Hacker News Reader

Comment by makecheck | Hacker News Reader

I don’t understand this sort of “right to track” that so many organizations seem to have. I don’t care if modern technology gives them a way to do it, I have a right to block or otherwise avoid loading whatever I want. Somehow 20 years ago businesses managed to judge how effective their communications/ads were without tracking; let them go back to that.

View on HN

The article is quite specific in why Mozilla wants to track emails - email being sent to dead email accounts causes greylisting/blacklisting problems for them; they want to be able to unsubscribe inactive accounts, and the only way to determine account inactivity is through some sort of feedback mechanism.

I guess privacy is a middling concern in the face of the all important greylist.

So it seems, the conclusion here after all that's happened in the past few months is that modern Mozilla is no longer a privacy-first company when they're inconvenienced by that stance. Their rallying cry is now nothing more than "we're not as bad as Google".

What a sad state of affairs for the Internet in general.

Did you read the compromise that they found, near the end of the article? It's fine privacywise.

For me, the alarming fact is that this "privacywise" option was not the firs one chosen. Instead, they went with a "privacyunwise" option as a default, and only backed out because of user uproar. Bad Mozilla!

I strongly suggest you look at the actual discussion that happened [1].

One Mozilla employee, trying to solve a specific technical problem but not necessarily having thought through all the implications of the proposed solution, suggested the "privacyunwise" option on a public mailing list that Mozilla uses for discussing decisions like this. It's a public list because that's how Mozilla prefers to operate.

In the 24 hours that follow, there are 5 responses asking for a clearer description of the problem being solved and why this specific "unwise" option is considered the best solution. Three of those responses are from Mozilla employees. Following this, the author of the original proposal says that clearly more work is needed in terms of solving the particular problem they are facing.

A few days later, there were three more mails objecting to the proposal; two from employees, one from a non-employee.

A few days after that, the original proposal author came back with what you call the "privacywise" option.

So:

1) The "privacyunwise" option was not _chosen_. It was _proposed_, on a list specifically designed to evaluate the sanity of such proposals. This list happens to be public, which is why you know that the option was considered at all before being discarded as not compatible with Mozilla's principles.

2) The "uproar" was largely, but not entirely, by Mozilla staff.

The "Bad Mozilla" conclusion can only be based on a misunderstanding of what happened here...

Disclaimer: I work for Mozilla, I saw this thread; I did not reply to it because other people got there first and I would just be repeating what they said, but had they not replied I most certainly would have.

[1] https://groups.google.com/forum/#!msg/mozilla.governance/WWK... and following thread.

Why can't they just ask the recipients to respond if they want to continue getting emails, and drop any addresses that don't?

That's exactly the end result they came to (again, explained in the article). "But, once a year, those subscribers will get a message asking them to click on a link to confirm their continued interest in remaining on the list."

Wine mailing lists do this, works great.

Since forever I've been reading html mail using 'lynx -dump'. That never had any negative effect.

So my guess is that this particular kind of subscriber tracking is not used all that much (on technical mailing lists).

So Mozilla are claiming that has a negative effect on their sending reputation.

If that's true - it's a problem with the companies we've collectively chosen to outsource email reputation to - not with people who want to receive plain text email.

It’s not a problem for the 4 people who do that.

It becomes a problem when you pump lots of email into a good sized provider, and your open rates are poor. Google knows more about what mail you read than you do.

Google knows, for example, that I get the Vagrant-DigitalOcean mailing list mail, and open it maybe a handful of times a year. If they are downgrading that mailing list's reputation based on that they're 100% wrongly reading my intentions into their data. That's Google's fault (even if they're externalising the costs ont ot he mailing list).

I must be missing something here.

If the email account is dead, sender (Mozilla in this case) will get an error reply such as "550 No such account", etc. When that happens, obviously, Mozilla should stop sending to that account.

The stated problem is with accounts that are inactive but still open. A gmail account that hasn't been touched in 10 years, for example.

Will that produce a bounce (and so.. graylisting/blacklisting)? I think not, but I may be wrong.

BTW the OP said "dead", not "inactive but still open"

No bounce. My reading of the article is that the problem is with accounts that are still valid, but inactive. If you send a lot of mail to such accounts, e-mail providers flag you as spammy, apparently.

