The trouble with text-only email | Hacker News Reader

The trouble with text-only email

lwn.net

191 pointscorbet152 comments

I don’t understand this sort of “right to track” that so many organizations seem to have. I don’t care if modern technology gives them a way to do it, I have a right to block or otherwise avoid loading whatever I want. Somehow 20 years ago businesses managed to judge how effective their communications/ads were without tracking; let them go back to that.

The article is quite specific in why Mozilla wants to track emails - email being sent to dead email accounts causes greylisting/blacklisting problems for them; they want to be able to unsubscribe inactive accounts, and the only way to determine account inactivity is through some sort of feedback mechanism.

I guess privacy is a middling concern in the face of the all important greylist.

So it seems, the conclusion here after all that's happened in the past few months is that modern Mozilla is no longer a privacy-first company when they're inconvenienced by that stance. Their rallying cry is now nothing more than "we're not as bad as Google".

What a sad state of affairs for the Internet in general.

Did you read the compromise that they found, near the end of the article? It's fine privacywise.

For me, the alarming fact is that this "privacywise" option was not the firs one chosen. Instead, they went with a "privacyunwise" option as a default, and only backed out because of user uproar. Bad Mozilla!

I strongly suggest you look at the actual discussion that happened [1].

One Mozilla employee, trying to solve a specific technical problem but not necessarily having thought through all the implications of the proposed solution, suggested the "privacyunwise" option on a public mailing list that Mozilla uses for discussing decisions like this. It's a public list because that's how Mozilla prefers to operate.

In the 24 hours that follow, there are 5 responses asking for a clearer description of the problem being solved and why this specific "unwise" option is considered the best solution. Three of those responses are from Mozilla employees. Following this, the author of the original proposal says that clearly more work is needed in terms of solving the particular problem they are facing.

A few days later, there were three more mails objecting to the proposal; two from employees, one from a non-employee.

A few days after that, the original proposal author came back with what you call the "privacywise" option.

So:

1) The "privacyunwise" option was not _chosen_. It was _proposed_, on a list specifically designed to evaluate the sanity of such proposals. This list happens to be public, which is why you know that the option was considered at all before being discarded as not compatible with Mozilla's principles.

2) The "uproar" was largely, but not entirely, by Mozilla staff.

The "Bad Mozilla" conclusion can only be based on a misunderstanding of what happened here...

Disclaimer: I work for Mozilla, I saw this thread; I did not reply to it because other people got there first and I would just be repeating what they said, but had they not replied I most certainly would have.

[1] https://groups.google.com/forum/#!msg/mozilla.governance/WWK... and following thread.

Why can't they just ask the recipients to respond if they want to continue getting emails, and drop any addresses that don't?

That's exactly the end result they came to (again, explained in the article). "But, once a year, those subscribers will get a message asking them to click on a link to confirm their continued interest in remaining on the list."

Wine mailing lists do this, works great.

Since forever I've been reading html mail using 'lynx -dump'. That never had any negative effect.

So my guess is that this particular kind of subscriber tracking is not used all that much (on technical mailing lists).

So Mozilla are claiming that has a negative effect on their sending reputation.

If that's true - it's a problem with the companies we've collectively chosen to outsource email reputation to - not with people who want to receive plain text email.

It’s not a problem for the 4 people who do that.

It becomes a problem when you pump lots of email into a good sized provider, and your open rates are poor. Google knows more about what mail you read than you do.

Google knows, for example, that I get the Vagrant-DigitalOcean mailing list mail, and open it maybe a handful of times a year. If they are downgrading that mailing list's reputation based on that they're 100% wrongly reading my intentions into their data. That's Google's fault (even if they're externalising the costs ont ot he mailing list).

I must be missing something here.

If the email account is dead, sender (Mozilla in this case) will get an error reply such as "550 No such account", etc. When that happens, obviously, Mozilla should stop sending to that account.

The stated problem is with accounts that are inactive but still open. A gmail account that hasn't been touched in 10 years, for example.

Will that produce a bounce (and so.. graylisting/blacklisting)? I think not, but I may be wrong.

BTW the OP said "dead", not "inactive but still open"

No bounce. My reading of the article is that the problem is with accounts that are still valid, but inactive. If you send a lot of mail to such accounts, e-mail providers flag you as spammy, apparently.

So instead of making a fuss about broken anti-spam measures that are breaking email, mozilla gives in to tracking?

No. They proposed one way of handling it. People didn't like the proposal. They've come up with another way.

...which is remarkable because the email providers are the ones who are keeping the accounts open.

All they need to do is internally maintain a list of dormant accounts (as defined by not connecting to read email in some period of time); send a series of warnings to those accounts; stop accepting email for those accounts; at some point, delete the accounts and let mail bounce. Document the policy and the timeline.

What am I leaving out? Oh, forwarding accounts. Let the user mark them as forwarding accounts and change the "dead" heuristic to spot when all mail sent by the account's rules is bouncing.

I suppose that might cut the statistical boasting a bit (12 billion active users!) but at this point nobody has any sympathy for marketing departments anyway.

Email providers track "engagement", not just overall account activity. Plenty of "marketing" messages are sent to still active account and just go undread. Enough of this will cause messages to be routed to the bulk/spam folder.

That’s just one use case.

There’s a category of bulk mail that isn’t spam, but isn’t read. The providers punish those mailers who overload on those unread messages.

I doubt this explanation. I have personally seen spamhaus blacklist a newsletter that was subscribed to using double opt-in. What happened: the e-mails never bounced, the provider just closed down and - what a "coincidence" - the domain ended up being owned by someone who immediately used it as a "spam honeypot" for spamhaus.

It's apparently impossible to protect a sender against this by other means than detecting real user interaction. Alternatively, blacklist providers doing this could be ignored...

The way most people solve this is with a unique code attached to some tracking pixel that gets picked up when the HTML email is opened. We use an alternate of embedding the unique code in the links for the email so that even a text only email will trigger a click for that user if they copy/paste the link. You lose "open" tracking, but this isn't too bad unless you are selling ad impressions for your emails.

