Hacker News Reader

Comment by sph | Hacker News Reader

If I'm certain I don't know the company, or I know the company but there is no unsubscribe button, it goes straight to Spam, no questions asked.

A decade ago I went to my country's embassy to renew my passport, and they now use my email to subscribe me to the newsletters of any new political party. All unsubscribe links just 404s. Shameful behaviour.

Anything I receive from any of their political candidates goes straight to spam now. The hope is that I am training the spam filter so it marks those as spam for all other users as well.

It's simple really: have clearly visible, working unsubscribe link in the body of the email that doesn't require jumping through hoops, and be from a company I know and use. Otherwise the spam filter learns about it.

View on HN

There's worse. An unsubscribe link that asks you to submit your email. Few things anger me more, because they went through the trouble of pretending to comply, and a decision was made to make my day more difficult.

That exists for a reason, and it's not nefarious at all.

Lot of people, especially of the older generation, forward all sorts of emails to their friends and family every day. If one person who received a forwarded email doesn't like it and clicks the unsubscribe link, the original recipient (who clearly likes the email enough to forward it around) gets unsubscribed. That's a bug. If you don't like the unfunny newsletter your uncle keeps forwarding you, that's a problem between you and your uncle, not between your uncle and his newsletter!

The email submission form exists to ensure that the person unsubscribing is the person who is actually on the mailing list. It will not prevent an annoyed nephew from deliberately unsubscribing the original recipient, but it will prevent most cases of mistake by third parties.

Similarly, many unsubscribe links require two clicks instead of one, because some email services used to automatically check out every link they found in the body of an email. A one-click link would unsubscribe everyone before they even saw the email. Nowadays we have better protocols and better email scanners, but old industry habits die hard.

There is no "mistake" in wanting to unsubscribe from a mail list. This is just dark pattern to increase friction, whatever scenario they try to come up to justify.

I share your frustration, but there is no evidence that you read the comment you're replying to.

That comment explains that there's a scenario where people can be accidentally unsubscribed in the presence of mail forwarding, and the requirement to enter an email address can patch over this.

Well, you could still pre-fill that field.

Upon re-reading the comment, I understand the scenario now. Thanks for clarifying.

Thankfully I don't have people forwarding emails to me outside of work...

I think you are mostly wrong. OP is complaining they sometimes have to enter their email address - that is absolutely unnecessary make-work.

The page can prompt the email address, and have a simple unsubscribe button. Not perfect, but okay.

Even better, one-click unsubscribe features (e.g. Gmail's App) are presumably set up to work for the current recipient (not the original sender) so the problem is resolved for anyone using an email client with inbuilt unsubscribe.

The forwarding problem is only for html link unsubscribe. Personally I hate trying to play find-the-ubsubscribe-link, so I use the email client feature where possible (which also helps Gmail rate/flag spam).

Mostly I haven't had problems with repeat spammers, except a republican politician (I'm not in the USA so doubly annoying).

Not everyone uses Gmail or a modern email client that understands the one-click List-Unsubscribe protocol, so senders must include an HTML unsubscribe link in the body of the email in order to comply with relevant rules in all jurisdictions. That link, unfortunately, can fall prey to the shenanigans I mentioned above.

I understand the parent's sentiment because we all want to unsubscribe from unwanted emails. But technical standards can't distinguish unwanted emails from business-critical emails. You could legitimately cause someone damages by silently unsubscribing them from an important news feed. (Imagine that you silently unsubscribed an open-source maintainer from all github notifications!) Even worse, this kind of vulnerability disproportionately affects senders who try to follow the rules and make it easier for people to unsubscribe. Spammers don't care and keep spammin'.

Ideally, an email would have both a one-click List-Unsubscribe header and an HTML unsubscribe link in the body. The latter need not be one-click, and in fact, if it's anything remotely important, should not be.

> Imagine that you silently unsubscribed an open-source maintainer from all github notifications!)

Do open-source maintainers forward around their unsubscribe links in practice?

The other problem with email scanners clicking links automatically can be solved without prompting for the email address. One simple solution is: if the link is clicked within a minute or so after sending the email there's a chance the clicker is an automated system. Instead of unsubscribing right away, serve a HTTP POST form with a single "Confirm Unsubscribe" button. Normal users will rarely see the form, automated systems will hesitate to fire off HTTP POST requests.

> The latter need not be one-click, and in fact, if it's anything remotely important, should not be.

It absolutely should be one-click.

Since when are GET requests with side effects a good thing?

> Mostly I haven't had problems with repeat spammers, except a republican politician (I'm not in the USA so doubly annoying).

I’m a republican (also not in the US sense — I want to get rid of the tie to the monarchy) but I also find that republican politicians seem to be really annoying!

They could perhaps pre-fill the email as a middle ground.

Many websites actually do this. It significantly weakens the defense against the forwarding problem because people will blindly click submit. But IMO it's an acceptable compromise for anything not business-critical.

Some people have come up with a trick to hide the unsubscribe link with CSS when it is inside a <blockquote> tag, as in a forwarded email. It doesn't work reliably, though. HTML email is still stuck in the 90s, it's impossible to do anything fancy inside of it. Much easier to send the user to a real web page for an actual transaction.

Email senders are trying to solve a problem no one asked them to solve. Me unsubscribing from emails from my grandma is her problem and eventually someone should/will help her find another way to share. Let's not pretend that email senders care about my grandma.

Email providers autoclicking on links, is the recipient's problem. This is the same flow used for account verification links and yet you do not see them adding an additional step to it.

And then we have the large number of users complaining about this, and yet they feel they simply know better and reserve the right to impose themselves on us?

This decision is purely self serving, let's not pretend otherwise.

Also needing to log in before you can unsubscribe.

Especially if your account is no longer accessible; a problem I had with Uber after changing my phone number. Bombarded with "Uber Eats" spam and no way to unsubscribe without going through some kind of ridiculous process to reactivate the account.

I have that problem with a former utility company that keeps sending updates about the business that I've unsubscribed from multiple times. The one that irks me the most is TP-Link Kasa who has a marketing opt-out in the account creation flow and they still send repetitive spam without honoring the unsubscribe link.

IIRC, CAN-SPAM explicitly says the unsubscribe button needs to be available without logging in. So this would be a violation.

So, who do you contact about that violation?

Here you go: https://www.justice.gov/action-center/report-spam

You can probably guess how effective that is. In practice, unless you can get the FTC or a state attorney general to sue an actual company for you, nothing will ever come of it.

I report spam that I'm unable to unsubscribe from to the FTC via their online page[0]. I've never gotten any response but it does seem to work. I've been dropped from several marketing lists after reporting them to the FTC, and it's unlikely that these marketers decided on their own to remove me from their lists.

[0] https://reportfraud.ftc.gov/#/

Or needing to enable javascript to unsubscribe.

Hulu did (does?) this and the form rejected my email address as invalid because the domain portion had three parts to it. Of course, they were able to continue sending me emails so some system knew it was valid. It was likely a bad assumption an engineer made somewhere, but all the more reason to use unsubscribe links that are already tied to the email address.

Reply on news.ycombinator.com