So instead of making a fuss about broken anti-spam measures that are breaking email, mozilla gives in to tracking?

No. They proposed one way of handling it. People didn't like the proposal. They've come up with another way.

...which is remarkable because the email providers are the ones who are keeping the accounts open.

All they need to do is internally maintain a list of dormant accounts (as defined by not connecting to read email in some period of time); send a series of warnings to those accounts; stop accepting email for those accounts; at some point, delete the accounts and let mail bounce. Document the policy and the timeline.

What am I leaving out? Oh, forwarding accounts. Let the user mark them as forwarding accounts and change the "dead" heuristic to spot when all mail sent by the account's rules is bouncing.

I suppose that might cut the statistical boasting a bit (12 billion active users!) but at this point nobody has any sympathy for marketing departments anyway.

Email providers track "engagement", not just overall account activity. Plenty of "marketing" messages are sent to still active account and just go undread. Enough of this will cause messages to be routed to the bulk/spam folder.

That’s just one use case.

There’s a category of bulk mail that isn’t spam, but isn’t read. The providers punish those mailers who overload on those unread messages.

I doubt this explanation. I have personally seen spamhaus blacklist a newsletter that was subscribed to using double opt-in. What happened: the e-mails never bounced, the provider just closed down and - what a "coincidence" - the domain ended up being owned by someone who immediately used it as a "spam honeypot" for spamhaus.

It's apparently impossible to protect a sender against this by other means than detecting real user interaction. Alternatively, blacklist providers doing this could be ignored...

The way most people solve this is with a unique code attached to some tracking pixel that gets picked up when the HTML email is opened. We use an alternate of embedding the unique code in the links for the email so that even a text only email will trigger a click for that user if they copy/paste the link. You lose "open" tracking, but this isn't too bad unless you are selling ad impressions for your emails.

What about your subscribers which use text only email?

The links in the text email look like:

    https://www.example.com/foo/bar?blah_id=123456&utm...

If you don't copy/paste a link from any email within a year you end up falling off the "active users" segment and we stop wasting our time sending you emails. For text-only users (which we seem to have a few who have "clicks" but no "opens"). The particular system I work with is actually slightly more sophisticated and considers usage from a lot of channels (push message consumption, email opens and clicks, app usage, alexa usage, bot interactions, and website usage). If you don't do any of those things you fall into less and less frequent push/email interactions until we stop bothering with routine newsletter/updates messages except for an occasional "please come back"-style campaign.

I don't understand how copy/paste can trigger the tracking on your side. Can you please explain?

I am using mutt to read emails and vim to write them, I'd be very surprised if copy/paste has any effect for you.

The URL holds an unique id for each mail sent, such as the `blah_id=123456` example in the parent comment.

I understand that. I don't understand how copy/paste has anything to do with pinging anything on the internet with that code.

Is this maybe some gmail thing? I can't think of mechanism that makes copy/paste trigger this.

Copy pasting into the browser to view the link triggers this, just copying doesn't. If I understood the previous comment correctly, the author copies links into the browser instead of clicking them (since they aren't clickable links).

"Copy/paste" here means "Copy the URL, paste it into the address field of a Web user-agent program, and initiate navigation to that URL in that Web user-agent program".

I suspect the phrasing was used since the discussion is about text-only email and, this being Hacker News, someone might have nit-picked that they view plaintext emails in a mail user agent program which does not scan for strings matching the format of a URL and offer a direct way to click on them or otherwise trigger automated opening of them in a Web user-agent program, and so the person who wrote "copy/paste" had to avoid saying "click on the link".

And how many email users load images by default? How many of Mozilla's more technical demographic?

If I legitimately want emails from you (Mozilla seems likely) and you stop sending them, I'm going to be irritated. But if you stop because your phone home 1x1.gif doesn't load, that doesn't mean I wasn't reading them.

At least for my site, we consider multiple channels of engagement when calculating whether a user who is subscribed to something is active enough to bother messaging. If you don't click/open the emails (as far as our tracking can tell), but your account still opens our app, you'll keep on getting email updates until you unsubscribe via the unsub link, the profile preferences, or you close your account.