What about your subscribers which use text only email?

The links in the text email look like:

    https://www.example.com/foo/bar?blah_id=123456&utm...

If you don't copy/paste a link from any email within a year you end up falling off the "active users" segment and we stop wasting our time sending you emails. For text-only users (which we seem to have a few who have "clicks" but no "opens"). The particular system I work with is actually slightly more sophisticated and considers usage from a lot of channels (push message consumption, email opens and clicks, app usage, alexa usage, bot interactions, and website usage). If you don't do any of those things you fall into less and less frequent push/email interactions until we stop bothering with routine newsletter/updates messages except for an occasional "please come back"-style campaign.

I don't understand how copy/paste can trigger the tracking on your side. Can you please explain?

I am using mutt to read emails and vim to write them, I'd be very surprised if copy/paste has any effect for you.

The URL holds an unique id for each mail sent, such as the `blah_id=123456` example in the parent comment.

I understand that. I don't understand how copy/paste has anything to do with pinging anything on the internet with that code.

Is this maybe some gmail thing? I can't think of mechanism that makes copy/paste trigger this.

Copy pasting into the browser to view the link triggers this, just copying doesn't. If I understood the previous comment correctly, the author copies links into the browser instead of clicking them (since they aren't clickable links).

"Copy/paste" here means "Copy the URL, paste it into the address field of a Web user-agent program, and initiate navigation to that URL in that Web user-agent program".

I suspect the phrasing was used since the discussion is about text-only email and, this being Hacker News, someone might have nit-picked that they view plaintext emails in a mail user agent program which does not scan for strings matching the format of a URL and offer a direct way to click on them or otherwise trigger automated opening of them in a Web user-agent program, and so the person who wrote "copy/paste" had to avoid saying "click on the link".

And how many email users load images by default? How many of Mozilla's more technical demographic?

If I legitimately want emails from you (Mozilla seems likely) and you stop sending them, I'm going to be irritated. But if you stop because your phone home 1x1.gif doesn't load, that doesn't mean I wasn't reading them.

At least for my site, we consider multiple channels of engagement when calculating whether a user who is subscribed to something is active enough to bother messaging. If you don't click/open the emails (as far as our tracking can tell), but your account still opens our app, you'll keep on getting email updates until you unsubscribe via the unsub link, the profile preferences, or you close your account.

Mozilla is probably in a bit weirder position because their value-prop isn't in curating articles and videos the user is interested in. They don't require the users to login to use Firefox, and thus can't know if text-only users are using their emails unless they process unique ids on links inside the email (and that's the last step of the usual funnel, which means the segment definition is going to have to be really long (probably a year)).

I use MDN at least once a week, but I never log in. Hard for them to tell my email address is engaged.

Supposedly, some ISPs recycle dead accounts as spam traps.

http://docs.briteverify.com/spamtraps/

Now, keep in mind the source of that information sells mailing list cleaning solutions, and it may be "email marketer" superstition, I don't know.

Big SMTP won't tell because they don't want a client to scan for valid accounts.

Many people block tracking pixels (by not loading images) anyway, so it doesn't completely make sense. Is the plan to automatically unsubscribe everyone who doesn't load images in emails?

Why not ask the users to check in once a month or so by having them click a link?

That way, it's on the user to remain active. If they don't click the link?

So sad but sayonara.

> the only way to determine account inactivity is through some sort of feedback mechanism.

Or a timeout (distributed systems 101). Just time-out accounts and send a good-bye email that has a one-click reanimation link.

Yep, i'm on several mailing lists that send me a "confirm you're alive" link once a year. Works just fine.

From the article:

"an acceptable compromise has been found, and the text-only option will remain. But, once a year, those subscribers will get a message asking them to click on a link to confirm their continued interest in remaining on the list. That should allow Mozilla to prune its inactive readers"

So that's exactly what Mozilla actually ended up doing.

Making spam lists opt-in? I'm pretty sure there's some kind of secret blood oath amongst marketing types that none shall ever make it simpler or more convenient to get off a mailing list, let alone making it harder to stay on one.

Where I live it is required by law for mailing list emails to have an unsubscribe link at the bottom :)

That's what bounces are for. If email is deliverable, it is going to an "active" account. There are several mailing lists I retain for posterity, since I've seen a good handful of them simply disappear along with the archives.

Maybe they should limit this measure only to receivers which have a known reputation of downgrading senders of unopened mail.

Consider a user who just keeps clicking "mark as junk" until he stops seeing Mozilla mails, instead of unsubscribing. Or an overzealous system that marked a Mozilla mail as junk once, and nobody complained, so it keeps doing it. The user's account still exists and mail can still be delivered so there's no bounce response, but each mail Mozilla sends will be treated as evidence that Mozilla is spamming.

Isn't this what "List-Unsubscribe" header is for? The email client should display Unsubscribe option instead of Mark as junk or offer to unsubscribe first.

That's equivalent to following a link on the email, and it's a well known recommendation that you should never follow links from spam emails.

That said, gmail does offer to follow the unsubscribe link for you when you mark an email as junk.

The major players tend not to bounce emails. They accept all mail at the edge, and then blackhole it once it's actually looked at by the backend.

The 'right to track' here is because Mozilla is getting blacklisted for sending to now-nonexistent addresses, and when they're blacklisted, it's hard to get off the blacklist.

As an example, one company I work for is on the blacklist RFC-Clueless, which blacklists you for not following the RFC and having the required default mailboxes (webmaster@, abuse@, etc). We use gmail, and it was a screw-up in their system - something I got them to fix about 2.5 years ago. Despite multiple requests to get off the RFC-Clueless list (their request link being obfuscated), they've done nothing about it. It's particularly galling that a blacklist that blocks you for 'being a bad netizen' is themselves an atrocious netizen.

So, if a client has an IT dept that subscribes to RFC-Clueless, there's simply no way we can send them email - it's very difficult for our sales staff to convince their contacts to start that conversation with their own IT, especially in the initial stages of the trial.

