deceptive subject lines. The subject line must accurately reflect the content of the message. Identify the message as an ad. The law gives you a lot of leeway in how to do this, but you must disclose clearly and conspicuously that your message is an advertisement. Tell recipients where you’re located. Your message must include your valid physical postal address. This can be your current street address, a post office box you’ve registered with the U.S. Postal Service, or a private mailbox you’ve registered with a commercial mail receiving agency established under Postal Service regulations. Tell recipients how to opt out of receiving future email from you. Your message must include a clear and conspicuous explanation of how the recipient can opt out of getting email from you in the future. Craft the notice in a way that’s easy for an ordinary person to recognize, read, and understand. Creative use of type size, color, and location can improve clarity. Give a return email address or another easy Internet-based way to allow people to communicate their choice to you. You may create a menu to allow a recipient to opt out of certain types of messages, but you must include the option to stop all commercial messages from you. Make sure your spam filter doesn’t block these opt-out requests. Honor opt-out requests promptly. Any opt-out mechanism you offer must be able to process opt-out requests for at least 30 days after you send your message. You must honor a recipient’s opt-out request within 10 business days. You can’t charge a fee, require the recipient to give you any personally identifying information beyond an email address, or make the recipient take any step other than sending a reply email or visiting a single page on an Internet website as a condition for honoring an opt-out request. Once people have told you they don’t want to receive more messages from you, you can’t sell or transfer their email addresses, even in the form of a mailing list. The only exception is that you may transfer the addresses to a company you’ve hired to help you comply with the CAN-SPAM Act. Monitor what others are doing on your behalf. The law makes clear that even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law. Both the company whose product is promoted in the message and the company that actually sends the message may be held legally responsible.

Then any delivery service (online or real world) would be a spamming service.

Infrastructure is just the pipes, not the intent.

Report them to mailchimp here: http://mailchimp.com/contact/abuse/

I can't speak for them, but I've reported spam senders using other commercial senders and generally get an acknowledgement that it's looked into and they don't tolerate abuse.

You should paste the mails into the spamcop web interface. Hopefully it'll get mailchimp to shape up; that's what I do every time (in addition to clicking the mailchimp unsubscribe form and choosing "i never signed up for this list")

Even better, there an option "this email is spam and should be reported".

> You should paste the mails into the spamcop web interface. Hopefully it'll get mailchimp to shape up;

And it's this kind of reason which is why we can't use the Spamcop blocklists: They block way too much legitimate e-mail because they regularly end up blocking service providers due to actions of a few of their customers.

> In addition to the free version of the site, BuiltWith now has a SaaS-based membership model for users that want to take advantage of a number of services that the platform now provides around lead generation, sales intelligence, and market analysis. The most popular user case is a customer that uses curated data from BuiltWith as a lead list. For example, a business that has created a platform that allows businesses to send newsletters to customers may build a list of all companies in Australia using Campaign Monitor or Mailchimp to target for marketing activities.

Yeah, I really wish people would stop calling "lead generation" anything other than what it is. Spam.

> BuiltWith sells my contact info in their list of "Shopify websites"

This right here is why you should always get domain privacy.

+1 I wonder how many people just harvest whois info for email addresses

"domain privacy" is just another extortion scheme.

Providing a filtered email address without domain privacy is another option.

However, a domain needs to have a point of contact, in case of abuse or illegal activity. Domain privacy is a valid service, where the registrar serves as a proxy for you and hides your personal information from public view.

While you could argue that it should be included as a default service, the pricing of domains is almost entirely arbitrary anyway.

Seems I need to get into the spam business if it earns me this much dough.

Why not obfuscate your email?

I don't condone spamming, but anyone that has their email in plaintext knows what to expect.

I value being easy to contact more than having a spam-free inbox. Customer service is perhaps the top reason people give for using my products against alternatives, and is heavily correlated with someone becoming a long-term customer. I think you overestimate the amount of spam having an e-mail address on a webpage generates, too. These mails are about all I get.

You can easily obfuscate your email to web crawlers by generating the email text and link through javascript.

This is what many people like Cloudflare do.

Deleted comment

They could but they probably don't.

You could easily assemble it on hover or on click. And bait the bots by putting a hidden element above that if they are randomly activating events, then it disables your email display code. Or any number of tricks to make it impossible for any spammer to harvest your email unless they specifically target your script.

WHOIS isn't meant for soliciting. I don't check it regularly, and I would be surprised if any customers contacted you that way. But that's just me.

My email is in plain text all over the internet and I get next to no spam. The worst spam I've ever dealt with was from the Princeton Review–a supposedly legitimate business–after taking an LSAT sample quiz online. They wouldn't leave me alone for years despite my best efforts.

Have you reported them to MC?

Reply on news.ycombinator.com