Get the top HN stories in your inbox every day.
toxik
techsupporter
> However, basically every mail platform creates tailored links to track click engagement.
Yep, even financial institutions do this and half of them don’t even use domains they own for the tracking links.
Years and years of “don’t click on suspicious links” out the window because bank.example.com/creditcard is turned into 4828fjfneo848.totallyfine.adtracker.thirdparty.example.org
I hate all of it but nobody seems to give a shit (nor do they care to implement proper 2FA to effectively guard against phishing) so whatever. If people have their accounts drained because marketers gotta get that sweet engagement metric, what does it matter any more?
geoduck14
My work touts the "look at links before you click!". But they also auto forward all email links to a service that scans the link for malicious stuff. The result is that when I hover over a link, I get a REALLY long url, like: https://urldefense.company.com?link=blablablablablahlablabla......
And I can't actually read it.
nofunsir
My work actually visits the url ahead of time.
This sucks when the link is a one-time-use only code.
lttlrck
A pet peeve is unsubscribe links are frequently on an obscure domain that has found it's way onto Adblock lists.
That's got be by design.
nkrisc
If I can't unsubscribe with a single click then it's spam and I report it as spam. They don't give a shit about me, so I don't give a shit about them.
eloisius
It's easy: I set a rule in Mail that flags every email containing "Unsubscribe" or related terms with a red flag, and I review and mark them as junk when they show up. Every newsletter is spam because I would never ever sign up for one, regardless of whether I do business with the sender. Either they are illegally mailing me spam from some list that they purchased, or they hid their "please don't send me bullshit" opt out when I signed up for their services, because I would never ask to receive marketing or product updates. It's all spam.
wlesieutre
If something makes itself difficult to unsubscribe you could always feed it to the spam filter
3np
And more and more often, unsubscribe links go 403 or even 500 when on Tor or well-known VPNs, while the rest of the site works fine on it. A great way to make me never want to deal with you again is to coerce me to doxx myself to unsubscribe from your newsletter.
ssharp
It's not uncommon for the unsubscribe links to live on the same domain as the link tracking and other features of whatever email or marketing automation platform they are on, so if those are blocked to prevent tracking, the unsubscribe links would be as well.
kergonath
> I hate all of it but nobody seems to give a shit
I hope this will change. More companies need to make some noise about it.
deergomoo
> Years and years of “don’t click on suspicious links” out the window because bank.example.com/creditcard is turned into 4828fjfneo848.totallyfine.adtracker.thirdparty.example.org
I got an email from my bank (Barclays) a couple of months ago that literally took me several minutes to determine whether or not it was a phishing email.
It wasn't, but it used badly compressed jpegs for the Barclays logo and the call-to-action button, the link attached to the button had no verifiable connection to Barclays, and for some reason it used backticks instead of apostrophes in the copy.
When I finally did click the link I was half expecting to be taken to a page saying "you moron, this is obviously a scam" in 96pt font.
dwighttk
I spend about 10 seconds at most thinking about if my bank sent me a spammy looking email and then separately go to the bank site and look for whatever they were supposedly talking about.
Rule of thumb: never click on the link.
devoutsalsa
I just don’t click on those links, except on accident because some jackass made it impossible to copy/pasta the URL on my mobile device because I couldn’t see what the URL was in a preview window.
0-_-0
Could Apple preload those links too the way they want to preload the tracking pixels? (I don't know much about web tech)
hsbauauvhabzb
MFA won’t protect against phishing.
techsupporter
The MFA we commonly use right now won't protect against phishing because, as I suspect you mean, the codes are not protected against being entered into the "wrong" site.
Proper MFA, like U2F/FIDO2/whatever-it-is-called-today, will protect against phishing because the visited site won't match the hash needed to complete the second-factor-auth-flow.
gleenn
Yes it does, maybe not directly. Two examples, both 1Password and my Yubikey only autofill passwords based on the domain. I immediately get a tingle when I go to autocomplete a commonly visited website and it doesn't fill ... time to immediately inspect the URL for phishing etc. Those tools have definitely saved me multiple times.
nickfromseattle
Delivery rates, AKA staying out of spam and getting into the inbox are correlated to subscriber engagement on your emails.
The more often subscribers open + click a link, the more likely the mail server will let it in the inbox.
If you blast 10,000 emails, and noone clicks or engages with your email - you'll kill your domain's delivery rate.