So I can understand that Mozilla might want to keep themselves off mailing blacklists, especially when they're sending mail to now-dead addresses that have previously asked for mail to be sent.

> Mozilla is getting blacklisted for sending to now-nonexistent addresses

Not quite, the problem is that the addresses do still exist, but they're inactive and the mail is never being read. It sounds like some blacklists use "continuing to send mail to known-inactive addresses" as an indicator of a bad sender.

> So I can understand that Mozilla might want to keep themselves off mailing blacklists

So can I, but the desire/need to do this does not imply a "right" to track the opening of messages in the manner initially planned. The reader does however have a right to privacy, whether they link know about a 1x1 image and its effects or not.

Email deliverability is a giant pain to have to deal with, of course, so the motivation to overlook this small sacrifice of privacy is pretty high.

If you can show who's running those lists, and their names, sue them for damages. Garnishment is very much a thing.

Admittedly, attacking others in a system that features money as a signifier as status/power isn't usually wise. But given these people are trying to use blacklists as a form of power, this can be used against them. At least if the threat of monetarily loss isn't realized, the fact that you're willing to drag them into court will... expedite any issues you have with being on that list.

20 years ago they made X amount of money, now they want to make more 2017 levels of money. Also society changed and people respond differently to old communication tricks.

Nobody in journalism makes any money, especially not compared to 20 years ago.

Advertisement revenue was cut in half, because the inventory grew, and the middle men (google and facebook) started taking half of it.

At exactly the same time, subscription revenue also dropped by about a quarter for most publications.

And, at least as important, the cash cow of publishing has almost completely disappeared: classifieds, obits, and job ads.

Even if there was a "right to track", then it would be the user who grants it.

Because it originates with the user, the user could refuse to grant it or revoke it.

The question for Mozilla is who are they accountable to?

These are not open source volunteers.

Mozilla can claim it is not a "for-profit" but its contributors are well-compensated, with salaries comparable to people working at the for-profit companies releasing web browsers. (Google Chrome was started by former Mozilla developers.)

"We are proudly non-profit, non-corporate and non-compromised."

https://donate.mozilla.org/

Question: What makes Mozilla any more trustworthy to users than the other companies releasing web browsers?

Question: Why should they care about users any more than those companies?

Annual salaries from 2015 (reportable compensation from IRS Form 990):

  Mitchell Baker, Chair $977,382 + $45,530
  Bob Lisborne, Director $92,000
  Mark Surman, Exec. Dir./President $170,699 + $40,602
  Jim Cook, Treasurer $934,526 + $45,530
  Angela Plohman, Secretary/VP Operations $121,322 + $30,342
  Christopher Lawrence, VP Learning $153,492 + $62,538
  An-Me Chung, Dir. Partnerships 154,946 + $72,672
  Daniel Sinker, Dir. Partnerships 123,630 + $64,215
  Hiram Paul Johnson, Marketing Lead 126,605 + 54, 903
  Andrea Wood, Online Organizing/Fundraising Lead $135,048 + $46,322
  Samuel Dyson, Director Hive Chicago $114,860 + $63,549

https://static.mozilla.com/moco/en-US/pdf/2015_Mozilla_Found...

Question: How much of this comes from donations and how much comes (indirectly) from sale of advertising (by "partners")?

They get about half of their total revenue ($12,429,238) from licensing royalties ($6,466,566) according to the 2015 filing.

Question: Are there really any incentives to serve users in ways that the companies releasing web browsers do not? Users want the tracking to stop. Would Mozilla have disincentives to help users in this regard?

There is no "corruption" being implied by the above. It is legal to pay high salaries and not pay taxes.

I don't know what you're trying to say? If you're accusing the Mozilla management of corruption, you should really offer more than the fact that, yes, people at non-profits also get salaries.

The only qualitative difference for a non-profit is the lack of owners demanding return on invested capital.

> How much of this comes from donations and how much comes (indirectly) from sale of advertising (by "partners")?

Well you have the numbers right there. Mozilla doesn't sell ads anywhere as far as I know. Apart from grants and donations, they only have the google search deal as a major source of income.

The deal is with Yahoo.

Side remark: One twelfth of Mozilla’s annual revenue goes directly to its highest-paid employee? Talk about 10x programmer, that lady must be a genius.

Mozilla employs about 1000 people and has revenues of around 300M-400M, so there's been a miscalculation there. 1/400th with 1000 employees doesn't sound very high at all.

The numbers are probably from the Mozilla Foundation, which only employs a few people, so obviously they're going to be remunerated highly percentage-wise.

Ah, ok, thank you, that explains it a little bit at least! :)

Two years after Mozilla Foundation was announced in 2003, the Mozilla Corporation was announced. It engages in commerce and it keeps profits. It is responsible for paying taxes.

"'The formation of the Mozilla Corporation gives the Mozilla Foundation new capabilities for becoming even more successful in delivering innovative open source end-user products," said Mitchell Baker, president of Mozilla Corporation. "The Mozilla Corporation is not a typical commercial entity. Rather, it is dedicated to the public benefit goal at the heart of the Mozilla project, which is to keep the Internet open and available to everyone.'

The broad adoption of Mozilla Firefox has created significant economic value both in Firefox itself and in a commercial ecosystem that is developing around Firefox."

http://www.mozilla.org/press/mozilla-2005-08-03.html

Is the delivery of "end-user products" not the source of revenues for the Corporation? What if all those products are delivered for free? Then where do the revenues come from?

Giving away free software while still producing significant revenues from commerce seems to resemble the other corporations that deliver web browsers and other free web software. Regarding those companies, it has been said that "Users are the product".

Note I am not implying anyone has done anything wrong. Each party is expected to pursue its own self-interest. Freedom of choice is a necessary component of an "Internet that is open and available to everyone".

These are just some facts that I believe could be relevant to users who are not interested in marketing user data or the advertising sales ecosystem.

