Hacker News Reader

Comment by urban_winter | Hacker News Reader

Google suspend email accounts that get lots of spam reports. It happens a couple of times a year for salespeople in my company who use Gmass (a bulk email sending tool).

I mention it only as a useful data point, and in the absence of anyone else on the thread mentioning that Google have robust email abuse monitoring.

View on HN

I wouldn't say that's robust email monitoring at all. It's embarassingly bad. Gmass shouldn't exist and your salespeople should be out of a job.

I hope you realise, it does sound like you are suggesting that salespeople in your company are essentially spammers.

Most of the salespeople in any company are spammers.

No, you don't understand. The people at my company are auto-opt-in premium-communication value-add customer-relationship-establishment specialists. But otherwise, I agree with you: everyone else is a spammer.

So, just to clarify, the salespeople are spamming cold addresses, or are they opted in or existing customers?

Was going to say there’s a good reason lots of people use services like mailchimp now. You’re not sensibly managing it yourself with the current (very sensible) regulations in the US / EU, nor do you want to be sending from your own domain en masse.

Mailchimp and other legitimate services (other than salesforce, which is best just blocked) don't permit spam, whereas gmail and outlook don't give a fuck unless the spammer gets a large amount of abuse reports.

Certainly mailchimp and the like make things simpler, but the price can be quite high.

This seems to be a laughable claim? I don't get anything but spam from Mailchimp.

No, it's valid for me, and I just verified. In spam filter for past month: 0 mailchimp. In valid emails: 6 emails from a service that I signed up for via mailchimp.

Checking my received emails for mailchimp I see a whole bunch of legitimate emails, including for flightschedulepro which uses it. I also see replies to my abuse reports to mailchimp saying the problems have been addressed.

Do you report any of these spams to mailchimp?

Indeed, Mailchimp is a tool specifically built and advertised to send spam.

Where does it say on their website that it is specifically for sending spam?

Someone’s marketing emails are someone else’s spam.

Mailchimp is specifically made for mass email emission, for marketing a newsletter and whatnot. So yeah, a lot of people will consider them spammers.

Spam is defined as unsolicited bulk email. Marketing is only spam when it isn't previous customers, or people who have specifically opted in.

100% of marketing email I've received is spam. I didn't knowingly or willingly sign up for any of it.

There's some delusion in the marketing world that just because someone places an order or creates an account they should be spammed.

Yes, I used to agree with that, but have since given in and accepted that most companies (except mine and a handful of others) will spam all customers who buy a product without asking them first.

It's a little irritating, although I reserve full enmity for the spammers who I've never interacted with ever.

> Marketing is only spam when it isn't previous customers, or people who have specifically opted in.

Yes, this excludes any people, customers or otherwise, who did not knowingly and willingly opt-in to specifically receive marketing emails / promotional emails / any other unnecessary emails.

A good heuristic is: if somebody receives an email from you that they do not want, there's a good chance you're spamming them: maybe by calling a marketing email, an "update" instead; maybe because you didn't make it abundantly clear to them when they opted-in that they would receive emails of that type.

I think thats a really wrong definition of spam. Spam is untargeted junk from people you don't know, who are probably hiding there real identity using fake email headers etc. If it's a legit company with legit unsubscribe options, it's not spam.

It worries me a lot that people clicking "mark as spam" on messages from legit companies because they subscribed to the newsletter will mean that my messages with important information (order confirmations, e-tickets etc.) will get blocked.

That's a spammer's definition. Everyone else's definition is that spam is unsolicited e-mail. Which covers most marketing e-mail, and not just the cold messages, but especially marketing e-mail from vendors you had interacted with in some way in the past.

> It worries me a lot that people clicking "mark as spam" on messages from legit companies because they subscribed to the newsletter will mean that my messages with important information (order confirmations, e-tickets etc.) will get blocked.

They probably didn't subscribe to the newsletter, they were subscribed, or tricked into subscribing. Either way, it's spam, and legitimate companies do not mix transactional e-mail ("order confirmations, e-tickets, etc.") with marketing e-mail.

FWIW, I'm one of such people clicking "mark as spam" on marketing e-mail, and I do it intentionally.

Don't send spam and I won't mark it as spam. I didn't sign up for your newsletter, don't send it to me. Creating an account or placing an order does not mean I agree to your spam.

Mailchimp is for sending emails that people signed up to receive. If enough recipients click "unsubscribe", the whole email campaign gets suspended.

Signed up, or were signed up without their knowledge, or were tricked into signing up.

>Mailchimp is for sending emails that people signed up to receive.

that might be what it is for in a theoretical sense. but that is not how it is being used.