One of the methods email marketers use to keep their email delivery rates high is by removing subscribers that don't engage with their email.
Preventing email tracking prevents marketers from removing uninterested or unengaged subscribers from their lists.
hermanradtke
> One of the methods email marketers use to keep their email delivery rates high is by removing subscribers that don't engage with their email.
Email marketers can still track when a user clicks a link, which is the proper signal for them to be using anyways.
snowwrestler
You get what you measure, so relying solely on clicks to measure interest is going to drive email products toward more clickbait designs and content—reversing a nice trend over the last few years to put most/all of the content into the email itself.
undefined
bjustin
Clicking links doesn't sound like the sort of thing that email servers would know about one way or the other. Likewise for engaging (or not) with emails at all. What setup do you have in mind where this is the case?
Given that AFAIK Apple Mail downloads entire messages regardless of whether they're opened, Apple's change here doesn't seem likely to affect delivery rates in this way anyway.
Nullabillity
> Likewise for engaging (or not) with emails at all. What setup do you have in mind where this is the case?
If you use IMAP (or basically anything else than POP) then your email client reports the read status back to the server.
zzo38computer
I think that it would be better using NNTP and plain text, and then these problems are avoided anyways. Then the sender need not keep track of these things or to worry about the things that you mentioned, I think. Also can be good to include the text in the message if you can do and not usually needing a link, you can then access it even if you are not connected to the internet, too.
(I use email software that is not even capable of HTML email, and I don't want HTML email.)
beagle3
Outlook killed NNTP 20 years ago by virtue of not supporting it (every other mail client at the time did).
it also suffered as a discussion medium because of the decentralized unauthenticated measure, for sure - I don’t think the global hierarchy would have done much better than it did.
But two companies I was consulting for around 2000 had very effective NNTP internal servers, and both switched them off around the same time because Outlook didn’t support them (Outlook Express did, but that’s not helpful)
One just went the “reply all” route. One used a mailing list (majordomo, iirc). Neither worked remotely as well as NNTP did.
chinathrow
Can you elaborate a bit how your mailbox provider knows about click/engangement rate?
E.g. why would Fastmail have any metrics on how their users interact with the mail they receive?
I see everybody calling out that one should keep a clean subscriber list (e.g. only keep engaged users) but I fail to see this is relevant to the actual mail acceptance/inbox delivery.
toxik
This could be done without duping the receiver’s email client into revealing that the email has been viewed.
kevincox
Yeah, this is really annoying because I keep getting silently dropped off of mailing lists because "I don't engage".
croon
Is this annoying? Do you still want it if there's nothing in it you want to engage with?
Or are you saying you want to read it, but take no related actions on it?
I would absolutely love to be automatically unsubscribed from everything I don't engage with.
I get tons of kinda-sorta-legit marketing emails due to a very old generic gmail address, and people being bad (or lazy) at entering addresses everywhere.
(Also tons of actual email meant for other people, but that's another story)
jonplackett
Why can't apple just allow some kind of pixel that doesn't reveal user identity, or strip user identity from what's already being used.
I don't really mind someone knowing I opened an email, just like I'm fine with a website knowing I visited (say using plausible.io rather than google analytics). I get that that's useful to them for non-nefarious reasons.
3np
"Read receipts" are already part of e-mail and supported by every email client I am aware of. There is already a well-supported way to track whether e-mail has been successfully opened or not without using subversive tracking pixels.
The reason businesses don't rely on them is supposedly because "too many users disabled or rejected them during the past decade".
rhizome
I feel like there is a body of literature waiting to be written about businesses refusing to take a hint in favor of user-hostile decisions. These things are conscious choices by the senders and they had several meetings about it.
dsr_
The two best mail clients, mutt and whatever people like that runs as part of emacs now, don't have read receipts at all.
Even MS Outlook lets end users decline to send read receipts. There's probably some awful group policy system to force it, though.
gnicholas
Apple can't strip identity from the existing trackers because there's not a separate and distinct part of the tracker that encodes the user identity. It's integral to the tracker itself, which makes this an all-or-nothing proposition.
jonplackett
I guessed it would just be some url variables on the end of each image, is that not how it works?
gwd
> I don’t load remote images by default, so this already doesn’t work for me. However, basically every mail platform creates tailored links to track click engagement. So you’re screwed anyway, just maybe a little later.