I hear you – but think of tracking as a form of payment for consuming the product / service / content. You are not paying them – their advertisers are, and ads are more valuable the more tracking and attribution they come with. Data is money, and by blocking their access to data you are affecting their monetization strategy. I'm not saying it's right, I'm saying that's how the business model is set up because that's what consumers demand – paid browsers and media sites are niche or nonexistent.

If I buy an item from a store and get an email receipt with tracking, this gives the vendor a whole bunch of information about me. If I already paid for the good/service, that’s objectionable.

I don’t buy “identifiable meta-information as payment”. It is fundamentally intrusive.

> I don’t care if modern technology gives them a way to do it, I have a right to block or otherwise avoid loading whatever I want.

Nobody has any rights whatsoever in this context, neither morally nor legally. It's all the law of the jungle, with the interested users perpetually a step ahead of advertisers, and the average user a step behind.

> Somehow 20 years ago businesses managed to judge how effective their communications/ads were without tracking; let them go back to that.

Well, they really didn't. And now that they've seen how much money they're wasting, it is no longer possible to feign ignorance.

But more important is the fact that the user's interests are not the total opposite of these publishers. Mpst companies publishing serious journalism on the internet, for example, barely break even. Any money they earn is directly invested in the product. Now you can obviously tell them to fuck off and they can't really stop you. But that's a collective action problem, like global warming or littering: if everyone follows your lead, everyone (including you) will suffer.

Many of the advertising practices of the last decade obviously went too far. But they were created not by collective greed, but panic. I wish we'd come up with a compromise that respects both users and creators.

"Somehow 20 years ago businesses managed to judge how effective their communications/ads were without tracking; let them go back to that. reply"

I definitewly agree that the fix to a lot of the tracking/privacy issue are on the client end. But, the value on the other end is not the same regardless of tracking.

20 years ago (even 10-15) online ad markets were tiny, even relative to the number of users. It just wasn't possible to translate users into dollars in the way it is today. It's not a 20% difference, it's a large multiple. The Google & FB machines are powered by highly trackable advertising. FB ads were worthless before they made a big jump in trackability a few years ago. The "feedback loop" is the difference.

20 years ago, advertising was powering mostly entertainment, some news and such. Today, it's also powering driverless car research, OSs, VR...

Indirectly, a lot of the startup boom is funded by trackable ads. Trackable ads translate "really popular, lots of DAUs" into "potential unicorn" on the backs of many envelopes which later get filled with cash. Feedback loops make this possible.

I'm not argueing against privacy. I actually agree with you. Clients (email clients, browsers..) should enforce privacy, serving users not advertisiers.

I'm just being realistic about the scale of the issue. Online, advertising is tracking. Advertising-tracking is at the heart of consumer technology's income & investment stream. If tracking goes away tomorrow,it takes a bunch of stuff with it.

I clearly remember when web developers had a ‘right’ to show popup ads and couldn’t possibly survive without Flash.

They’ll live.

I don't understand the problem: mozilla is basically saying "we need to track you, otherwise gmail/yahoo/hotmail thinks we are sending spam". But if that's the case, isn't the problem the to aggressive spam filtering of gmail/yahoo/hotmail? _Or_ mozilla is really sending spam. But knowing them I don't think that's the case.

So the real problem here is that everyone is using gmail/yahoo/hotmail, and those providers have broken spam filters. They should fix them.

Yes, I agree, they should. But they wouldn't. Mozilla is as powerless here as you or me.

Which is really irrelevant--if you want to subscribe to Mozilla mailing lists, you should be using an email provider that doesn't randomly label emails as spam, rather than Mozilla annoying everyone else because of it.

what email provider is that, with perfect spam filtering?

How is perfect spam filtering the only alternative to obviously terrible and trivial to improve spam filtering?!

SMTP has a perfectly good verification mechanism. You send a VRFY request with an email address, and the server tells you if the address is valid. The trouble is that many mail servers don't handle VRFY requests, because spammers used them to explore the space of destination email addresses.

There's also "Disposition-Notification-To", which sends back a message when an email is read. Most real mail clients tell the user this is being done, and allow the user to decide whether they want to send back a receipt. Does Gmail support that at all?

This. SMTP is broken because EmailSPs have found people to be spammy - using verify and messages with zero content to find addresses of people not opted in.

Added additional ways to track for 'are we sure it is a user' is just another way that bypasses privacy to be able to send more email.

Solution? Get real leads, not just honeypots. Make your unsubscribe so easy. Keep customers active with promotions and products.

"Keep customers active with promotions and products."

Sure, but that isn't exactly easy to do for Mozilla in these cases. The people on these lists are not "customers" and they almost universally do not want "promotions and products" in the ordinarily understood meaning.

Serious question - how would you explain your strategy to Mozilla in the context of their lists?

> how would you explain your strategy to Mozilla in the context of their lists?

I'd explain this to Mozilla by showing evidence of high click through rates in directed and singular "Calls to Action" - whether that's downloading a browser update, pages with new products, and features.

The easy to unsubscribe is also key here.

But also seeking better/additional channels such as "advertising" on related products and services (much like the service they provide for Google)

"One metric that some sites evidently use is email sent to accounts that are known to be inactive, which is seen as a sign of a spammy originator. This, seemingly, is where Mozilla has run into trouble. One way to avoid this problem is to track which recipients are actually reading their email; any recipient who doesn't look at any messages for a period of time can then be unsubscribed."

Shouldn't the sites bounce those emails in a way Mozilla can detect and therefore use to prune?

To me this reads more as an excuse for even more user tracking. Seems to be the new thing at Mozilla :(

Read the same to me.

Seems that if they were actually concerned for conserving user privacy, their "compromise" should have been approach #1, with more intrusive user tracking a fallback position iff the original "compromise" solution didn't work.

That they didn't even seem to trial a privacy-conserving measure first speaks volumes.

I can only point you to https://news.ycombinator.com/item?id=15484417 and suggest that you go read the actual discussion and understand the context.

