GitHub notification emails have tracking beacons | Hacker News Reader

GitHub notification emails have tracking beacons

bugzilla.mozilla.org

21 pointschris_wot15 comments

This is fully official: https://github.com/blog/1214-notification-email-improvements

> Notifications that are read as HTML email are automatically marked as read in the github.com notifications interface. An invisible image is embedded in each mail message to enable this.

If your client displays email in HTML (GitHub also sends the text version) and does not intercept images, then your client is leaking, and you should be concerned for your privacy every time you open a email.

I suggest to give a spin to this checker: https://emailprivacytester.com/

The linked Twitter conversation is reasonable:

https://twitter.com/hfiguiere/status/483040912491036672

If you read the email, they mark the notification as read so it doesn't bother you in the web UI. I'm a strong supporter of user privacy, but this is a reasonable thing for GitHub to do.

It was also announced officially on their official blog back then: https://github.com/blog/1214-notification-email-improvements

> Notifications that are read as HTML email are automatically marked as read in the github.com notifications interface. An invisible image is embedded in each mail message to enable this.

And you can always read Github's source code to find out if they're using the tracking pixel for anything el- ohhhh waaaait

The linked Twitter conversation[1] explains it quite well:

> It’s only used to mark notifications as read when you open the email

And the reaction from Hubert there is a bit excessive.

[1]: https://twitter.com/hfiguiere/status/483040912491036672

I'm confused why he has such an axe to grind. It's not like this is an unsolicited email: you have to choose to be watching the repo/issue/commit to get these kinds of notifications.

How he gets from a notification email to a company that violates privacy and has no ethics is beyond me.

The tracking beacon is harmless, I actually think the feature is pretty cool. And it looks like Mozilla's MDN uses non-opting tracking beacons as well: https://github.com/mozilla/kuma/issues/1985

So there's no need to file an issue with the same company who does the same thing on their developer network.

You know what is really funny...

These people have a problem with github's email tracking img. But they have no problem posting their live all over the internet for anyone to see...

https://github.com/hfiguiere

https://twitter.com/hfiguiere

http://www.figuiere.net/hub/

https://www.flickr.com/people/hfiguiere/

https://mozillians.org/en-US/u/hub/

I know WAY more about him based on those 5 links then I ever would from a tracking pixel which barely tells you anything.

The difference here is control. When I push a patch to github or post a picture on flickr , I decide what happens. If someone updates an issue and github tracks that I read the email without giving me the ability to opt out, I don't.

This is a bad argument. Just because the user decides to share certain information, doesn't mean they give up their right to privacy.

That being said, the GitHub tracker is not a privacy concern in my opinion and enables a useful feature. If it makes you uncomfortable, then you should always be using text-only email browsers.

This isn't a scandal. Either the originator is genuinely surprised that this kind of thing is an ordinary practice in corporate mailouts or they're trying to kick up a stink.

Downvoted.

> Downvoted

You can't downvote a story. You can only flag.

summery of linked twitter convo

- this is an invasion of privacy

- we only use it to mark an issue as read just like if you read the issue on our site

- so you admit you encroach on people privacy?

- you can disable it by turning of image auto display like your reader likely does by default

- I already do, this doesn't affect me, random comparison to facebook and insults to githubs ethics

- we actually do have ethics, IT'S JUST TRACKING IF YOU READ THE ISSUE

Isn't this how practically everyone tracks email open rates? MailChimp, Amazon, etc...

If you don't like it, turn it off.

Reply on news.ycombinator.com