Mozilla is probably in a bit weirder position because their value-prop isn't in curating articles and videos the user is interested in. They don't require the users to login to use Firefox, and thus can't know if text-only users are using their emails unless they process unique ids on links inside the email (and that's the last step of the usual funnel, which means the segment definition is going to have to be really long (probably a year)).

I use MDN at least once a week, but I never log in. Hard for them to tell my email address is engaged.

Supposedly, some ISPs recycle dead accounts as spam traps.

http://docs.briteverify.com/spamtraps/

Now, keep in mind the source of that information sells mailing list cleaning solutions, and it may be "email marketer" superstition, I don't know.

Big SMTP won't tell because they don't want a client to scan for valid accounts.

Many people block tracking pixels (by not loading images) anyway, so it doesn't completely make sense. Is the plan to automatically unsubscribe everyone who doesn't load images in emails?

Why not ask the users to check in once a month or so by having them click a link?

That way, it's on the user to remain active. If they don't click the link?

So sad but sayonara.

> the only way to determine account inactivity is through some sort of feedback mechanism.

Or a timeout (distributed systems 101). Just time-out accounts and send a good-bye email that has a one-click reanimation link.

Yep, i'm on several mailing lists that send me a "confirm you're alive" link once a year. Works just fine.

From the article:

"an acceptable compromise has been found, and the text-only option will remain. But, once a year, those subscribers will get a message asking them to click on a link to confirm their continued interest in remaining on the list. That should allow Mozilla to prune its inactive readers"

So that's exactly what Mozilla actually ended up doing.

Making spam lists opt-in? I'm pretty sure there's some kind of secret blood oath amongst marketing types that none shall ever make it simpler or more convenient to get off a mailing list, let alone making it harder to stay on one.

Where I live it is required by law for mailing list emails to have an unsubscribe link at the bottom :)

That's what bounces are for. If email is deliverable, it is going to an "active" account. There are several mailing lists I retain for posterity, since I've seen a good handful of them simply disappear along with the archives.

Maybe they should limit this measure only to receivers which have a known reputation of downgrading senders of unopened mail.

Consider a user who just keeps clicking "mark as junk" until he stops seeing Mozilla mails, instead of unsubscribing. Or an overzealous system that marked a Mozilla mail as junk once, and nobody complained, so it keeps doing it. The user's account still exists and mail can still be delivered so there's no bounce response, but each mail Mozilla sends will be treated as evidence that Mozilla is spamming.

Isn't this what "List-Unsubscribe" header is for? The email client should display Unsubscribe option instead of Mark as junk or offer to unsubscribe first.

That's equivalent to following a link on the email, and it's a well known recommendation that you should never follow links from spam emails.

That said, gmail does offer to follow the unsubscribe link for you when you mark an email as junk.

The major players tend not to bounce emails. They accept all mail at the edge, and then blackhole it once it's actually looked at by the backend.

I clearly remember when web developers had a ‘right’ to show popup ads and couldn’t possibly survive without Flash.

They’ll live.

"Somehow 20 years ago businesses managed to judge how effective their communications/ads were without tracking; let them go back to that. reply"

I definitewly agree that the fix to a lot of the tracking/privacy issue are on the client end. But, the value on the other end is not the same regardless of tracking.

20 years ago (even 10-15) online ad markets were tiny, even relative to the number of users. It just wasn't possible to translate users into dollars in the way it is today. It's not a 20% difference, it's a large multiple. The Google & FB machines are powered by highly trackable advertising. FB ads were worthless before they made a big jump in trackability a few years ago. The "feedback loop" is the difference.

20 years ago, advertising was powering mostly entertainment, some news and such. Today, it's also powering driverless car research, OSs, VR...

Indirectly, a lot of the startup boom is funded by trackable ads. Trackable ads translate "really popular, lots of DAUs" into "potential unicorn" on the backs of many envelopes which later get filled with cash. Feedback loops make this possible.

I'm not argueing against privacy. I actually agree with you. Clients (email clients, browsers..) should enforce privacy, serving users not advertisiers.

I'm just being realistic about the scale of the issue. Online, advertising is tracking. Advertising-tracking is at the heart of consumer technology's income & investment stream. If tracking goes away tomorrow,it takes a bunch of stuff with it.

