News for hackers. Stuff that matters.
Re:Gmail, Yahoo announce new 2024 authentication requirement... by kijin on Tuesday October 31, 2023 @12:32AM (#38080343)
Not everyone uses Gmail or a modern email client that understands the one-click List-Unsubscribe protocol, so senders must include an HTML unsubscribe link in the body of the email in order to comply with relevant rules in all jurisdictions. That link, unfortunately, can fall prey to the shenanigans I mentioned above.

I understand the parent's sentiment because we all want to unsubscribe from unwanted emails. But technical standards can't distinguish unwanted emails from business-critical emails. You could legitimately cause someone damages by silently unsubscribing them from an important news feed. (Imagine that you silently unsubscribed an open-source maintainer from all github notifications!) Even worse, this kind of vulnerability disproportionately affects senders who try to follow the rules and make it easier for people to unsubscribe. Spammers don't care and keep spammin'.

Ideally, an email would have both a one-click List-Unsubscribe header and an HTML unsubscribe link in the body. The latter need not be one-click, and in fact, if it's anything remotely important, should not be.

Re:Gmail, Yahoo announce new 2024 authentication requirement... by cuu508 on Tuesday October 31, 2023 @01:24AM (#38080660)
> Imagine that you silently unsubscribed an open-source maintainer from all github notifications!)

Do open-source maintainers forward around their unsubscribe links in practice?

The other problem with email scanners clicking links automatically can be solved without prompting for the email address. One simple solution is: if the link is clicked within a minute or so after sending the email there's a chance the clicker is an automated system. Instead of unsubscribing right away, serve a HTTP POST form with a single "Confirm Unsubscribe" button. Normal users will rarely see the form, automated systems will hesitate to fire off HTTP POST requests.

Re:Gmail, Yahoo announce new 2024 authentication requirement... by account42 on Tuesday October 31, 2023 @05:34AM (#38082215)
> The latter need not be one-click, and in fact, if it's anything remotely important, should not be.

It absolutely should be one-click.

Re:Gmail, Yahoo announce new 2024 authentication requirement... by kijin on Tuesday October 31, 2023 @11:41PM (#38094375)
Since when are GET requests with side effects a good thing?