Right, but I don't mind if companies I'm actually doing business with track my engagement. For newsletters I've actually signed up for, clicking the "load remote images" and/or on personalized links helps them with their business model, so why not? If I don't trust them with the data, I probably wouldn't sign up for their list anyway.
I'm more worried about randomly being tracked by who knows what person or organization. With the "don't load remote content by default", I have control over when and how I get measured.
pabs3
I noticed that WikiPedia does something that would work for you; if you don't login and click the link in the email, they stop delivering wiki page change notifications.
Grustaf
It’s a lot less creepy to track active engagement like opening a link though. And probably more obvious to people that it might happen.
asdff
There are browser extensions that clean these links
esotericimpl
This seems pretty easy to mitigate. Instead of tracking opens with the pixel, make the first image loaded in the email the “tracking image” voila you now can create a unique link to track for each email.
Hoasi
Mail privacy is the right thing to do and implement it will be a major improvement!
That doesn’t threaten email newsletters that are legitimate and of interest to real subscribers. Communication should never rely on espionage tactics even for the sake of metrics. Forgo monitoring people, customers, or would-be customers, and save a ton of time as a result.
Marketing experts will start talking about how two ways conversation is the ultimate email strategy that works. Send a non-tracked email, let them hit reply. Brands and consumers, united in conversation, finally. That is as horizontal as it gets.
graeme
Have you ever managed a newsletter? Mail providers such as gmail use things like open rates to determine if a message should be in important, promotions, or spam.
Also, a sizeable chunk of people refuse to click unsubscribe links and instead hit the spam button. This can be a sensible response, as a lot of spam senders ignore unsubscribe. But it is also hard for legit newsletters.
So what is the best practice? Pruning your list of people who never open it. This improves open rates, makes gmail like you, and unsubscribes people who already would prefer not to read your letter.
Now it will be much harder to know who is inactive so you’ll end up sending more mail to people who don’t want it. And no double opt in doesn’t solve this.
There are other ways around the problem, but you seem to be in complete ignorance of what newsletter senders use tracking for.
Open rates also let you diagnose deliverability issues.
schmorptron
To be honest, these days I'll click the unsubscribe link in newsletters and stuff, but if they expect me to click on another small link on a website or even enter my email again I just go back and report it as spam. Spoken to some friends who do the same, and I feel that this is the only reasonable approach to take with this.
snowwrestler
This is why a legit newsletter might have a confirm step:
https://news.ycombinator.com/item?id=27469535
I’ve had to deal with customers angry they did not get emails they wanted, and we tracked it back to a security service at their employer that auto-clicks all email links to check them. We had to add a confirm step to unsubscribe to keep it from happening. We’re B2B and I suspect it’s a much bigger issue than B2C because so many companies run custom email setups.
jeromegv
Which isn’t related to what you are replying to. We are talking of legit newsletter that offer 1 click unsubscribe.
eikenberry
Did those people who hit the spam button subscribe to the newsletter or were they subscribed without their consent? Seems odd that people would go to the trouble of subscribing to a newsletter only to send it to the spam folder. On the other hand if they didn't (go through the trouble of subscribing), then it is spam.
graeme
Generally yeah some people will just hit spam as unsubscribe even to something they signed up for. A lot of people have email overwhelm. You gotta figure that a fraction of people on any service behave oddly.
I’ve even done it myself on occasion when I’m pretty sure I HAVE unsubscribed but I keep getting mail (from things I likely signed up for)
snowwrestler
> Seems odd that people would go to the trouble of subscribing to a newsletter only to send it to the spam folder.
It happens. You have people in this thread explaining they hit the spam button when unsubscribe has a confirm step, even if they know they signed up.
There has also been long-standing advice not to hit unsubscribe on spam because all it does is confirm you’re there. A surprising number of people think that means never hit unsubscribe links at all, even in things you signed up for.
megablast
How would he know? How would anyone know??
things
I've seen people enter their email into those intrusive "sign up for our newsletter" popovers because they think that's the only way to bypass them. Which is probably one reason why sites keep using them. Not everyone is as web savvy as we like to think.
nkrisc
I report every newsletter and similar as spam because I have never knowingly or wittingly signed up for one. If I receive one, I was tricked into signing up for it (or never did), thus: spam.
