Hacker News Reader

Comment by petercooper | Hacker News Reader

I send a LOT of emails each month (email newsletter business - yes, legit!) and ran into an separate but topically related and amusing problem recently.

My newsletters are aimed at developers, and one issue went out and was considered by Gmail to be a 'phishing' attempt. I couldn't figure it out. Several issues later, another one was picked up the same way and I figured it out.. In both issues, one of the items was linking to domains that looked a bit like this "www.0x10abcdef.com" (this is NOT the actual domain) - basically a domain that looked like a hexadecimal number. I ran numerous tests and Gmail always considered mails with links to domains like this to be phishing attempts.

I reported this as a bug (since nothing was wrong or reported with the domains in question, it was basically Gmail's filter being in error) but no idea if it was ever resolved.

View on HN

It's probably specifically penalizing anything matching /https?:\/\/0/ because you can specify an IP address using hex or octal in most common browsers.

hex: http://0xD83AC02E

octal: http://033016540056

That's my guess, at any rate.

Yes, URLs like that are commonly used in phishing emails, so that's my hunch as well. They're just not recognizing that such strings can appear in domains so I suspect it's a simple bug but probably not one they'll fix.

OT: What does the red-flower-on-the-sun doodle mean?

Argentina National Day 2015

Edit: You can usually find out what they mean by going to https://www.google.com/doodles

I plan to build a developer mailing list but am hesitant to actually do so because all the advice I read tells me to do things that I personally find morally reprehensible.

tl;dr: I would blackhole my own mailserver.

Have you any advice for me?

Im planning to use confirmation as is done by free software mailing lists but my concern is how to flog my website without offending anyone by flogging my website.

use mailchimp or sendgrid or sailthru instead of self hosting it.

If I include graphics in my mail, are the graphics hosted by an http server or included in each mail?

it is generally up to you, you can inline them (MIME/base64? in the message) or remotely serve.

it'll usually serve remote http pixels for "open tracking" either way though

That's my whole point.

I regard such tracking pixels as morally reprehensible. While I know most of my subscribers will disable remote images anyway, quite likely they would think poorly of me for serving them.

All the stuff I read about email marketing is all about all the kewel things one can do with email bugs.

consider using your own software, but relaying through mailgun then. dumb relay, other than bounce management and notifications it won't try to append garbage to your messages.

You regard finding out whether someone you have sent a marketing email to actually opened that message as 'morally reprehensible' somehow? I know that blanket surveillance and government intrusion is a bad thing, to be minimised, but I'm not sure that also makes recipient tracking for one's own marketing purposes evil. If done right, cookies, email bugs and similar technologies are benign, or even beneficial to the recipient... It's all about finding out what the customer actually wants by observing what they do, since when you ask them, they often don't really know.

Not OP, but -- Yes. Morally reprehensible because it removes choice from the user/customer.

I might tolerate your initiation of contact, but I will not tolerate your observation of my reaction, without consent.

For this reason, I will not click on links with obvious tracking parameters. I strip them out first, or come to get the information some other way.

I'm cool with some discovering that I read their eMail.

I am not cool with them discovering I read their eMail while receiving pleasure in a hoyse of ill repute.

Recipients of email containing tracking beacons are generally not aware that such things exist, did not give permission for them to be used, and generally speaking, if they were aware of their existance, would opt out.

So if you use them, you're taking advantage of peoples ignorance. Seems morally reprehensible to me...

> quite likely they would think poorly of me for serving them.

Mandrill sets open tracking to 'off' by default[1] and no doubt Sendgrid, et. al make it optional as well. Same goes for link tracking.

(I use Mandrill for emailing dev-related stuff and was also sensitive about this given the demographic/privacy)

https://mandrill.zendesk.com/hc/en-us/articles/205582907-How...

> it'll usually serve remote http pixels for "open tracking" either way though

given how most clients/web-mails filter these by default, is this of any use? Only users which explicitly click on "show images" will get tracked, and the rest won't even show see your email properly.

And GMail for example will proxy the images as well, so they cant be tracked as easily.

Reply on news.ycombinator.com