"They" were very much concerned about user privacy, if "they" is Mozilla as a whole.

That casts a very different light on the situation. Thank you for providing the additional context.

Sounds like they're talking about perfectly valid email addresses that just aren't being checked anymore. I'm sure most people have like half a dozen of those.

I seem to increasingly get unsubscribed from mailing lists because of not opening them, which is very frustrating.

Sometimes it's because I'm reading but not triggering their tracking mechanisms. Other times it's because I'm subscribed to lists that I only occasionally read, but want to have available for reference.

Either way: if I've actively subscribed to a list, I have some reason for doing so. I don't want to be unsubscribed!

I'd be happy to add my email address to some whitelist of 'assume I'm reading anything I'm subscribed to', if only it were possible.

Otherwise, maybe I need to forward mails to some service that will open them all in a browser, and trigger all the tracking pixels.

FWIW Gmail does that: it triggers trackbacks from a pool of Google-owned IP addresses that don’t map to any specific users, and then serves themselves the images to the clients. This is why they now load images by default: there’s no more privacy issue.

GMail is itself a major privacy issue.

There is still a privacy issue since Google only caches external images at read-time, leaking the time you read your email to the sender.

I see a huge problem in this. Mozilla likely won't use IP to identify users. They will use the unique link in each email.

> Shouldn't the sites bounce those emails

Maybe they _should_, but in practice they _don't_.

The real problem here isn't text-only email, or even Mozilla being concerned about not being able to track who is opening messages sent to its mailing lists. The real problem is that certain large webmail providers are making a hostile takeover bid for the fundamental infrastructure that email represents. The likes of Google have decided that their own interpretation of how email should work is more important than things like following standards and delivering properly formatted and correctly sent messages.

Been a while since this was fixed now, but I once discovered a method to track views of even plain text emails when the user was using Thunderbird - https://www.grepular.com/DNS_Prefetch_Exposure_on_Thunderbir... - thanks to the DNS lookups caused by URL pre-fetching. Same issue worked with various webmail implementations at GMail, Hotmail, Roundcube, IMP, and probably more. You can test your client for this particular flaw and many more at a website I built - https://www.emailprivacytester.com

Mozilla seem to be falling into the same trap as the internet in general, albeit a good long while later. Just a little bit of tracking here, how is that harmful? Just a little bit of tracking there, too. It's really not a problem. Telemetry this browser feature, Google Analytics that addon page. And like the frog in the pan of water, eventually we're all cooked.

"Don't be evil" is deprecated, Mozilla Manifesto #4 will be too, soon enough.

Those are both anonymized, though. That doesn't make it okay, necessarily, but that's a pretty clear line, so I don't think this is a frog in boiling water situation.

They also willing to have conversations with users about privacy in the open [0] [1], and both telemetry and Google Analytics can be turned off. (The latter is already turned off if you've enabled Do Not Track.)

Finally, Mozilla apparently spent a year working on a contract with Google before they even enabled Google Analytics [2], so it wasn't a matter of slapping Google Analytics on a page because they thought one page couldn't possibly hurt.

That being said, I'm skeptical of their use of Google Analytics, so I'm not trying to defend that. I do think it's unfair to imply Mozilla is carelessly following the rest of the web, though.

[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=697436

[1]: https://github.com/mozilla/addons-frontend/issues/2785

[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=697436#c14

This leads me to believe that Mozilla may have recently been caught up in the same spamhaus spam-trap debacle as many others and was backlisted. They decided to send a permission pass email because if an open or click hasn't recently been recorded, there isn't really any other way for them to know which emails in their list are no longer active.

This also confirms my belief that one or more of the big email ISP's (yahoo, gmail, etc.) may have sold a crap load of their inactive email accounts to spamhaus recently. Doesn't matter if these once active emails did opt in to your list in the past, you will still get backlisted now that they are in the spamhaus spam-trap database.

I don't understand why the email providers don't simply shut down the inactive accounts. This would then result in a hard bounce to the sender allowing them to remove the emails from their list.

It's especially fun if users enter a spam trap email (something along the lines of a@free-email-service.tld) and they blacklist you for sending a opt-in email to that address :]

What is the "spamhaus spam-trap debacle" you are referring too? I'd like to know more.

I think the whole "non profit" angle of Mozilla is suspect. When so much of their revenue is tied to search engines[0], they're really more of subsidiary than a charity.

That, and having the marketing person insist that they need message tracking to prevent being blacklisted is shady as hell. Mozilla has plenty of smart people who already know several other ways to skin that cat.

[0] https://en.wikipedia.org/wiki/Mozilla_Foundation#Financing

Sources of revenue are not relevant to the categorization as a non-profit. Only the use of funds is.

Meeting all of the current legalities is a low bar.

I'm sure there's some anti-smoking "non-profit" out there that gets 90% of its revenue from Philip Morris, and is 100% compliant with the law. Doesn't make it right though.

You'll have to pry plaintext email from my cold, dead hands. If you send me an HTML email it goes right in the bin.

I see this a lot on HN, but how does that work in practice? nearly all common graphical email clients compose in HTML mode by default. Most signatures that I see contain at least one clickable link.

Do you just delete all emails from people who dare to use Gmail? Or Apple Mail? Or Outlook? Are they all horrible, horrible people not worth corresponding with?

All common graphical email clients that I know of send a HTML message as a "multipart/alternative", with both a plain text and a HTML version. In fact, AFAIK an email having only a HTML version (or the plain text version being too different from the HTML version) is an indication that the email is probably spam.

The text-only email clients just ignore the HTML version and show the plain text version of the email.

Ahh right, that makes more sense. So all the people who proudly boast that they send HTML emails straight to /dev/null actually mean "emails that don't come with a text version".

Sounds less hardball when you put it put that :-)

It's funny how the entire privacy nightmare was finally avoided by a simple link to click once a year. This itself shows that such involuntary tracking has no useful purpose which cannot be achieved in a simpler manner that preserves privacy.