BeFlatXIII
workflow may be something like 1. Free music 2. required signup for band newsletter 3. Why am I receiving this newsletter? 4. Mark as spam
donkeyd
I don't think these changes at Apple will ruin your use case at all. From what I've read, will load images privately, which means it'll probably hide IP (as they've mentioned) and details about browser etc. It'll still need to load the image. If you were to create a specific image for every sent email, you can still see whether that image was accessed by Apple. Unless they create something like a CDN to cache every image people receive, even if they don't open the email, you'll still be able to see whether an email was opened. You just won't be able to see from where, or from which browser, which seems unnecessary in your use case.
To me this seems like the only actual negative impact could be on LE, who sometimes use this technology to find missing persons.
Edit: I was wrong, upon further reading they do get the images for every email, even ones that weren't opened. Seems wasteful (the majority of my email never gets opened), but it's a great implementation. Guess it's time to give Apple Mail another try.
_jal
I do understand it is tough out there for a newsletter.
The problem is, the same tactics that they want to use, that I might put up with for a slightly-trusted sender, are used by spammers for mostly the same reasons.
And I am not willing to put up with the repercussions of that for the benefit of some newsletter operators who are not me.
So there's the problem to be solved.
charrondev
I’ve seen how fungible email lists can be for marketing departments.
I’ve seen cases of “I very carefully opted out of your dark pattern, and then your automatically opted in my account after the fact”.
Unfortunately a lot of companies that will take your email for verification/password resets don’t keep that list away from their marketing department.
pembrook
True, but that has nothing to do with the comment you responded to. Regardless of whether tracking pixels are blocked or not, scummy marketers are still going to do that.
The question is, will it hurt the indie newsletter guys and gals, the people sending stuff you actually want? Certainly yes. They won't know if they're still giving their audience something of value.
The bigger problem, in my mind, is the unintended consequences of this. Will blocking tracking pixels actually cause those scummy marketers to send even more emails? My guess is, absolutely yes.
Post-tracking, nobody can prove the marketing department emails are ineffective or hurting deliverability by oversending, so let's blanket inboxes with as many as we can!
sssilver
The best practice is supposed to be RSS (or something in that paradigm).
foxpurple
The problem with RSS is you can’t force sign up people without them realising.
Almost all newsletters are spam and should be treated as such.
vincentmarle
Based on this, I predict that newsletters will start forcing you to click a link to read the entire newsletter.
randomperson_24
That is what will happen. Send an excerpt and to view the full post click on the link, which will be tracked along with the website which serves content filled with javascript trackers and cookies :(
layoutIfNeeded
Simple: send a letter every month with a link that says “Click here if you still want to receive this newsletter”. Then remove everyone from the list who hadn’t clicked it after a week.
jeromegv
Sure, and that’s not spammy at all
undefined
seumars
Every privacy-focused push by Apple – or anyone, really – forces publishers to find less invasive methods for engaging with their audience, without having to rely on skewed data and grotesque tracking. How could that be bad for journalism? We got rid of blinking text and popup ads for a reason, and this is just the next step.
Barrin92
because one possible consequence of this is that it forces people to move towards closed platforms like Apple's own if they want to effectively advertise and that includes forking over substantial amount of money to those platforms.
Which is of course the economic incentive that a company like Apple has to introduce these measures, it creates an asymmetry where Apple has all kinds of user information, but competitors don't.
And if you want to see the effect that declining ad revenue has on journalism you can just look at the decline of local journalism across the US as revenue shifted from advertisers to digital platforms.
tshaddox
> Which is of course the economic incentive that a company like Apple has to introduce these measures, it creates an asymmetry where Apple has all kinds of user information, but competitors don't.
It's completely fair to speculate that this is Apple's true goal, but I actually do feel a little bit better about Apple doing this than, say, Facebook, or Google. The reason I feel a little bit better is that Apple at least still has an actual business model where people give them money in exchange for a product. I'm willing to be charitable and speculate that at least some of the reason Apple releases services like this is that it will cause people to continue to buy iPhones (which are wildly profitable).
grishka
Apple doesn't offer an alternative even if you want to pay them. It's simply saying "you can no longer do this to our users, it's now illegal".
bjustin
In this case and things like ATT, Apple is saying "you can no longer do this to our users unless they agree to it first". And they default to asking users. That users are the ones making these choices is an important point.
daemoon
You know you can opt in and out of these features right? The whole point is to let the users pick themselves...
