Hacker News Reader

Comment by timrosenblatt | Hacker News Reader

"it's easy to unsubscribe with one click. If people didn't want it, they would have unsubscribed"

Be careful with this assumption. It might surprise you how many people won't bother to click unsubscribe (no matter how obvious you make the option) b/c they just click "spam". I have friends who have been caught by this one in the past.

View on HN

That was my knee-jerk reaction too, until I actually clicked on the link to Bit of News page. It's very simple and straightforward. It says "Daily 60 sec news summary in your inbox" and asks you to enter your e-mail address to subscribe.

I've been in a lot of situations where I gave out my e-mail address to some site because I needed to have them let me know about something specific and then I started receiving unrelated stuff from them. That's what I would call a form of spam. But receiving periodic content you explicitly signed up for? I personally can't find a reason to call that spam.

If there's anyone who decides to subscribe to this and then later can't be bothered to unsubscribe, that's really their own problem.

That's a good point but I think it's a weak assumption.

So far I haven't received any spam reports from Mailchimp - hopefully that's because I haven't received any instead of Mailchimp failing to catch any haha...

I agree! There are also a lot of spam-mailers that use their unsubscribe link just to confirm that the email adress actually belongs to a human. Thats why I tend to ignore the unsubscribe button, when the mail looks fishy.

Wouldn't it be nice if mail programs followed any rel='unsubscribe' link found in a message, whenever the message was marked as spam?

As mentioned below, giving spamm'ers a way to test a block of (presumably random/dictionary-generated addresses) for valid subsets isn't a very good idea.

It would be nice if everyone that actually allows unsubscription would set the correct headers. In my experience, only traditional mailing-lists do, and all the stuff you really want to unsubscribe to reinvent a new interface over http(s). Which isn't great if you're in an email reader, not a web browser.

If people could get their act together and actually supply an accurate text/plain part to all the "fancy" html crap, that'd be great too.

It always makes me sad when companies realize that they've not got an interesting enough offer that stating it in a short concise text is going to get any conversions, an then assume that if they format it so it's unreadable on a small screen, add a lot of images that'll be blocked for privacy reasons, their offer will be more enticing.

Makes me even more sad that it (apparently) works.

No, because it would help spammers identify valid addresses.

This is the argument I see everyone using, but I don't understand it. Why does it matter if a spammer knows your address is valid, if they've already decided it's valid enough to spam it? Do you think spammers really bother to validate their address-lists before reselling them to other spammers? (Even if they do, though, I think it'd be irrelevant. If your spam filter is effective, it doesn't matter how much "true spam"--things you have absolutely no chance of finding interesting--you get. It all gets filtered away before you see it.)

Think about it this way: if there was an auto-unsubscribe mechanism, which ethical bulk email senders honored and spammers didn't, then it would become much easier to filter spam: any message that clusters into a message-cluster that the system has sent out an unsubscribe-request for already, is junk.

Maybe more importantly, they would know whether their message was classified as spam (or a pretty good heuristic thereof). A naive bayes classifier for spam relies on the spammer not knowing whether the message was marked as spam or not. Such a classifier isn't difficult to fool if you can test how a given message is classified. (Presumably gmail's spam filter is more advanced these days, but the idea that it is easier to fool if you can tell the result still seems reasonable.)

Here's an alternative idea: what if clients would only honor rel='unsubscribe' links with an HTTPS URL scheme, and only finish the TLS handshake for those requests if the host sends the client a valid Extended-Validation certificate?

Every spammer who wanted to "trick" the auto-unsub mechanism would basically have to first dox themselves for all the world to see. And any certificate that turned out to not be a valid means of contacting the spammer would be quickly revoked.

Well can't they do that anyways, by sending emails to an address they own and seeing what gets classified as spam?

>Why does it matter if a spammer knows your address is valid, if they've already decided it's valid enough to spam it?

Because then they can dictionary attack a large list of random emails, send out a trivial campaign, and collect a list of valid users then sell it to someone else.

Which is why people need to put their Unscubscribe buttons in large at the top of their emails too, not just in tiny script at the bottom. :)

I don't know if that's quite true. I think in a script in the bottom is fine, as thats where people expect it to be. If its a simple, one-click thing, then its fine. I think adding big unsubscribe buttons at the top is just noise and obstructive to people that are actually reading your emails. Sure there are people that will just mark your email as spam or filter it to the trash, but I don't know how much of a difference the location of the unsubscribe button will make to them because I suspect they likely aren't even opening your emails to begin with.

i only click 'spam' or 'junk', and never,ever click any link in the mail itself.

Perhaps we need a ham filter instead of just one for spam.

Reply on news.ycombinator.com