Browsing your website does not mean I want your spam • Hacker News Board

Re: Browsing your website does not mean I want your spam

#31

Post by pdkl95 » Mon, Aug 22, 2016, 7:28 PM UTC

jamiesonbecker wrote: post #22

tl;dr: related: Amazon sold (or gave) my secret Amazon email address to third parties without my express consent rather than using their remailers. I have exactly one email address that I use for Amazon, and I've never used it elsewhere for anything else. I occasionally receive emails from vendors (through the vendors' mail servers themselves, not remailed through Amazon per mail headers) at Amazon that I have bought…

> exactly one email address that I use for Amazon

This is why I use my entire domain as my email address (i.e. *@example.com is routed to my inbox). This makes it trivial to hand out a unique address every time I fill out a form.

If any spam arrives that is addressed to "vendor.com@example.com", it's obvious who sold their email db. Bonus: it's easy to filter out spam when the spammer is sending to a unique address.

Re: Browsing your website does not mean I want your spam

#32

Post by anilgulecha » Mon, Aug 22, 2016, 7:29 PM UTC

More directly - if you want your precious content/resources to make you money, make sure you send the bits over an authenticated & paid account.

Not behind an overlay, or with a adblock redirector or when the user-agent has 'googlebot' in it.

If you send the bits over, then I may consume them with no additional payment, whether via ads or mailing-list or account signups.

Re: Browsing your website does not mean I want your spam

#33

Post by FussyZeus » Mon, Aug 22, 2016, 7:35 PM UTC

I just love the amazing "Terms of Service" that all of these ad companies have, letting you know that by virtue of loading an HTML page you've consented to have your personal information of ANY caliber spread all over their ad network, their "partners" networks, and to anyone else with a buck and a server, and immediately absolve themselves of any responsibility for what that might mean in terms of information falling into the wrong hands.

I can't think of another business that has this kind of insane amount of easy-to-start interaction that results in so much activity and yet can claim zero culpability for any consequences. It's as if you purchased an airline ticket and the ticket came with a 17 page document attached where they spell out that by flying on this aircraft you agree to have tickets pre-planned in your name for 24 other flights, the plane may or may not make a stop off in 6 airports en route to your destination, the pilot occasionally likes to do barrel rolls and loops but he's real good at it so don't worry, and by the way occasionally the engines fall off but you don't get to sue us if anything goes wrong. ENJOY YOUR FLIGHT

Re: Browsing your website does not mean I want your spam

#34

Post by eridius » Mon, Aug 22, 2016, 7:37 PM UTC

ashark wrote: post #12

gwbas1c wrote: post #7

This is why gmail has a big fat "REPORT SPAM" button. Shenanigans like this are SPAM, and should be reported accordingly.

Learning to stop worrying about messing up people's ability to deliver email and just liberally hammer the "REPORT SPAM" button for any email I didn't want to see anymore improved my email experience substantially. So much faster than messing with filters. I also tell Twitter that every ad they show me is offensive. Because they are.

The problem with this is it's easy to start getting legitimate marketing emails that you signed up for filed as spam, because they look similar to the marketing emails that you've been reporting. For example, for a while SpamAssassin decided that every email from the PlayStation store (even receipt emails) was spam, primarily because they look similar to other emails I've marked.

Re: Browsing your website does not mean I want your spam

#35

Post by DavideNL » Mon, Aug 22, 2016, 7:44 PM UTC

what i usually do is reply to their spam e-mail on a support mail address and ask them to stop sending me spam: waste their time the same way they waste my time... if everyone would do that the problem would be solved.

Re: Browsing your website does not mean I want your spam

#36

Post by sseagull » Mon, Aug 22, 2016, 7:47 PM UTC

Bartweiss wrote: post #26

gwbas1c wrote: post #6

This is why I own my own domain and have a catch-all email address. When I give a company my email address, I use (companyname)@domain.com. They all forward to gmail; where it is very easy to filter out (companyname)@domain.com once shenanigans like this happen. It's also easy to track down and shame companies for doing this, too.

