Live data from Hacker News

Major European payment processor can't send email to Google Workspace users

atha.io

361–370 of 443 posts

Re: Major European payment processor can't send email to Google Workspace users

#361
post #149

> Viva.com's outgoing verification emails lack a Message-ID header, a requirement that has been part of the Internet Message Format specification (RFC 5322) since 2008 > ... > `Message-ID` is one of the most basic required headers in email. Section 3.6. of the RFC in question ( https://www.rfc-editor.org/rfc/rfc5322.html ) says: +----------------+--------+------------+----------------------------+ | Field | Min | Max…

My take, as a postmaster for hosting company, who don't have any sympathy to gmail (that should be visible from my comments history): Message-ID is absolutely MUST in production e-mails. You can send your test stuff without it, but real messages always have it. Not having Message-ID's causes lot of fun things. All somewhat competent software is capable to add Message-ID's, so lack of it is good indication of poorly m…

Your casual use of the word MUST is not the same as a standard document's use of the word MUST. Your real world experience is entirely irrelevant to the conversation about what the standard requires.

Re: Major European payment processor can't send email to Google Workspace users

#362

Earlier quoted context omitted.

Exactly. Message-ID is not required. An unrelated frustration of mine is that Message-ID really should not be overridden but SES for instance throws away your Message-ID and replaces it with another one :(

It is de-facto required and has been for many years. Should in most RFCs also mean "do it as long as you don't have a very good technical reason not to do it". Like it's most times a "weak must". And in that case the only reason it isn't must is for backward compatibility with older mail system not used for sending automated mails. And it is documented if you read any larger mail providers docs about "what to do that…

What's de-facto required and not is completely irrelevant here. The claim was that "Message-ID header [is a] a requirement that has been part of the Internet Message Format specification ... since 2008" (emphasis mine), which is false; it's a recommendation that has been part of the Internet Message Format specification since 2008

Re: Major European payment processor can't send email to Google Workspace users

#363

Earlier quoted context omitted.

This very clearly says that SHOULD is not effectively REQUIRED at all, and is fact nothing more than RECOMMENDED. Really not sure how you misinterpreted this so badly

It's not required but they need to understand the implications. In this case the implication is that Google drops the mail. So clearly they didn't understand the implications.

Yes, but this might be googles fault for not respecting/missinterpretating the spec.

Re: Major European payment processor can't send email to Google Workspace users

#364
post #337

Earlier quoted context omitted.

I think that's actually an interesting feature of society as a macro system. It is very fault tolerant, which is frustrating for any power user but without which the system as a whole would not function at all.

Or without which the system would function much better because all poorly functioning systems would fail, forcing designers to focus on fixing the faults

I think of it as a plane that cannot land. Allow it to fail in flight and you won't have a plane to fix or designers to fix it.

Re: Major European payment processor can't send email to Google Workspace users

#365
post #210

Earlier quoted context omitted.

> How is not having a message-id a security risk? CVE classify a lot of things that have nothing to do with security. Not having a Message-ID can cause problems for loop-detection (especially on busy netnews and mailing lists), and with reliable delivery status notification. Dealing with these things for clients who can't read the RFC wastes memory and time which can potentially deny legitimate users access to servic…

Well, gmail does not manage usenet groups and mailing lists. Delivery status notifications are considered best effort so it wouldn't make sense to block messages for that case. Additionally, Gmail adds its own message identifier on every message (g-msgid) because it knows that message ids can not be trusted to be unique. Finally just calling me ignorant is the cherry on top – please try to keep things civil on here.

> Well, [google] does not manage usenet groups and mailing lists.

They do. Sort of.

Google used to nntp, and manages the largest usenet archive; They still have one of the largest mailing list servers in the world, and they still perform distribution on those lists via SMTP email.

They still have all of the problems associated with it, as do lots of other mail/news/list sites still do that are a fraction of Google's size.

> Delivery status notifications are considered best effort so it wouldn't make sense to block messages for that case.

Sure it does.

You consider them best-effort, but that doesn't follow that I should consider them best-effort. For a simple example: Consider spam.

In any event, if you keep sending me the same message without any evidence you can handle them, I'm not going to accept your messages either, because I don't know what else you aren't doing. That's part of the subtext of "SHOULD".

Most big sites take this policy because it is internal nodes that will generate the delivery notification, but the edge nodes that are tasked with preventing loops. If the edge node adds a Message-ID based on the content, it'll waste CPU and possibly deny service; If the edge node naively adds a Message-ID like an MSA, the origin won't recognise it, and forwarded messages can loop or (if sent to a mailing list) be amplified. There also are other specific documented requirements related to Internet Mail that edge nodes not do this (e.g. RFC2821 § 6.3).