JimBlackwood
These features Apple introduce sell well because people (including me) want them.
If that means journalists lose revenue, they should look for other ways. Using intrusive ads as an excuse for “otherwise we don’t have money” is just dumb. They’re free to think of other ways.
The best journalism I’ve read (ftm.nl, dutch) is a subscription service and they don’t rely on ads or tracking. The sites that do this kind of tracking, in my anecdotal experience, produce shitty journalism.
If this is bad for journalism, we’ll end up in that crisis and figure out a way that doesn’t use these methods.
smoldesu
> These features Apple introduce sell well because people (including me) want them.
You want the service, you don't necessarily need it from Apple though. That's the crux of this entire argument: Apple's black-box model is terrible for the industry. Apple is opposed to any roads that don't run through taxable lands, so it should come as no surprise that they want to tear down everything that keeps the web currently working. The less functional the internet becomes, the higher pressure there is to use native apps: that's likely part of why Safari is woefully broken and outdated compared to Chrome and Firefox.
> If this is bad for journalism, we’ll end up in that crisis and figure out a way that doesn’t use these methods.
We are already in that crisis. Whenever a paywalled link crops up on Hacker News, the first comment is always an archived version for the 99% of readers who would otherwise be unable to read that. Compared to the past 15 years of reporting, that's a direct downgrade. Adding synthetic friction to the flow of information never works: games get cracked, movies get shared, shows get ripped and music gets leaked. It's nothing new, and pretending like it's somehow not going to affect the next decade of reporting seems a little disingenuous to me.
na85
Where along the way did society come to implicitly accept the (completely false) dichotomy that the only two possible options are "ads" or "shitty journalism"?
randomperson_24
Also, don't forget the 30% cut they will take for premium newsletters.
kergonath
> it creates an asymmetry where Apple has all kinds of user information, but competitors don't
That is true only if Apple competes with them, which is not the case at all.
Barrin92
But they do? Apple is literally in the news business, the services business (many of which rely on ad revenue to compete with Apple's own services), increasingly in the ad business itself (revenue is expected to rise to 11 billion in 2025, growing quickly)[1], and as I just laid out in the post above, has a huge interest in just laying waste to independent revenue streams outside of their own channels, in the exact same way digital platforms overall benefited from laying waste to the small and mid-sized ad-industry.
rickdeckard
This asymmetry is already very real, and a quite dominant pattern of Apple's strategy is now to build mechanisms to protect explicitly their ability to monetize all aspects of their _users_, not so much their devices.
These small steps taken under the banner of "preserving the users' privacy" are also steps to make sure that all those clumsy users don't get offered something without giving Apple the opportunity to profit from it first.
And the only disarming response to this so far is "yeah, but that's fine for me. I WANT Apple to take control, they're the good guys with the cool products!"
nickfromseattle
It's believed Apple generates ~$2B per year from advertising revenue (through Appstore PPC) and that could increase to over $10B in 2025. [0]
rodgerd
> “This is another sign that Apple’s war against targeted advertising isn’t just about screwing Facebook,” Joshua Benton wrote in Nieman Lab. “They’re also coming for your Substack.”
I mean good? Like you, I struggle to see the downside of this, really. Probably the only risk in the bigger picture is the degree to which wealthy billionaires fund free lies such as Brietbart or the Murdoch papaers, while actual research and journalism is pay-for. But the wealthy billionaires are doing that anyway, so it's hard to see much change.
jldugger
> How could that be bad for journalism?
I don't know about journalism per se, but for journalists, they presumably arrived at the status quo as the profit maximizing option, and removing it will, to varying degrees, impoverish them.
FabHK
That is a sensible first hypothesis, but it rests on many assumptions, in particular that the market doesn't have any prisoner-dilemma/tragedy of the commons aspects to it.
It is quite conceivable, for example, that every single journalist is better off if they make click-bait listicles instead of investigative journalism, but the profession as a whole suffers.
machello13
Seems like an argument against making any kind of change to any industry.
jldugger
You're not wrong; it's not like industry constantly lobbies against regulation because they'd be _more profitable_.
