Hacker News Reader

Comment by wl | Hacker News Reader

> We were also informed that our normal, business communications with paying customers should have unsubscribe notices appended to them. Which is to say, you're a paying customer of a service and we send you some kind of alert or critical announcement ... and it should have an unsubscribe link.

You absolutely should. The amount of junk I get because someone else signed up for something and fat fingered their email address is ridiculous. "Mandatory communication" with a company I've never dealt with gets flagged as spam.

View on HN

That's a (very legitimate and important) reason to do double opt-in unilaterally for all email communications. Companies should make 100% sure that the person who signed up, and the person receiving the email, are the same person, before they associate the email with the account. Otherwise, malicious people can sign up arbitrary third parties for tons of random crap.

But it's not a good reason for adding unsubscribe links unilaterally to all email communications.

Remember, unsub links are machine-automatable; Gmail at least offers to follow any embedded unsubscribe links for you if you mark a message as spam. (Which, with hotkeys enabled, is one accidental keypress away.)

So consider the extreme case: what if the user fat-fingers an unsubscribe (without realizing) to their local electric company's e-invoices, which is what they've been relying on to prod them to log onto the site and pay the bill?

If it's clear that "bills you need to react to or your power will be shut off" shouldn't have an unsubscribe link, then clearly there's some sort of line that must be drawn somewhere.

(Note, I'm not arguing against the use of "Manage your Mail Preferences" links in these cases — the kind that act as magic sign-in links and take you directly to a page on which you can un-check a "mail me about X" checkbox. It makes sense to include those. I'm just arguing specifically against unilaterally including "Unsubscribe" links — the kind where following the link unsubscribes you with no further confirmation needed.)

> So consider the extreme case: what if the user fat-fingers an unsubscribe (without realizing) to their local electric company's e-invoices, which is what been relying on to prod them to log onto the site and pay the bill?

To name a specific example of this problem, I want Gulf Power of Florida to stop sending exactly the kind of email you speak of. Bills. Nastygrams when the person falls behind on the bills. Unwanted power saving tips. Calling the company and sending them postal mail has not helped. It all gets marked as spam these days. If they had an unsubscribe button, it wouldn't.

If the email is so damn important, they can go back to sending postal mail to the service address when someone unsubscribes.

I think you're trying to use two wrongs to make a right. If we're talking about things Gulf Power of Florida should do differently, then rather than add unsubscribe buttons to bills which is a bad idea, they should confirm people's email addresses before sending them email.

What's wrong with giving the user the ability to remove themselves from any automated emails? The alternative is being hit with the spam button.

They should have confirmed their user controlled the email address, too, but why not go with both?

And this is hardly confined to Gulf Power. Verizon, Spectrum, countless banks...

Well, I think letting people get silently charged monthly without sending them any message about it is a bad idea, even if they say they want it. Similar with not telling them about an outage to their service.

Well, then that mail is going to get legitimately marked as spam when I didn't request it, I have no business relationship with the sender, and there's no other way to make it stop. And the user is still getting silently charged because it's going to my inbox, not theirs.

Unsubscribe is the alternative to the spam button. If you don't provide it, you are asking to be marked as spam, no matter how important you think the email is.

If you have no business relationship with the sender, this is fixed by not sending email to unconfirmed addresses, as we discussed above.

the email w/unsub link could be forwarded also, it's often a portal to change notification settings w/o auth and leaks personal preference info - and when there is auth it's impossible to unsub when if were signed up maliciously.

it happened to me - someone charged a bunch of stuff to my cc and then registered my email at thousands of sites to bury the email receipts (it didn't work since I have simple filters for that sort of thing) but it has been impossible to unsubscribe from all the junk. livemail's bulk optout was roughly 50% effective. the dark patterns around optout are outrageous and it's worse when you have to use google translate just to find it.

Ugh that sucks.

But in the cases where there is authentication, isn't it enough (in most cases) to reset the password and change the email to something disposable?

Of course that's not really practical for the case where you get subscribe-bombed, but maybe for the general case it is, no?

a bunch of my remaining junk accounts have broken pw reset, or even after taking control there's no way to delete the account and/or the "optout of everything" option doesn't actually stop them from sending me junk regularly (ie they just dont honor their own optouts)

> So consider the extreme case: what if the user fat-fingers an unsubscribe (without realizing) to their local electric company's e-invoices, which is what they've been relying on to prod them to log onto the site and pay the bill?

I actually unsubscribed from my provider's invoices. That's because I have activated direct debit from my bank account so they're always paid, and I can view my past invoices on the website.

However you make a good point. I'd say the one thing where it doesn't make sense to have an "unsubscribe" at all is on "bill unpaid" emails.

For my power to be cut off, I would have to…

1. Forget I had a monthly power bill for a couple of months.

2. Ignore the e-bill that gets sent to my bank bill payment service - ebills have been a thing for almost two decades. I worked on some of the early implementations.

3. Ignore the physical snail mail warnings for a couple of months.

> Otherwise, malicious people can sign up arbitrary third parties for tons of random crap.

In the early days of the internet I was a teenager in a prank war with someone so I signed them up for all kinds of spam and also free trial magazine subscriptions.

That's a different problem. They should have first sent a confirmation email, then paused all communications until it was confirmed.

But once the email is confirmed, I think it's totally fair for a company like rsync to say 'if you're a paying customer of this service, then we need to send you certain information to fulfill our obligations in the contract, if you truly don't like it cancel your account and take your business elsewhere.'

Yep. I had to file a GDPR complaint to get an airline to stop sending me "letters from the CEO" and other COVID-related reports that never mattered to me.

I never flew with them but somehow they still sent ads disguised as reassuring messages every other week.

Support constantly denied help, since I was never a customer. Only a GDPR complaint solved it.

Reply on news.ycombinator.com