Even for Gmail users, the + notation will handle this well. foobar@gmail.com and foobar+SearsSoldMyEmail@gmail.com will both direct to the same location, and relatively few resellers have the sense to strip the extra data.

If you run your own mail server you can set it to be any character you like. I have mine set to a dash, which tends to be accepted everywhere and less likely to be discovered as an alias (although certainly not impossible)

Re: Browsing your website does not mean I want your spam

#37

Post by bitchypat » Mon, Aug 22, 2016, 7:47 PM UTC

Sir_Substance wrote: post #13

r721 wrote: post #2

This is the reason I keep "Block third-party cookies and site data" option checked in Chrome.

I'm a big fan of "self-destructing cookies" for firefox. It automatically clears your cookie cache when you leave websites, unless you add exceptions.

Great extension. The only annoyance is that when I run ccleaner it wipes the list of sites I want to keep cookies for, so I have to re-add them. But those extra clicks are definitely worth it.

Re: Browsing your website does not mean I want your spam

#38

Post by sp332 » Mon, Aug 22, 2016, 7:50 PM UTC

jamiesonbecker wrote: post #23

sp332 wrote: post #21

Earlier quoted context omitted.

This is really pushing the boundaries of the CAN-SPAM act. You're not allowed to send unsolicited emails. You shouldn't be allowed to pretend that visiting a site is a solicitation. Edit: I misunderstood the mechanism of collecting the addresses. This isn't skirting "unsolicited mail", but it is circumventing the ban on harvested email addresses.

> You're not allowed to send unsolicited emails. Actually, you ARE allowed to send unsolicited email, even commercial (UCE). It has to be clearly labeled, contain the postal address of the sender, and contain unsubscribe links. Also, CAN-SPAM only applies to senders in the U.S. (unfortunately). https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003#Applicabi...

I don't know if I would call it a "relationship" message, but maybe it's a "transactional" message, where serving the webpage counts as the transaction?

Re: Browsing your website does not mean I want your spam

#39

Post by simcop2387 » Mon, Aug 22, 2016, 7:50 PM UTC

kazinator wrote: post #17

I wrote myself a web application called Tamarind that runs on my web server for managing throwaway mail aliases. "Tamarind" == "Throw-Away Mail Alias Randomization Is Not Defeatable" :) http://www.kylheku.com/cgit/tamarind/tree/README I log in with my IMAP4 user name and password, and then get a simple UI with a table of my aliases, and attached memo strings (which can contain URL's that get converted to links). I ca…

I do a similar thing with google apps and aliases for my main address. that looks like it's nicer to manage.

Re: Browsing your website does not mean I want your spam

#40

Post by Bartweiss » Mon, Aug 22, 2016, 7:50 PM UTC

techsupporter wrote: post #30

Bartweiss wrote: post #26

Earlier quoted context omitted.

Even for Gmail users, the + notation will handle this well. foobar@gmail.com and foobar+SearsSoldMyEmail@gmail.com will both direct to the same location, and relatively few resellers have the sense to strip the extra data.

The problem with the + notation is twofold: First, not all places accept the + character; second, you've now revealed your actual e-mail address (since foobar@gmail.com is just as valid as foobar+dontspamme@gmail.com). I use a subdomain with catch-all, like me.example.com. Everybody is fine with subdomains and then I can use companyname@me.example.com. Using that format doesn't expose my actual e-mail address and mak…

This is a good point.

For me, the actual email problem isn't huge - my first line of defense is giving out a burner email unless I want the primary site to be able to contact me. So I don't expect to get truly hammered with spam, and just want a way to know what happened if someone does sell the address.

The invalidation issue is a bigger one, and a subdomain is certainly a better solution for it. Disposable emails and the + notation are nice for people who either don't want to leave gmail, or are bound to it via college or company email system. They aren't the best cure, though.