Hacker News Reader

Comment by encoderer | Hacker News Reader

Obviously you're entitled to your opinion.

But I think the fact that users opt-in to HTML emails and engage with them far more frequently than text opt-in and engagement indicates that your opinion is an outlier.

I like HTML email. I opt-in only to companies that interest me enough to do so. Those times when I'm opted-in accidentally by not unchecking a box or whatever during checkout I just unsubscribe from and move on. What I have left is useful content in my inbox, some of it more directly sales oriented, the rest more generally informational.

Similarly, for certain senders, I chose to tell Gmail to always load their images — including tracking pixels. It's not a violation of my privacy any more than the numerous pixels on any other website I read.

View on HN

I have little doubt that I am an outlier, since most users have no idea what HTML even is. I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox.

HTML mail itself is a security problem. It has been used for fairly sophisticated phishing attacks in the past:

http://blog.mxlab.eu/2010/03/13/phishing-emails-with-attache...

It is almost certainly being used for phishing attacks now. It makes it difficult to give users visual cues about which emails can be trusted, since the sender could have embedded HTML in the message to present that same queue. An attacker might give the user the idea that a message was digitally signed by using HTML mail.

Security with HTML mail is a serious enough concern that the DoD will sometimes convert all incoming HTML mail to plaintext as a precaution:

http://it.slashdot.org/story/06/12/24/1922216/department-of-...

"It's not a violation of my privacy any more than the numerous pixels on any other website I read."

In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation.

> In other words, it is a violation of your privacy. The fact that it is a common practice on the web does not somehow make it less of a violation.

So...the web at large violates people's privacy. I can agree to that, but I prefer a world where everyone has easy access to large amounts of information.

If the available communication mediums are only those that are secure but difficult to use, then the ecosystems of many sites would be much smaller. I can't imagine trying to browse Facebook or Yelp over a TOR connection. It's feasible but annoying to me. That tells me most of my friends and family would simply consider this process unfeasible and not use it.

You know, there was a time when browsing the web did not entail constant violations of your privacy. The web has always been open and has always been giving people easy access to information, since its very inception; the assault on privacy came later, when greedy advertisers showed up and took advantage of security problems and user ignorance.

While Tor is fairly annoying for most people (even myself), other privacy-protecting systems are less annoying. I have yet to hear someone complain about using ABP, which I would classify as privacy protecting (it blocks a large number of common tracking systems). I suspect nobody would complain about Firefox blocking tracking cookies by default either.

Really, we can live in a world where privacy is respected if we are willing to do so and willing to deploy the necessary technologies. One of my side projects is to develop a system that allows targeted ads to be delivered in a privacy-preserving fashion, so that advertisers can know which ads are successful without knowing whether any individual person actually viewed or clicked on their ads (using cryptographic techniques). My point is that there is no need to violate privacy and that better technologies can be developed and deployed.

You know, the "Greedy Advertisers" showed up when "Greedy Website Operators" decided that they didn't want to pay out of pocket to provide people with information. And that, actually, they'd like to make a buck or two doing it.

The web today has far more information and functionality than ever before. Much of this free to me because of advertising.

You act like the advertisers some how force things down your throat. If you don't want to deal with advertising, the answer is simple: Avoid websites that rely on advertising dollars.

"Avoid websites that rely on advertising dollars."

Or plan B: ABP.

So you're THAT type.

You feel entitled enough to just take what you want from a website while they pay the cost for your traffic.

Well, go ahead with that. And justify yourself with your "greedy advertisers ruined everything and violate my privacy" BS.

Feel free to have the last word here.

ABP is one of the first things I install on friends' computers which I have had to remove malware from. I genuinely think, for normal non-techy users, it is probably one of the most effective and simple methods of stopping people accidentally giving themselves problems.

Obviously this isn't because of the nice sites with good content which just want to make some money from their effort, it's generally because of less legitimate sites. But I think the idealogical argument of "these content providers deserve to get paid" just falls into irrelevance for these people when the alternative is protecting their computers, privacy, safety online, and of course their time.

As an ABP user who uses it mainly to make my internet experience nicer, I can take the time to unblock websites which I agree I should be supporting or reimbursing somehow for the content they have provided me, but most people would never take the time to do this, and for them the best solution seems to me to be blocking all ads where possible.

> I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox.

Are you serious? I can assure you that I have opted in to receive email, even HTML email, and so have nearly all my friends.

> It is almost certainly being used for phishing attacks now.

And the solution is to teach users about phishing. That's the only sane route, it's what everybody is doing and, by the way, and it mostly works (despite some ISPs, governments and banks trying hard to teach people that they must click on every unreliable warning).

> An attacker might give the user the idea that a message was digitally signed by using HTML mail.

That's a bug in your reader.

> most [email] users have no idea what HTML even is.

For most users email is something you do in a web browser. They've never used it any other way.

> I am doubtful that people are truly "opting in" to receive email; it seems more likely that they were not paying attention to the "yes by default" checkbox.

We manage lists with an aggregate about 1 million people who have all explicitly ticket checkboxes that were not checked by default and/or explicitly gone into their user account and added mailing lists on various sites we operate for clients.

That you even doubt that people are truly opting in just reinforce how much of an outlier you are.

Reply on news.ycombinator.com