I don't think your definition of spam matches the one that I understand it to mean. Spam is random email from someone you have not had contact with before firing messages to every address they can find anywhere on the web, the dark web, etc. Or if you ask not to be added to a mailing list and are added anyway. They often use fraudulent tricks to try to get the email through filters, such as fake from addresses.

Spam is not email from legitimate companies with valid contact details that have an opt out that you forgot to click when you signed up with them. That's legitimate marketing emails. You might argue they also shouldn't exist, but they are a different category.

I get plenty of the second from mailchimp (it's what they do), almost none of the first. Marking the second kind as spam, rather than clicking the unsubscribe link is dangerous because it teaches your anti-spam filter to reject messages from legitimate companies. You might find that if they need to contact you for a genuine reason e.g. a reciept for a future transaction, the message is blocked.

> an opt out that you forgot to click when you signed up with them

This is the textbook legal definition of spam in any sensible jurisdiction, though.

> I don't think your definition of spam matches the one that I understand it to mean. Spam is random email from someone you have not had contact with before firing messages to every address they can find anywhere on the web, the dark web, etc. Or if you ask not to be added to a mailing list and are added anyway.

I don't get _only_ this from Mailchimp, but I definitely get quite a bit of this from Mailchimp, Sendgrid, and others. I've marked it spam, reported it to them (no response), and continued to receive the emails.

I can be kind of scatter brained and generally give the benefit of the doubt, but sometimes it's pretty clear that, e.g., I most definitely did not sign up with some accountant in a different country, in a place I've never been to, to receive reminders of tax deadlines that don't apply to me and offers of accounting services I can't use. Or if I somehow did, the signup was deceptive enough that they never received meaningful consent and I'd call it spam anyway.

(And the email they're sending this to is not some easily confused gmail address or a fat finger--it's my own name at my own domain.)

Having valid contact details or an opt out on their sign up form isn't relevant given I never signed up. It's _unsolicited_, _bulk_ email. It's spam.

I get plenty of Mailchimp spam from people who have bought email lists and added me to their newsletter. It’s against their ToS, and I always indicate that I did not sign up for the list when I unsubscribe. Maybe it does something.

* Spam is not email from legitimate companies with valid contact details that have an opt out that you forgot to click when you signed up with them. That's legitimate marketing emails. You might argue they also shouldn't exist, but they are a different category.*

No, they’re all spam. It’s just that some spam is significantly worse than others.

Edit:

this just reminded me of an interaction with a customer when I worked at a dialup ISP over 20 years ago. We would routinely get abuse reports about spam coming from our network that would turn out to be a family computer with a virus. We would disable their account until we got ahold of them, and then help them run antivirus or redirect them to a local shop to fix it.

But this one time my boss is like “Hey you wanna pretend you're the email manager? We have an actual spammer sending ads for a local business through our smtp servers”. We were all laughing at the audacity of it, they were sending thousands of the same message out, I think it was for a tackle shop.

When I called the guy to let him know why we disabled his account he immediately got angry at me, I vividly remember him saying “It’s not spam, it’s for a business!!” I explained to him that it doesn’t matter, it’s just as bad, and could get the whole company blacklisted from sending emails. Turns out his friend owned the business, and convinced him to install something that sent emails through outlook express.

The reason I got that duty is because I had no problem being confrontational back then. I remember telling him that I think he should be fined, and permanently banned from the internet. But that we’ll only let him back on if he uninstalls the thing.

He called back indignantly asking why we were allowing some other spam. I had to explain that it was from another network, and we’re trying to stop it, and that if every ISP were like us then it would barely be a problem.

I wonder if that business spams through google now.

> Spam is not email from legitimate companies with valid contact details that have an opt out that you forgot to click when you signed up with them. That's legitimate marketing emails. You might argue they also shouldn't exist, but they are a different category.

Yes it is. Using a dark pattern to trick me into signing up doesn't make it not spam. It's still spam.

I disagree, I get plenty of spam from Mailchimp. Spammers seem to be able to add email addresses to Mailchimp without verification, and they just keep making new accounts/"campaigns" to re-add my email addresses.

Legitimate companies like to not provide the legally-required opt-in flow and assume consent without ever enabling or disabling a consent checkbox. That is spam too.

It's on Mailchimp to not take business from companies that abuse their system. If they get flagged as spam and their other customers have delivery issues because of that, I see that as a feature, not a bug.

> Spam is random email from someone you have not had contact with before

It's very rare, but I get those types of spam emails from MailChimp.