Maybe it's called for and in the consumer's best interest, but let's not pretend Apple is doing this for industry's bottom line.
layble
Exactly the opposite actually.
midasuni
Please elaborate
throwaway3699
It forces publishers into closed gardens. I am willing to bet Apple's work here will have the same effect that advertising did on RSS, which is that newsletters will turn into truncated notifications designed to bring you to a website where they can get the business metrics they "think" they need.
I actually think there is a nice middle ground for something like a basic view counter, and some open rate data to be available in an aggregated, anonymous way.
ljm
You know, I had some beef with the word 'engaged' a few years ago, especially because I worked for a startup that cared about happiness instead (an active question rather than passive inference). In that context, we realised it was ridiculous to ask if you were engaged with your job, we wanted to know if you were happy and so we asked the questions instead of trying to secretly gather the data by spying on your activity.
Now I downright hate it. What does 'engaged' even fucking mean? One definition is that you're 'locked', so your attention is locked with them and not someone else. A public toilet cubicle will say 'engaged' when someone is in it.
For an email newsletter, you can see how well it's doing both by the number of subscribers on the list, and also by how many people click through and read the full article on your site. No tracking involved, you just send out an email and look at your logs for an uptick in traffic.
9wzYQbTYsAIc
Click through detection requires inclusion of at least a newsletter id in a query parameter, or something along those lines, for the links provided within the newsletter. Without that, there’s not enough specificity to get anything other than a rough idea of how many people might have clicked the link right after you sent the email.
ljm
You can make a case for it not being tracking if it's not a link masked behind 2 or 3 redirects through ad or link tracking services.
You can just have a link that you could log and rewrite in nginx/apache/caddy -> https://mysite.com/mailer/thepost --> https://mysite.com/thepost
Or just forget about all of that and just _ask_ people and make your decisions on that instead of extrapolating meaning through espionage.
snowwrestler
> For an email newsletter, you can see how well it's doing both by the number of subscribers on the list, and also by how many people click through and read the full article on your site.
How is it any more happiness-centric to force people to “click through” again and again to read the full article? This is borderline reader-hostile in 2021.
The big revolution in email recently has been that the email itself is the product. Put all the content there; deliver 100% of the value with one click (the click that opens the email).
This is way better for the reader than having to click 12 separate times just to read a bit.
jedberg
Doesn't Gmail and Outlook already anonymize tracking pixels? When I heard that announcement what I heard was, "we implemented a feature that Gmail and Outlook have had for years!". I don't think it will change the landscape all that much.
stingraycharles
They don’t anonimize it, they just request it from the backend. They still request the exact same URL, so you can carefully track email opens on a person-by-person basis, you just cannot track IP addresses and/or set tracking cookies or whatnot.
gruez
The wording[1] also suggests they request the images even if you haven't opened the email, which obfuscates whether you've opened the email or not. With other services like gmail the images are only requested when you open the email, so it's possible to infer whether you opened the email or not based on whether the image was loaded.
[1] https://twitter.com/rjonesy/status/1401993816001978375/photo...
lstamour
Gmail and similar providers proxy all image URLs they receive at the time they receive the email, so you can't tell when a user later opens the email. That said there might be bugs to make your images un-cacheable such that Gmail still loads them later, directly or indirectly, when you open an email.
Compare this with Apple Mail which proxies emails from a different, presumably non-Google IP address and which does so only when an email is downloaded in the background. So while you can't track IP address, yes, and you never could set cookies that I'm aware of without clicking a link first, this means you can still track "downloads" of your email to a local client, just not "opens" - and if your Mail app already downloaded images when the email was downloaded, then it's possible it won't even change that - you might not have been tracking opens this whole time... maybe.
gruez
>Gmail and similar providers proxy all image URLs they receive at the time they receive the email, so you can't tell when a user later opens the email.
I searched around and found some articles that makes the same claim[1], but in my own testing that doesn't seem to be the case (ie. I had to click on the email before image would start loading).
[1] https://sendloop.com/articles/the-effect-of-gmail-image-prox...
shp0ngle
This is not correct. They load the URLs at the moment you open the e-mail. You are still trackable. It's just that they open it on backend, so they don't get your IP, but they still know that you opened it.
snowwrestler
Gmail’s proxy only requests and caches the image when the user does. It does not hide anything other than the user’s IP address.
jankeymeulen
Will Apple do it differently?
jedberg
Right, exactly the same way Apple Mail will work.