However you seem to be assuming Google is blocking messages "for this case" which is a little presumptuous. Google is presumably trying to save themselves a headache of handling errors for people who aren't prepared to do anything about it, the most common of which is spam. And the use of Message-ID in this application is documented at least as early as RFC2635.

> Additionally, Gmail adds its own message identifier on every message (g-msgid) because it knows that message ids can not be trusted to be unique.

Without knowing what Google does with the g-msgid header, you are making a mistake to assume it is equivalent to the Message-ID header just because it has a similar name. You have no reason to believe this is true.

> Finally just calling me ignorant is the cherry on top – please try to keep things civil on here.

I am sorry you are offended to not know things, but you do not know this thing, and your characterising my actions will make it very difficult for you to learn something new and not be so ignorant in the future.

Think hard exactly about what you want to happen here: Do you want Google (et al) to do something different? Do you want me to agree Google should? Who exactly are you trying to convince of what, and to what end?

I am trying to tell you how to interpret the documentation of the Internet, in this case to be successful sending email. That's it.

I am not likely to try and tell Google what to do in this case because of my own experiences running mail servers over the last 30 years, but listen: I am willing to be convinced. That's all I can do.

If it's something else, I'm sorry I just don't understand.

Re: Major European payment processor can't send email to Google Workspace users

#366

With fintech that surprises me not the slightest bit. Financial institutions are filled to the brim with unbelievably incompetent people. A large part of it is probably willful ignorance, too. It's often truly staggering that a financial company I interact with in day to day live is even able to exist. That's until I remember that all the others are just as incompetent. "Major European Payment Processor" really just…

I mean, since 2008 finance has been officially privatised profits, socialised losses. It's inevitable that an industry people are forced to use and cannot fail becomes this way.

Re: Major European payment processor can't send email to Google Workspace users

#367

Huh I've lived in Europe for most of my life and I've never heard of viva except as a poor name choice for Microsoft's corporate Facebook (yammer) Most companies here use stripe on their website.

Yeah, they're defining 'major' fairly generously, here, I think. Difficult to find figures, but seems to be transaction volumes of tens of billions a year. So not actually particularly big.

Re: Major European payment processor can't send email to Google Workspace users

#368

With fintech that surprises me not the slightest bit. Financial institutions are filled to the brim with unbelievably incompetent people. A large part of it is probably willful ignorance, too. It's often truly staggering that a financial company I interact with in day to day live is even able to exist. That's until I remember that all the others are just as incompetent. "Major European Payment Processor" really just…

There is plenty amount of incompetence in FAAMG. Notepad .... Do Europe financial institutions have the same level of corruption as the USA? Such as a credit card company authorizing credit card transactions with incorrect expiration date to maximum profit, Bank of America? Or opening new accounts without consumer consent, Wells Fargo?

> Do Europe financial institutions have the same level of corruption as the USA?

lol... how much time do you have? Here's just one to start with off the top of my head: https://en.wikipedia.org/wiki/HSBC#Controversies

Re: Major European payment processor can't send email to Google Workspace users

#369
post #270

Earlier quoted context omitted.

[flagged]

You are confused about what I'm doing. I'm not telling anyone what to do. I'm saying what category their actions fall into. And the line of yours I quoted is still not supported by anything.

> You are confused about what I'm doing.

Absolutely.

And if you're not confused by what I said, that's not obvious in the slightest.

> I'm not telling anyone what to do.

So you say.

> I'm saying what category their actions fall into.

I think that's pretty weird that you think you get to decide that all by yourself.

But I'm not playing, because you're right: I don't know why you would be doing that.

> And the line of yours I quoted is still not supported by anything.

Yes it is. It's a description of the behaviour of other Internet hosts, and it's a description of exactly what is happening in the linked article.

Re: Major European payment processor can't send email to Google Workspace users

#370

Earlier quoted context omitted.

[flagged]

> You don't have the right to complain to random websites without punishment. And nobody punished you. And "ability to redress" is something you still have. And there are no damages. Well, you see Dang aka Daniel edited the settings on my account to stop me replying, or that's what I've heard, and pointing out the absolute lie that the blog post is. And that did hamper my ability to redress and people have been lying…

I thought the problem was inability to edit, now it's inability to reply? Also you're wrong about the post and you don't know what damages are and your flex failed real bad. Good luck in life.

And nobody ever has to let you post on their private website. Right to redress is unrelated. If you take away anything from this conversation, please let it be that.

Post reply on HN