I would disagree with that definition, and wikipedia and multiple dictionaries appear to agree with me; it doesn't matter how many dark patterns the company uses or whether they (claim to) let you opt out after the fact, if the message is unwelcome, it's spam.

https://www.merriam-webster.com/dictionary/spam

> spam noun

> unsolicited usually commercial messages (such as emails, text messages, or Internet postings) sent to a large number of recipients or posted in a large number of places

https://dictionary.cambridge.org/dictionary/english/spam

> unwanted email, usually advertisements

> Spam is random email from someone you have not had contact with before firing messages to every address they can find anywhere on the web, the dark web, etc.

> Or if you ask not to be added to a mailing list and are added anyway.*

> Spam is not email from legitimate companies with valid contact details that have an opt out that you forgot to click when you signed up with them.

There's a HUGE grey area between the random unsolicited emails for scams and legitimate business partners where I forgot to check the opt out. I get almost none of the first (spam filters are pretty good at keeping Nigerian princes from getting help to access their money), and also almost none of the last (because I'm hypervigilant about opting out of email and cookies and all that trash), so all the spam I get is from "asked not to be added but added anyways".

Most of those are coming from Mailchimp and similar services. I'm sure that if I could take the senders to court and disentangle their web of parent companies that had my email in the web form for 10 seconds before I opted out and they sold it to each of their 20 daughter companies and partner organizations, and then I received the first "legitimate marketing email" (LOL! LMFAO!) and unsubscribed from that (which will take effect in 20 business days) so now I'm only subscribed to 19 new mailing lists from that company and also the dozen other organizations they're a part of, until they pivot to a new marketing agency which - oopsie! - forgot about my opt-out request.

That's Mailchimp's business model and the way that the entire "legitimate marketing" economy works, but I still consider it spam.

I guess you can only report spam through the gmail web interface which the FSF aren't using (because they're not using gmail, for obvious ideological reasons).

I did some tiny digging because I remembered that there is a way to report individual messages in a structured machine readable way to abuse@ for these things --- i suspect that this is technically supported by gmail (if not given a lot of signal weight)

https://en.wikipedia.org/wiki/Abuse_Reporting_Format

How to bulk do this is interesting too. https://en.wikipedia.org/wiki/Feedback_loop_(email) says that gmail has a bulk format and that sendgrid is seeing some success.

Not defending just trying to see what a technical solution looks like

Edit: https://www.twilio.com/en-us/blog/insights/leveraging-gmail-...

Shows you how to use googles thing if you are a sender to know if @gmail folks are reporting you. It doesnt address what to do if someone's @gmail is doing this to you (a workspace custom domain yes)... @gmail are rate-limited to a few 1000s per day per gmail address but this is still a lot obviously

> Google have robust email abuse monitoring

But only in Gmail then? Where is it possible to report a spam from a Gmail address received on a non-Gmail inbox?

Google is being a real PITA as the receiving side for people who try to self-host their mail or who use small providers. They should at least be good citizen on the sending side, which it seems they're not. They are killing email.

Spam reporting is pretty standardized? If your email client doesn't support it that's not Google's fault.

edit: I might be incorrect on this and was thinking about how unsubscribing is standardized instead.

Standardized how?

Basically, there is no standard beyond the ages-old requirement to have abuse@ and postmaster@ email addresses that react to such reports. Which Google doesn't follow at all, you just get redirected to some useless web form which requires a Google account and the sacrifice of a goat.

It is entirely Google's fault, and they should be shunned for it and their emails dropped. But unfortunately, they are too big for that by far...

Maybe is thing about Gmail about "This message is spam", that is a Gmail feature not anything standard.

Same as Gmail broke IMAP standard, or Gtalk XMPP standard.

Google can do whatever they please, they've become the standard of humanity surveillance.

Marking a mail as spam locally is different from spam reporting

https://support.google.com/mail/contact/abuse

You can use this form

>They should at least be good citizen on the sending side, which it seems they're not. They are killing email.

Eh? They do tons in anti-bot detection. But the value in exploiting and using Google's service is extremely high so bot authors are increasingly getting creative. Google stops running Gmail and simply another service becomes a high value target.

At least Microsoft fixed their Azure abuse after 10 years of not giving a fuck. It used to be stupid fucking easy to setup a trial O365 tenant and spam the fucking internet through "onmicrosoft.com" domains. And they let that go for 10 years.

I think in this case and all the others.

They're not sending emails directly from their gmail address.

But they are adding victim emails to other Google services and then Google themselves send them invitations emails.

And if you name your service like "Google helpdesk - password reset" or something like that.

Invitation email from Google will look very official, but URL in the email will be controlled by the attacker.

It's pretty old working technique used for phishing for years now.

Spam report does nothing, since you're reporting official Google email.

How would it even be possible to name a service "Google helpdesk - password reset" or something like that, without being insta banned? Obvious fraud in the making, not getting recognized?

Reply on news.ycombinator.com