Who are the organisations keeping these lists of 'inactive' accounts and doing it in such a sloppy way that receiving text mail counts as not existing? I sure as hell haven't told them whether or not I use any of my email addresses. Isn't the solution to correct them, not to go along with them?

Surely Mozilla has enough clout to at least get a message to them rather than just throwing in the towel?

The problem is that they are Mozilla's competitor (Google - Gmail). It's not named explicitly but the dots are pretty damn obvious to connect, I think.

> not that there was really any need for more evidence that the email system is broken

Broken? Where? Is there a reliable open standard alternative to passing messages to one another with attachments, encryption, self-hosting, and local archiving as actual options on the table? And no, IMs are not an alternative for anything longer than a few lines.

Email is only "broken" if you don't use it properly.

Email is only "broken" if you don't use it properly.

Email is plenty broken today even if you do use it properly. In my various business interests, we frequently see mails bounced or silently dropped even though we were sending a legitimate message from one specific person in our business to one specific client or customer contact.

We get rejections because a big mail service provider like Google has deemed certain types of attachments unacceptable.

We get rejections because someone screwed up a blacklist and caught a server at a service provider we use in the net.

Sometimes we get rejections saying our content is unacceptable or whatever words they're using for that this week, when we are literally just sending a standard form tax receipt that we are legally required to provide to our customer!

If you aren't sending from a well-established system or with whatever extra levels of sender verification these services have deemed necessary these days, you're pretty much automatically going into someone's junk folder regardless of the importance, urgency or legitimacy of your message. I had literally never had a problem with legitimate business mail going into a recipient's junk folder until relatively recently, but in the last few years I've seen whole deals blown because a crucial meeting was happening abroad and information that we sent to a client in good time to meet their own prospects wasn't received and turned up in their junk folder that they hadn't thought to check (and this is with long-term clients we have exchanged literally thousands of messages with previously).

Email is broken, and the likes of Google have broken it, and we can and should lay the blame squarely at their feet.

I recently switched back to Mutt after 10 years of Outlook and OWA. It took a few months of constant tweaking, but loving it now. I can still load html email in a browser with one key if I need to.

you mean "neomutt" ^_^ ?

i noticed the updated name when running `mutt -h` one day and was pleased to find this page

https://www.neomutt.org/

with good documentation along with an active github repository and apparently welcoming community. i think there's even a Twitter account for "keeping up with the times."

I always explain tracking pixels to non-technical users and show them how to turn off image loading if they wish to. Every single one has chosen to do so. It's way past time for email clients to have this as the default for html emails.

They could send a personalized mail every year saying - "if you still want to continue to receive these mails", click here.

The conclusion of the article states that this is what they did.

I don't know why this wasn't the first option instead of tracking users without permission? This seems easier to implement, privacy-aware and even seems to more explicitly indicate the users intent to keep receiving emails.

Also have them opt-in when they sign-up to your newsletter, aka double-opt-in. Don't worry about those that don't opt-in as it's unlikely they'll read your newsletter anyway.

I second that, however most companies seem to think that opt-out is the only way to go if you want to profit.

There should be email client's who only open images if they are attached. I don't think any email client should try to load anything inside the html automatically if not attached. and even than attachment images should be confirmed.

“Automatically download images” is a setting in Outlook and turned off by default

You don't need html email for that... you just need a trackable link. If someone hasn't actually come back to your site for years due to the mail you're sending out... should you really be sending them mail?

If your site looks virtually the same in Lynx I'm not sure if that's a feature or a bug.

Digital brutalism is under appreciated.

How did we reach a point where a technical write up is forced into a column 6 inches wide on my 32 inch monitor?

Why does practically every code snippet exceed this 6 inch width, requiring a scroll bar?

Why is there a 50-50 chance that this scroll bar will be so tall that it actually hides the code snippet, and the fastest way to read the bits of information which are the point of the entire write up is to pop open developer tools by inspecting the element and read the code directly from the html?

I'd rather not have to follow a line of text from one side of my large screen all the way back to the other, nor be forced to scrunch down the window because they never considered that screens could be so large when that site was laid out in 1996.

LWN at least has a reasonable max width, but some sites don't.

I agree with this sentiment in general, but having to read the full width of my screen instead of playing copy-paste + text selection games with page elements which _cannot_ be viewed in their entirety (or sometimes at all) is an option I would take all day every day.

This is why some browsers have "Reader Mode" which strips out all the garbage and leaves you with a well-formatted article.

The trend to run everything full screen is an odd one, probably was never even a thing on Windows, with its terrible window resizing options. Of course tabs in browsers is a side effect of terrible window management in GUIs, and causes more full screenness

I have a theory about how this obsession with running web browsers in full screen came about, based on my personal observations on what happened at the time:

The graphical web browser was originally mostly used on computers like Sun SPARCstations and NeXTcubes with desktop resolutions like 1152×900 (Sun) and 1120×832 (NeXT). The web browser, in these desktop environments, were not maximized, but were instead used as one window (or multiple windows) among many other windows on a desktop full of other applications, icons, and menus. (See for example the fact that the normal shortcuts Ctrl/Command-N (for new browser window) and Ctrl/Command-W (for close window), which are standard in all current web browsers, actually originated as built-in features of the NeXTSTEP window environment, and not as a feature of the first web browser (which was written for NeXTSTEP). Tabs were not a feature in any web browsers yet – separate windows were used for approximately the same purpose.).

Anyway, the first graphical web sites were written with these non-maximized pixel widths in mind, with a typical web site being a bit above 600 pixels in width and assuming a maximum window height of around 700 pixels. PCs, around this time, typically had 640×480 pixels on their whole display (or maybe 800×600 or 1024×768 if they had a more expensive monitor and enough graphic card memory, but this was more rare). At that time, a user on a normal cheap PC, browsing a web site made for about 600 pixels in width, would find it easiest to simply maximize the window. And running multiple applications at the same time was not a practical option anyway for these PCs, considering the limited CPU and RAM available, so maximizing the web browser was natural.