JimDabell
No, you’re missing the difference. Gmail requests the embedded resources when you open the email. So it’s still possible to track open rates through it, even if the proxy obscures your IP address. Apple Mail requests the embedded resources without you opening the email, so you cannot use it for tracking open rates.
A lot of people assumed this is what Gmail did, but it wasn’t actually the case.
webmobdev
This is why I find it hard to trust Apple products - if Apple funnels the request through their servers Apple also now has access to this data. Now, your personal data / metadata is available with more people than before. But you are supposed to believe this is all to protect you. /s
(And no, I don't trust Apple not to associate this data with a user's Apple ID and datamine it in the future - if your country has lax privacy laws Apple will exploit it till the law says otherwise.)
Edit:
Here's another perspective - now, even if I don't use Apple's iCloud backup or email services, Apple has found another clever way to learn about some of the marketing emails I receive. That information is very valuable.
macintux
> if your country has lax privacy laws Apple will exploit it till the law says otherwise
Given the wretched state of privacy laws in the U.S. that seems an uncharitable position. Apple has far more business motivation to treat its customers well in that regard than to try to squeeze money out of their data.
Although you’d think they’d have motivation to treat developers better than demanding a 30% cut, so there’s that.
lstamour
If Apple re-uses iCloud Private Relay for this feature, which they might or might not be doing, then there are actually two entities involved and Apple presumably knows what user made the request but not what URL was requested: https://appleinsider.com/articles/21/06/10/how-apple-icloud-...
floatingatoll
Typically they have an off switch for things that are considered sensitive data, and when they don't they seem inclined to course correct. If they don't have an off switch in the WWDC developer betas, that would be a bug for everyone to report via Feedback Assistant.
_hyn3
This is absolutely correct. Because you can connect Apple Mail to non-Apple servers, they are missing out on a lot of telemetry that Gmail gets by default (because it already goes through Gmail's servers.) This gives them an excuse to proxy non-Apple email. (on another note, it sure seems like most of Apple's moves are dual-purpose now, and I don't think that was the case in the days of Jobs.)
However, I'd like to see the Privacy Policy (if it's available and in plain English) for this feature before concluding that they're not immediately discarding this data (or even just where I get my mail from, which is also very useful information to further lock me in.)
lstamour
Yep.
When Gmail first introduced this image proxy feature in 2013 it started showing images in emails by default, which is great. I researched blog posts from then and apparently a workaround that still worked was to serve a fake HTTP Content-Length header of "0" and Gmail's proxies wouldn't cache the image. It's unclear if this bug has been fixed or not, or if similar bugs affect Outlook's proxies, for example.
The rest of this post is speculation -
I wonder if it won't affect Apple's Mail app because Apple isn't loading images directly from a proxy, instead, the original URL is sent to the Mail app over IMAP or Exchange and then Apple will download the image by asking the Apple proxy for the unmodified URL. This means even if an existing Gmail or Outlook image proxy server can be tricked, it shouldn't affect the Apple Mail app.
That's not to say Apple Mail won't have other issues - for example, it shouldn't stop at images. Apple Mail supports CSS and web fonts, so theoretically all network traffic not destined to hit the IMAP server should go through the proxy if complete privacy is desired. I think the wording of the Mail app suggests it's more than just images.
And the way it's implemented, because it's not server-side, it does indicate that an email address checked using Apple Mail downloaded your email, so you know it's pretty likely there's a human at the other end and they use Apple Mail even if they don't know exactly when you opened the email for the first time, they know when your Mail app downloaded it and possibly when you received a push notification about it. Unless it caches content with every request, which it might, you might also know how many different Apple Mail clients downloaded the message and when which might still indicate patterns of use especially if you can create a network of tracking pixels across different email messages. Finally, nothing about the feature actually anonymizes links or prevents specifically tracking pixels, but that's probably a good thing until we invent local Content Blocker extensions for Mail app, for example.
kasperset
Just saw this "Build Mail app extensions" https://developer.apple.com/videos/play/wwdc2021/10168/ Does this mean we will get content blocker for email then?
smoldesu
I have never used an email client that doesn't block it by default. I was surprised (and somewhat worried) when I heard it being announced for Mail.
Jakob
I liked this way to contact your subscribers, I received the other day. No tracking necessary and either engagement or pruning:
You signed up for my private email list at https://sive.rs/
... but since you've never replied, I can't tell if you're a real person.
