Hacker News Reader

Comment by mehrdadn | Hacker News Reader

I care about privacy as much as anybody, but why make such a big outcry over such a minor infraction? An email address is one of the least private and most non-consequential pieces of information that could be retained about someone in this day and age. Which many other companies flagrantly abuse all the time with no shame. Yet compared to many other large companies, Cloudflare has been a company with at least a respectable reputation and track record. Does that not warrant treating them a little bit better than this? Is the fact that they were unable to unsubscribe a user really something that warrants alarming the HN community over? Is there such a dearth of hills to die on right now that this is what we should be outraged about today?

View on HN

If they don't have such a simple mechanism as unsubscribing from a mailing list, what else have they fucked up? I would rather not take any chances.

https://en.m.wikipedia.org/wiki/Cloudbleed

https://news.ycombinator.com/item?id=13718752

> Yet compared to many other large companies, Cloudflare has been a company with at least a respectable reputation and track record.

Has it? See the following page (which also contains complaints about unsolicited e-mail, among others): https://codeberg.org/themusicgod1/cloudflare-tor

> over such a minor infraction?

It might be minor if it's only affecting one person, but the OP seems to suspect (on fair grounds) that there might be a lot of people affected by the same dubious corporate practice.

Email is a pain to deal with and unwanted email saps attention and time from one's day. One of the reasons I use individual email aliasing for every company[1] is because I wanted to avoid wasting cumulative hours or days over my lifetime managing unwanted emails.

Lots of companies (big and small) don't unsubscribe me properly and I end up getting emails a year or two later. It's nice to have the nuclear options of deleting the alias if needed.

So yes, it's relatively minor compared to internet infrastructure products and tooling that Cloudflare is responsible for, but it's still an issue that erodes trust in a company.

[1] Detailed here: https://jonpurdy.com/2020/06/using-email-aliasing-to-detect-...

Isn't reporting them as spam, or just blocking them, a lot more time efficient?

Yes the obvious answer is you can click once to Mark as Spam and be done with it forever.

IMO this is just a weird form of grandstanding.

> click once to Mark as Spam and be done with it forever.

That doesn't always work.

I receive spam from a major US university to a Gmail account. Marking it as spam for over a year has done nothing.

That’s a bug with your email client then. Marking as Spam should be the same as a Block plus a Spam Report.

Whether they keep sending you email or not, you should never see a message from the same address again.

A decent client would give you the option to block the whole domain.

That’s a bug with your email client then

Don't blame the victim. GMail does this. I have the same problem, and I only use GMail's web interface.

First, I wasn’t blaming the user at all, I was blaming the software. Second, I don’t see any “victim” here. It’s an occasional email sent in error. It’s a special kind of privilege to be able to write 500 words complaining (and threatening retribution) for something like this.

Email clients do need to be able to successfully handle spam, it’s a pre-requisite for using email. I would absolutely blame the email client software before shouting into the void.

Where's the threatened retribution?

Talk about GDPR, ICO, SEC... calling it a “breach”. Calling out the CTO for deleting old tweets, the comment “I assume that JGC doesn’t like his personal data being misused.” could be interpreted as a veiling threat but it’s borderline.

Talk about the GDPR isn't threatened retribution. It's just something that happens when you violate the GDPR. That's like saying that talk about tax law and the tax office and calling something “tax fraud” is a threat.

I do understand about the tweets, though. Calling out perceived hypocrisy, especially when there are legitimate reasons it's not hypocrisy, is a threaty sort of thing.

https://www.ftc.gov/tips-advice/business-center/guidance/can...

Isn't reporting them as spam

If you are using an e-mail provider that does something about it.

I have a GMail address that receives spam from several specific companies regularly. I've marked the messages as spam every month for at least five years. They keep coming, and GMail keeps showing them to me.

"Cloudflare has been a company with at least a respectable reputation". No they don't. They have the kind of rep where in the future if they are caught spying everyone would go.. I figured that was happening.

So you're basically saying we should give them the benefit of the doubt on not complying with GDPR because they have a good track record?

It would be one thing if OP was receiving cookie-cutter responses from CloudFlare's support team, but the CEO repeatedly personally intervenes and makes assurances that simply aren't true (and he's already made the same promises in this thread). How can those promises be taken at face value when it's still a problem a year later?

No, I'm not saying anything about "doubt". I'm saying if a nice friend (or a non-friend for that matter) takes your pencil and insists for the next year that he'll return to you despite never doing so, maybe there's a better way to deal with this trauma than to crucify him in front of 7 billion people.

I mean if you want to go out of your way to portray the company in the best possible light and OP in the worst possible light, sure.

Most people wouldn't consider a multi-million dollar corporation that is beholden to federal regulation their 'friend' though. And if we're continuing your painfully hyperbolic analogy, if said friend kept insisting that they had or were in the process of giving me back my pencil any time I asked them over the course of a year, I would have some grounds to complain.

Oh, my bad. By complain on a small independent forum I really meant 'crucify him in front of seven billion people'. My mistake.

For someone experiencing "pain" at "hyperbole" I hope it doesn't pain you to realize that the forum you're calling "small" has some five million monthly readers...

I mean you're the one who called this independent blog post a 'public crucifixion in front of 7 billion people' but sure, let's make this a "no u" thing.

A better way, such as? You mean like writing email / tweet requests directly to those responsible? What's this magical alternative method? FWIW, this method seems to have worked where the reasonable and common methods clearly failed. He bought his own nails and cross when he promised action would be taken but failed to execute.

> A better way, such as? You mean like writing email / tweet requests directly to those responsible? What's this magical alternative method? FWIW, this method seems to have worked where the reasonable and common methods clearly failed. He bought his own nails and cross when he promised action would be taken but failed to execute.

Is shaking your head, maybe adding an email filter or reporting as spam, and moving on with your life too traumatic an experience to go through? Is your life not worth living at that point unless you pull the fire alarm, evacuate the whole building, and publicly obtain vengeance?

So the bad behavior can continue?

I run into this all the time at work. We're at the point where we've spent 5 whole minutes talking about some software-driven bad behavior. Nobody is sure if this is the first time we've been affected by it (maybe it's the fifth time already, but it is starting to feel like deja vu.)

Someone suggests it isn't really a problem and we should ignore it. This person is very effective at their job and gets lots of stuff done once we've decided to take action. But there's a problem, actually tons of them, they're piling up now and we still have daily conversations about how they aren't a problem, (on a big long rotation so nobody seems to recall if we've seen this one before on any given day.)

No. Nobody said don't deal with the problem. Nobody said it isn't really a problem either. I'm saying go ahead and deal with the problem as best as you can, privately. If you still can't solve it at the source, then mitigate it on your end, and move on. Just because ∃ a problem and you encounter it for a long time, that doesn't mean you need to alarm people across the planet over it, or to publicly crucify someone in the process.

Nobody is being crucified. Nobody said they can't solve it at the source. They seem to want to solve it, at least outwardly. You're forgetting that only this forum seems to have the capability of reach, to reach those who are empowered to fix the problem.

If it was just a problem for this one person, well that would be a real anomaly. But adding a filter rule to always block is ignoring the problem, in the context of my work-life analogy, not fixing it.

If that person is a publicly-traded company with hundreds of millions in revenue, and "taking your pencil" is failing to adhere to their obligations under privacy law, yeah, maybe public shaming isn't too bad.

I mean, I know in America, corporations are people and even have constitutionally-protected religious beliefs, but I'm sure Cloudflare will, with enough counselling, cope with the trauma of some mild public shaming.

Reply on news.ycombinator.com