A few years later, as PCs became commonplace, and therefore became the norm for web browsing, and as monitors and graphic card memory became cheaper, web designers started using the full-screen mode as the assumed mode for using web sites, and as 800×600 (and later 1024×768) desktop resolutions became more common on PCs, web site designers jumped to using these widths as their assumed web browser widths. (See the common practice at the time to have little buttons on web sites stating “Best viewed in 800×600”, and similar.) PC users, during all this time, were thus implicitly taught to always maximize the web browser window. Meanwhile, Sun/NeXT/SGI/etc. workstation users did not really complain since they had ample resolution to spare for viewing these ever widening web sites, and workstations were on the way out anyway.

However, nowadays, with both “retina” displays and much wider than 4:3 aspect ratios (initially 16:10 and later 16:9) being the absolute norm, it’s ludicrous to run (and design) a web site in full screen mode. I mean, the line length shouldn’t be over 55 characters per line anyway¹, so a web site has no business being wider than that. And personal computers are now more than capable of running more than one program at a time, which is only made more difficult by programs assuming they can cover the whole desktop for themselves.

1. https://en.wikipedia.org/wiki/Line_length

Another possible explanation for the penchant of many users (esp. non-technical ones) to run everything "maximized":

Most non-technical users have only ever seen and used MS Windows.

MS Windows has always had atrocious overlapping windows management features as compared to Unix X11 window managers. So most non-technical users never really learned to use multiple, overlapping, onscreen windows at the same time.

The one 'window management' feature that is directly visible to a non-technical MS Windows user is the task bar, and then its (the task bar's) only feature they see is "raise to top".

Applying a bit of "if the only tool you have is a hammer, all your problems start to look like nails" mentality, and it becomes easier for a non-technical user to simply hit the MS Windows "maximize" button on every window that opens for any applications they use (after which most MS Windows apps remember and auto-maximize the next time they launch) and then use "the hammer" they have (task bar with "raise this window to top" tool) to simply pop an already full screen window up when needed, then pop up another one when that one is needed, etc.

Plus, from their viewpoint, this provides a "less distracting" work-space since only the thing of interest is in view at any given moment.

Couple this with a bit of "follow the leader", or in this case, someone else they've observed, or possibly from the trainer who maximized not because he/she wanted to, but because the 800x600 projector of the day was too small to demo anything with overlapping windows and we have non-technical users who all start running everything maximized.

> I'd rather not have to follow a line of text from one side of my large screen all the way back to the other

I read wikipedia articles in fullscreen 2560x in desktop mode. The mobile site is a huge waste of space to me to forces me to scroll more than necessary.

On the other hand I have no trouble with scrunching browser windows when it makes sense since I use a tiling window manager and have keyboard shortcuts to rearrange windows.

What about a userContent.css entry on your personal browser that enforces a max-width that you like?

After all, it is your browser on your computer, it should render how you want, not how the site author wanted.

I've been called old-fashioned with the way I format my articles from the disco era:

https://digitalmars.com/articles/b76.html

but they are readable, no javascript, the browser reflows the text as required, the fonts work, they load fast because there's little there & they're static, the fonts can be resized by the browser without breaking the layout, they work with screen readers, etc.

You need a max width on that. On a 27" or larger screen those lines go on endlessly.

Make your browser narrower?

Then all new windows end up narrower which is annoying.

I'll just close the window and move on.

You can manually make the window narrower of course, but it doesn't play nice with tabbed browsing. In particular, you now face a choice:

1. Make the current window narrow. But when I switch to other tabs in this window, I need to expand it again, because the people who wrote them assumed there would be many horizontal pixels available. (Responsive layout? What's that?)

2. Move this tab into it's own window. But what to do if I then follow further links that point to other sites? If I open them in the same tab, I must resize again. If in a new tab: should this tab be manually migrated to my wide window? Or should I resize the narrow one?

The ideal solution would be a browser feature (like Reader Mode or Reading View).

Can you insert a max-width entry in your local userContent.css file to enforce your own max-width no matter what the site author may, or may not, specify?

Something isn't set up right if your goal is to have the browser reflow text as required -- I just clicked through on my iPhone and the text is at a specific width (and fwiw it's not very readable to me with my non-perfect eyesight).

Hmm, I resize my browser window and it reflows. I don't know what you're seeing.

> it's not very readable to me with my non-perfect eyesight

When I click on Ctrl-Plus, the font size increases in my browser, Ctrl-Minus and it decreases. The text reflows as expected.

The html code and the css are very simple. If you have suggestions for improvement to make it better for low vision, I'd be happy to see them.

Ahh, I see... it works great on desktop, just very tiny text on my mobile device (and unfortunately there's no Ctrl-Plus/Crtl-Minus on mobile safari).

You'll have to look at your analytics or server logs to see how much mobile traffic you get and decide if it's worth making the design "responsive". If so, basically you could make it a single-column layout when the screen is below a certain width.

   This is an example of what could be a code snippet that automatically gets a scrollbar added to it if I wrote this correctly. At least it is more than six inches across when I view it on a 21.5 inch monitor, although it could be a lot wider.

Wouldn't a better solution be exempting Mozilla from these checks? I mean really.. it's MOZILLA. The same one that Google, Microsoft, et al are teaming up with them to improve web docs but at the same time some (does gmail and htomail do it or not?) of these hinder it's mailing lists about the very same subject they are supposed to be teaming up on?

Other reputable mailing lists operators should also have all their addresses exempt from this charade.

What is the danger that mails from Mozilla are actually SPAM, seriously.

On the other hand, I just looked into my spam on gmail right now - 2 spammy emails (from shady domains, I guess they're okay, since they don't run mailing lists) and 1 genuine email, form a reputable big site, emails from which I always open that gmail judged to be spam (?!). Yes, it's promotional, so the 'content is similar to spam' but it's a newsletter that I subscribe to and always read, from contact@ a large genuine website, so what the hell?

