News for hackers. Stuff that matters.
Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by inetknght on Wednesday October 16, 2024 @01:49PM (#41861762)
> I immediately mark them as "spam".

Ahh yes, the feel-good response that Google gives you without doing anything substantial to prevent spam from reaching you in the future.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by maccard on Wednesday October 16, 2024 @02:13PM (#41861986)
My experience with the spam button is 1) they never ever go into my inbox again if they do keep sending, and 2) as someone who has had emails marked as spam (from people who actively clicked the sign up to my newsletter button) your ability to send email gets neutered pretty quickly.

What is your experience?

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by compootr on Wednesday October 16, 2024 @03:18PM (#41862765)
I use my own domain so I can return mails as bounced, which mail providers don't like, since it may indicate attempting to send unsolicited mail to loads of addresses.

it's not me, it's you. Screw you if you send me mail I don't want!

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by inetknght on Wednesday October 16, 2024 @02:33PM (#41862212)
> What is your experience?

Reporting spam does not block the email from being received by my client -- it only blocks the mail from being seen in the inbox, but it still shows up in the spam box.

I don't send mail that gets reported as spam in the first place. Or, if it does, then I haven't been meaningfully affected because I can still send and receive the email I want to.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by maccard on Wednesday October 16, 2024 @02:59PM (#41862562)
I’m not sure what you expect to happen?

> I don't send mail that gets reported as spam in the first place.

I ran a newsletter where people had to opt in to receiving it. It was announce news for a video game. You only ended up on this list if you entered your email, clicked join list, and then clicked the link in the email we sent to you to confirm subscription. We had a big unsubscribe button at the very top of the email. We still regularly got people who hit report spam on us, presumably as a way of saying g they didn’t want the email anymore.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by jacobgkau on Wednesday October 16, 2024 @05:30PM (#41864038)
> I’m not sure what you expect to happen?

They're probably expecting their email provider to take that info and use it somewhere upstream of their own individual account. Which, as you've pointed out, does happen.

Maybe they don't believe that it happens often enough or something, but the thresholds do need to be reasonably high since, as you pointed out, some people hit the button whether it's justified or not. If the threshold for email provider action was too low, you'd end up not being able to send to anyone with Gmail because one guy forgot he signed up to a list (or signed up and immediately reported it as spam to spite the sender).

The person you replied to also sounds like they may be using an offline or third-party email client, though. There's a difference between a "Report Spam" button somewhere your email provider controls, and a "Mark as Spam" button in your third-party email client. I'd assume there's some kind of protocol that could potentially allow third-party clients to report it back to the email provider, but would also assume it may not be as reliable as first-party interfaces.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by inetknght on Wednesday October 16, 2024 @10:21PM (#41865835)
> They're probably expecting their email provider to take that info and use it somewhere upstream of their own individual account.

Report spam, as a generic feature? It's an okay starting point "as-is" but useless for preventing malicious use and it hasn't meaningfully improved since launch.

Specifically for google: allow users to block whole domains; I can already do that on my own mailserver, why can't I do that on Google's? Then, block mail from foreign countries -- or at least countries that I don't care about; I can block whole ASNs on my mailserver, why can't I on Google's? That then leaves only mail that I can bring legal action to.

Another iteration: when you "unsubscribe", then keep a record of it, and also show the history of emails that you've received from them on a confirmation dialog. Show me anything interesting like purchases, warranties, appointments, etc. When confirmed, keep a record of it. Show me a list of _all_ of the things I've unsubscribed from. If email is still received, automatic report spam and block the domain. Oh, that means that mailing lists must come from the same domain that sales are made on.

Another iteration: a subscription should require a confirmation. Let the email server recognize the confirmation, and block emails whose unsubscribe links aren't in the list of confirmations. That means an unsubscription link should go to the same domain that a subscription was confirmed on.