20 years ago they made X amount of money, now they want to make more 2017 levels of money. Also society changed and people respond differently to old communication tricks.

Nobody in journalism makes any money, especially not compared to 20 years ago.

Advertisement revenue was cut in half, because the inventory grew, and the middle men (google and facebook) started taking half of it.

At exactly the same time, subscription revenue also dropped by about a quarter for most publications.

And, at least as important, the cash cow of publishing has almost completely disappeared: classifieds, obits, and job ads.

I hear you – but think of tracking as a form of payment for consuming the product / service / content. You are not paying them – their advertisers are, and ads are more valuable the more tracking and attribution they come with. Data is money, and by blocking their access to data you are affecting their monetization strategy. I'm not saying it's right, I'm saying that's how the business model is set up because that's what consumers demand – paid browsers and media sites are niche or nonexistent.

If I buy an item from a store and get an email receipt with tracking, this gives the vendor a whole bunch of information about me. If I already paid for the good/service, that’s objectionable.

I don’t buy “identifiable meta-information as payment”. It is fundamentally intrusive.

The 'right to track' here is because Mozilla is getting blacklisted for sending to now-nonexistent addresses, and when they're blacklisted, it's hard to get off the blacklist.

As an example, one company I work for is on the blacklist RFC-Clueless, which blacklists you for not following the RFC and having the required default mailboxes (webmaster@, abuse@, etc). We use gmail, and it was a screw-up in their system - something I got them to fix about 2.5 years ago. Despite multiple requests to get off the RFC-Clueless list (their request link being obfuscated), they've done nothing about it. It's particularly galling that a blacklist that blocks you for 'being a bad netizen' is themselves an atrocious netizen.

So, if a client has an IT dept that subscribes to RFC-Clueless, there's simply no way we can send them email - it's very difficult for our sales staff to convince their contacts to start that conversation with their own IT, especially in the initial stages of the trial.

So I can understand that Mozilla might want to keep themselves off mailing blacklists, especially when they're sending mail to now-dead addresses that have previously asked for mail to be sent.

> Mozilla is getting blacklisted for sending to now-nonexistent addresses

Not quite, the problem is that the addresses do still exist, but they're inactive and the mail is never being read. It sounds like some blacklists use "continuing to send mail to known-inactive addresses" as an indicator of a bad sender.

> So I can understand that Mozilla might want to keep themselves off mailing blacklists

So can I, but the desire/need to do this does not imply a "right" to track the opening of messages in the manner initially planned. The reader does however have a right to privacy, whether they link know about a 1x1 image and its effects or not.

Email deliverability is a giant pain to have to deal with, of course, so the motivation to overlook this small sacrifice of privacy is pretty high.

If you can show who's running those lists, and their names, sue them for damages. Garnishment is very much a thing.

Admittedly, attacking others in a system that features money as a signifier as status/power isn't usually wise. But given these people are trying to use blacklists as a form of power, this can be used against them. At least if the threat of monetarily loss isn't realized, the fact that you're willing to drag them into court will... expedite any issues you have with being on that list.

Even if there was a "right to track", then it would be the user who grants it.

Because it originates with the user, the user could refuse to grant it or revoke it.

The question for Mozilla is who are they accountable to?

These are not open source volunteers.

Mozilla can claim it is not a "for-profit" but its contributors are well-compensated, with salaries comparable to people working at the for-profit companies releasing web browsers. (Google Chrome was started by former Mozilla developers.)

"We are proudly non-profit, non-corporate and non-compromised."

https://donate.mozilla.org/

Question: What makes Mozilla any more trustworthy to users than the other companies releasing web browsers?

Question: Why should they care about users any more than those companies?

Annual salaries from 2015 (reportable compensation from IRS Form 990):

  Mitchell Baker, Chair $977,382 + $45,530
  Bob Lisborne, Director $92,000
  Mark Surman, Exec. Dir./President $170,699 + $40,602
  Jim Cook, Treasurer $934,526 + $45,530
  Angela Plohman, Secretary/VP Operations $121,322 + $30,342
  Christopher Lawrence, VP Learning $153,492 + $62,538
  An-Me Chung, Dir. Partnerships 154,946 + $72,672
  Daniel Sinker, Dir. Partnerships 123,630 + $64,215
  Hiram Paul Johnson, Marketing Lead 126,605 + 54, 903
  Andrea Wood, Online Organizing/Fundraising Lead $135,048 + $46,322
  Samuel Dyson, Director Hive Chicago $114,860 + $63,549

https://static.mozilla.com/moco/en-US/pdf/2015_Mozilla_Found...