I used to be subscribed to some lists and only read mails I found the titles interesting personally to me, I wonder if that hurt them too now...

'An algorithm did it' is like a new 'a wizard did it'. And it somehow exonerates the people who put that crap in place and then its up to the victim to fix it (complain on Twitter your YouTube was wrongly banned, complain on HN your AWS got locked, track mailing list readers to not get demerit for operating big mailing lists, etc.). This isn't right and often attempting to dispute it doesn't even work, with a human reassuring the victim that the algorithm was right until there is a mini-scandal and only then the decision is overturned. All with 'you broke our terms and/or social guidelines', no concrete information what even happened in the first place and then it happens again to someone (or to the same person again).

It boggles my mind a reputable behemoth like Mozilla can be stuck in a situation where they can't send an email to anyone until someone overturns the algorithm's judgement which takes a lot of time (because it's soooo hard to judge emails from Mozilla aren't SPAM, yeah, right).

I won't believe there isn't a way to do that because in that case Twitter, YouTube and Facebook would be penalized very BADLY for all their spammy notification emails many people leave in their social tab on gmail for years. Somehow they don't end up in spam ever (and many of them I never open and they would fit the description, especially Twitter updates about what's trending in my country, that I literally can't turn off since my account was judged to be a bot and locked right after creation and 1 Tweet and they now demand my phone number to unlock it).

From the comments:

"Not blindly loading elements works just fine

Posted Oct 12, 2017 17:18 UTC (Thu) by david.a.wheeler (subscriber, #72896) [Link]

> All of them. The way this generally works is that there's a unique, invisible, element in the email, like a 1x1 pixel image. When that image is requested, the server marks that the email has been read. Since most email clients blindly load all HTML elements this works. Even for the more careful clients that don't load elements from remote servers by default and ask the user to click a "load full message" (k-9 mail on android does this), most HTML mail is unreadable without those remote assets because the layout is completely broken.

I don't load elements from remote servers by default, and practically never have problems with desirable email. In my experience, email that's broken without remote loading is practically always spam.

> This is even harder for mail client's that have to rely on a third-party rendering engine for HTML mail, since they don't necessarily have the hooks into the renderer to tell it not to load remote content.

At least some third parties DO support this functionality."

I use a non-major, non-modern "web browser" that does not load elements from remote servers, and I practically never have problems with desirable content.

The "blind loading" problem extends to web browsers in addition to email.

In fact, email clients took the idea of tracking from web browsers and applied it to HTML email.

It may be possible to disable autoloading of images such as 1x1 pixels but unfortunately the "major" aka "modern" browsers do not allow users to disable all blind loading, e.g., malicious .js files.

For example, the recent Equifax incident involved blind loading of an undesirable .js file.

This "blind loading" is the foundation of tracking and web ads, not just spam.

It seems the more the more "major" a browser is considered, the more people refer to it as "modern", the better the browser works for tracking. Strange coincidence I guess.

Let's make subscription timeouts a reality. When you subscribe to an email newsletter, have it default to a 1-year subscription, which the user can modify.

This solves this problem, and auto-unsubscribes people who are not active users. You could have a login or other action renew the subscription.

No.

If I subscribe to something, I want it to just continue working. I don’t want to have to continuously spend time maintaining such bullshit.

This is another user-hostile action.

Meh, I'd take this one. There is literally nothing that is maintenance free. Closest you can get is areas where the cost of maintaining it is outsourced to someone else.

That is, I don't disagree that this is user hostile. I contend it is still the better option by offloading of the cost to you. Instead of by selling you.

So, it's technically not possible to not automatically delete addresses from a subscriber list?

Its not possible to know which subscribers aren't reading without tracking information.

I grant that you wouldn't need to sell said information once you are tracking it. The extra infrastructure to support all of that isn't free, though. So the incentives are high.

But it simply shouldn't be your business whether I read it. If I request that you subscribe me to some mailing list, then I expect to receive the emails from that mailing list exactly up to the day that I request to be unsubscribed. Whether I subscribe to read the emails or just to archive them for later reference or for feeding them into a robot that distills out the most important information for me ... that's simply none of your business and you shouldn't try second-guessing me if I have explicitly declared my intentions.

I don't necessarily disagree. However, there is a cost to blindly sending emails forever. To that end, I'm ok offloading the effort of keeping the subscription going to me.

Would I rather there was a reliable way to do this that did not result in spam detectors getting triggered? Well, yeah. If you have thoughts on how to make that happen, they are welcome.

Well, that cost is almost certainly lower than building a solution to figure out who is reading stuff or anything like that. Sending emails just isn't expensive resource-wise.

As for spam detectors: Just forget about spam detectors. If people employ someone to throw away their emails for idiotic reasons, that is not my problem. If they want to be subscribed to my mailing list, they should not employ people who throw away my emails.

> If I subscribe to something, I want it to just continue working. I don’t want to have to continuously spend time maintaining such bullshit.

Every certificate you own for security purposes should have an expiry date, and this is not "user-hostile", this is just good practice. A link to click on once a year is not a big deal.

For certificates, we have a fully standardized automated system to renew them.

I literally don’t have to do anything, and my certificates will continue to work as long as Let’s Encrypt exists.

If I have to manually to any maintenance, the system is broken. Which, in this case, it is.

The problem isn’t "one link to click per year", but if everyone does this, suddenly I have to click dozens of links per day.

The company that truly improves email will be a fixture and a household name. Its a devilishly hard problem, though. But one with immense potential.

I think a big limitation of current attempts are the focus on closed teams/enterprises and making a "clean break" from email. WhatsApp seamlessly bridged a gap between modern messaging and telecom to produce grand success — the same can be done with email.

Email is still a necessary component because it fills a specific need. Where tools like Slack and Sharepoint help solve specific problems, Email is a good general purpose tool for both short and long conversations, plus sending out links to other tools.

I think the problem is not email itself, but email clients and their pathetic inability to order your inbox correctly.

Reply on news.ycombinator.com