Hacker News Reader

Comment by ForHackernews | Hacker News Reader

In the pantheon of tech company misconduct, opting users into marketing emails when they open a support request seems pretty minor (especially if they can easily opt-out).

This is at worst, a trivial annoyance. I don't see how we need regulation to outlaw this behaviour.

View on HN

Sure, sending spam that I can opt out of isn't the worst thing they can do. But if you are selling security products I expect better morals than that. This is yubico squandering trust in exchange for sending a few more marketing emails.

Considering legislation: I live in Germany. Over here unsolicited marketing mail (snail mail) addressed to me is illegal. I fully support legislation that extends the same standard to email (and I'm pretty sure yubico's behaviour is illegal here). It's waisting my time and computing resources for somebody else's gain (and that on a massive scale: if you waste just one minute each from a million people, that's two full years wasted)

> I fully support legislation that extends the same standard to email

Has already happened. Sending unsolicited marketing via email is illegal in Germany. For some light reading I can recommend this lawyers blog who blogs about his lawsuits against spammers https://www.kanzlei-hoenig.de/search/Spam/

A recent high profile case deciding that even marketing in auto replies constitutes spam was this https://www.dr-bahr.com/news/werbung-in-autoreply-e-mails-is... (with links to high court decisions)

An overview about under which conditions Marketing Mails are legal is here https://www.datenschutzbeauftragter-info.de/fachbeitraege/ne...

You can request that the sender produces a protocol of your opt-in. That’s usually the best route as a layperson since it demonstrates that you know your rights, carries no risk since no accusations are leveled and is a red flag for any lawyers on the other end. I have a link to a good sample text somewhere but can’t find it right now.

Well, it’s says a lot about their company values though. That you can take and extrapolate on anything else they might do or not do

this says nothing about the company values; a person made the wrong decision. you’re blowing it up in a fantastical way, like the author of the editorial.

i don’t make purposeful email addresses; i don’t have time for that.

It's again like the social media issue. Lot of people don't care doesn't make it right thing to do. These type of things should be opt-in.

> a person made the wrong decision

…during the course of that person's work duties, for which the company, therefore, owns responsibility. Literally every single thing any company has ever done wrong boils down to "a person made the wrong decision."

> i don’t make purposeful email addresses; i don’t have time for that.

Yes, but security and privacy researchers make time for this specifically to validate whether companies follow their own privacy and usage terms as well as to quantify and gauge the risks in interacting with a company, such as the risk that the company will misuse that information or the risk that the company may be breached, resulting in user account details being used in attacks against the individual users themselves.

It's fine if you don't do any of this or, for that matter, if you don't even care. But don't belittle the work when you don't understand the reasons for it.

> It's fine if you don't do any of this or, for that matter, if you don't even care. But don't belittle the work when you don't understand the reasons for it.

Maybe don't over invest your emotions in something that isn't really important in the scheme of life? shrug. I don't think this is belittlement, but advice on how to manage stress.

On the later subject: I have a catch-all on a subdomain, so I do that on a regular basis with zero time effort (amortized). Just enter "${websitename}@antispam.[...].com" during registration. I'm actually surprised that only a handful of these addresses receive spam; but misconduct as described here never happened to me.

(Website and service operators claiming they were not pwned, however, is pretty usual).

> i don’t make purposeful email addresses; i don’t have time for that.

I do, because I can make them automatically. With Fastmail, if your address is name@fastmail.com you can make an email somerandomcompany@name.fastmail.com and it will automatically make it to your inbox. Fast, convenient and zero effort.

>time for that.

I wish you good luck :) I, like many other people in this community, make sure everywhere I register I use a unique username/email. It is also safer as to have a different email for each service. This way I know which * sells my data left-right-and-center.

As for the Company Values, these are the ones _practiced_ by its people. No point having an adamant privacy policy if your staff actually disregards them.

> a person made the wrong decision.

Even if that were true, they doubled down on their decision:

"Hi Chris, Thanks for reaching out. We've removed you from our email list."

That is not acknowledging they made a wrong decision here, it's an attempt to re-frame what they did as as simple opt-in/opt-out mailing list business.

It's not that hard either: "This shouldn't have happened. We're looking into it. We're sorry (and here's cake for your trouble)." Not this "I'm sorry you feel sad because I ran over your cat (but not for running it over)".

> "I'm sorry you feel sad because I ran over your cat (but not for running it over)".

Hyperbole much? How about "sorry I called you during dinner"?

> i don’t make purposeful email addresses; i don’t have time for that.

It takes zero effort with gmail and a number of similar platforms. e.g. for gmail and hotmail just put a +something after your username:

foobar+yubikey@gmail.com

You don't even have to prepare it advance, just do it when you're signing up to a site and it'll happen automatically.

Reply on news.ycombinator.com