Question: How much of this comes from donations and how much comes (indirectly) from sale of advertising (by "partners")?

They get about half of their total revenue ($12,429,238) from licensing royalties ($6,466,566) according to the 2015 filing.

Question: Are there really any incentives to serve users in ways that the companies releasing web browsers do not? Users want the tracking to stop. Would Mozilla have disincentives to help users in this regard?

There is no "corruption" being implied by the above. It is legal to pay high salaries and not pay taxes.

I don't know what you're trying to say? If you're accusing the Mozilla management of corruption, you should really offer more than the fact that, yes, people at non-profits also get salaries.

The only qualitative difference for a non-profit is the lack of owners demanding return on invested capital.

> How much of this comes from donations and how much comes (indirectly) from sale of advertising (by "partners")?

Well you have the numbers right there. Mozilla doesn't sell ads anywhere as far as I know. Apart from grants and donations, they only have the google search deal as a major source of income.

The deal is with Yahoo.

Side remark: One twelfth of Mozilla’s annual revenue goes directly to its highest-paid employee? Talk about 10x programmer, that lady must be a genius.

Mozilla employs about 1000 people and has revenues of around 300M-400M, so there's been a miscalculation there. 1/400th with 1000 employees doesn't sound very high at all.

The numbers are probably from the Mozilla Foundation, which only employs a few people, so obviously they're going to be remunerated highly percentage-wise.

Ah, ok, thank you, that explains it a little bit at least! :)

Two years after Mozilla Foundation was announced in 2003, the Mozilla Corporation was announced. It engages in commerce and it keeps profits. It is responsible for paying taxes.

"'The formation of the Mozilla Corporation gives the Mozilla Foundation new capabilities for becoming even more successful in delivering innovative open source end-user products," said Mitchell Baker, president of Mozilla Corporation. "The Mozilla Corporation is not a typical commercial entity. Rather, it is dedicated to the public benefit goal at the heart of the Mozilla project, which is to keep the Internet open and available to everyone.'

The broad adoption of Mozilla Firefox has created significant economic value both in Firefox itself and in a commercial ecosystem that is developing around Firefox."

http://www.mozilla.org/press/mozilla-2005-08-03.html

Is the delivery of "end-user products" not the source of revenues for the Corporation? What if all those products are delivered for free? Then where do the revenues come from?

Giving away free software while still producing significant revenues from commerce seems to resemble the other corporations that deliver web browsers and other free web software. Regarding those companies, it has been said that "Users are the product".

Note I am not implying anyone has done anything wrong. Each party is expected to pursue its own self-interest. Freedom of choice is a necessary component of an "Internet that is open and available to everyone".

These are just some facts that I believe could be relevant to users who are not interested in marketing user data or the advertising sales ecosystem.

> I don’t care if modern technology gives them a way to do it, I have a right to block or otherwise avoid loading whatever I want.

Nobody has any rights whatsoever in this context, neither morally nor legally. It's all the law of the jungle, with the interested users perpetually a step ahead of advertisers, and the average user a step behind.

> Somehow 20 years ago businesses managed to judge how effective their communications/ads were without tracking; let them go back to that.

Well, they really didn't. And now that they've seen how much money they're wasting, it is no longer possible to feign ignorance.

But more important is the fact that the user's interests are not the total opposite of these publishers. Mpst companies publishing serious journalism on the internet, for example, barely break even. Any money they earn is directly invested in the product. Now you can obviously tell them to fuck off and they can't really stop you. But that's a collective action problem, like global warming or littering: if everyone follows your lead, everyone (including you) will suffer.

Many of the advertising practices of the last decade obviously went too far. But they were created not by collective greed, but panic. I wish we'd come up with a compromise that respects both users and creators.

Reply on news.ycombinator.com