That's just a few spitballed ideas. Spam reporting functionality is clearly iterable, but it hasn't meaningfully changed for decades. It's still primarily done through opaque "reputation" scores and little else.

I don't want "report spam" which doesn't give me feedback and continues to let spam onto the wire to my client, and isn't powerful enough to use to block bad actors from trivially getting to my inbox. I don't want to be expected to (and trained to) click on unverified links which take me to somewhere I don't recognize, and could take me somewhere malicious. I expect more from the largest email provider(s) in the world.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by aspenmayer on Tuesday October 22, 2024 @04:21PM (#41918282)
> Specifically for google: allow users to block whole domains; I can already do that on my own mailserver, why can't I do that on Google's?

You can do this with filter rules on Gmail:

https://support.google.com/mail/answer/6579?hl=en

This list of Gmail search operators may be helpful in crafting your filter rulesets:

https://support.google.com/mail/answer/7190?sjid=11169181429...

You can either search first, then create a filter, or create the filter and then set your specific search terms/scope. The only downside of filters is that they only apply to incoming mail; you can't apply them to already existing mails, but you can use the same search terms as a kind of mask, then use the select all checkbox, then click the link to select all mail that matches the search instead of just selecting all mail on current page/view.

Hopefully that helps.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by everforward on Thursday October 17, 2024 @07:06AM (#41868413)
I’m not accusing you of this, but I will mark things as spam even if I signed myself up if what they’re delivering is just garbage.

It’s usually not newsletters for me, but small niche companies who sell very specific things and feel a weird urge to have a weekly newsletter. It’s like all they sell is 2 models of guitar capo, but they still feel the need to send me weekly updates on I don’t even know what.

The kind of things where I not only don’t want the emails, but I want to register that I feel I was misled when I signed up.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by mcmcmc on Wednesday October 16, 2024 @09:54PM (#41865714)
If you actually want to block emails, you need an email security gateway or some control over inbound anti-spam policies (ie pay for Google Workspace or another email service). Consumer email is not intended to give you full control.
Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by EVa5I7bHFq9mnYK on Thursday October 17, 2024 @01:21AM (#41866652)
And we all know that Inbox and Spam are one and the same these days - if you are expecting an email, you must check both.
Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by kemitche on Wednesday October 16, 2024 @02:03PM (#41861876)
What makes you say that? In my experience, the spam button works fantastically. There is a gym of some kind that has me on their mailing list, refuses to honor unsubscribe, and sends me probably 2-6 emails a month. They've been doing this for years, but Google correctly gets every single one into spam because I marked one (several?) as spam years ago.

Most, if not all, political junk email also ends up in my spam folder after judicious use of the spam button a few years ago.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by inetknght on Wednesday October 16, 2024 @02:38PM (#41862282)
> They've been doing this for years, but Google correctly gets every single one into spam because I marked one (several?) as spam years ago.

I've had numerous "businesses" that I've reported spam end up back in my gmail inbox after years.

I've stopped using gmail because of it not iterating on spam blocking capabilities.

Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by armada651 on Wednesday October 16, 2024 @02:01PM (#41861863)
If you were using self-hosted e-mail everywhere, then it would be quite obvious that large providers like Google do massively benefit from those user reports when filtering spam.
Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by 1shooner on Wednesday October 16, 2024 @06:16PM (#41864388)
User-reported spam in gmail is actually very efficacious. Aside from the logic gmail applies to your inbox specifically, Google's current violation threshold for those reports is .03%. Beyond that, those reports start to pull down sender IP and domain reputation, which impacts overall deliverablity to anyone's gmail inbox.
Re:FTC Announces "Click-to-Cancel" Rule Making It Easier to ... by MiddleEndian on Thursday October 17, 2024 @11:52AM (#41870816)
This is why I am quick to report spam, even if they are a "legitimate" business. Utility company / paypal / whoever wants to send me spam? I sincerely hope they are impeded from sending email to anybody.