Please reply to this email and say anything, ideally something about yourself like where you are in the world. Or feel free to ask any question.
(I read and reply to all. This part isn't automated. It's just me.)
If you don't reply, I'll assume you're not getting this, and delete this email (redacted) from my system.
ryantgtg
When Casey Newton (author of the article) first launched his Substack newsletter, he was alarmed that the full posts were not displayed for gmail users - instead there was a "jump" (that many users probably don't see, because it's formatted as "... [Message clipped] View Entire Message"). The issue is that gmail clips emails at 102k, and the substack emails easily hit that limit when posts contain lots of urls due to 1) inline styling on links, and 2) the ballooning hyperlinks due to the tracking strings.
This person found that substack was ballooning a 59 character url to over 400 characters.
https://tedium.co/2020/12/22/gmail-102kb-email-size-limit-hi... (same author, more detail): https://twitter.com/ShortFormErnie/status/133992146683031961...
I was hoping this incident would cause substack and others to pull back on the reins a little bit. The urls on these emails are redonk, and clearly the authors aren't happy about users missing out on content.
shortformblog
I wrote the story on the size limit issue you linked and have thoughts on the issue listed here. (Long story short: This whole issue is a byproduct of the lack of standardization in the email space, something highlighted by the use of tables in emails, which are another reason why emails are so large. Long story short, email is in need of modernization, which could lead to better options for tracking than tracking pixels, which are not anonymized enough for publisher use cases.)
I agree that the amount of tracking going on in the Substack links is a bit aggressive, but I want to be careful to not put too much of the blame on them for the long links. Part of the problem is the service that Substack is using, Mailgun, is intended for transactional emails, rather than the newsletters that Substack is sending. My feeling is that Substack ramped up using Mailgun but probably needs to start building their own tech for doing this, because it’s clearly not suited for the Substack use case.
Thanks for sending the link—it is super-relevant to this issue.
snowwrestler
Indeed, tables and in-line styles are industry standard email coding practices, and the main reasons email character count balloons. Tracking links are a tiny factor, unless maybe the email is stuffed with links. (I doubt Casey’s are.)
Thank you for figuring out that character limit. We redesigned and recoded a template to get under it.
And tables and in-line styling are industry standard for one reason: Microsoft Outlook. It still uses the ancient and horrible HTML rendering engine from MS Word, instead of a modern HTML engine like literally everybody else uses. And a ton of senders care about Outlook because so many high-value subscribers use it (e.g. corporate staff at big companies).
The other factor is that the use of email to send long-form content is pretty recent. For a long time before, emails were either personal, marketing, or publishing with “click to read full article.” All pretty short.
shortformblog
When I started my newsletter, I was seemingly the only person using email for long-form. Now everyone’s doing it.
The situation with Outlook should hopefully improve in the next year, as Microsoft is planning to make different versions of Outlook work basically the same, with the web version as the baseline: https://www.techradar.com/news/microsoft-wants-to-unite-all-...
The downside of this whole saga with Apple is that other than this Apple basically renders emails better than just about every other service—rendering essentially using the Safari engine. Gmail has improved but inlining CSS is still required because of it.
If everyone was working to a unified standard life would be easier for email senders … possibly even recipients.
ryantgtg
Casey’s are fairly stuffed with links. The format is generally: main article; multiple sets of links to other articles; funny tweets. He might be more mindful these days of how many links he includes, because at the beginning he seemed quite alarmed that many readers couldn’t see the whole email without a jump.
dan-robertson
1. There are (perhaps silly) reasons for newsletters to have tracking which is that if you send them to people who don’t read them then, even though it’s easy to unsubscribe, big mail hosts (eg Google) can down rank your host in their spam filters. Worse still, some users treat the spam button as “please delete this thing I am not interested in” but that is not really how the signal is interpreted by the mail host. The solution is for newsletters to auto-unsubscribe users if they seem to stop interacting with the emails.
2. The actual threat to the newsletter boom is that advertisers realise that, just like every other fad format before, newsletters aren’t a particularly better way to reach audiences, and so they will stop paying so much for the ad space. Or they will move on to some other fad format and demand will fall off a cliff.
gsich
>The solution is for newsletters to auto-unsubscribe users if they seem to stop interacting with the emails.
Not possible without tracking.
toomanybeersies
They aren't stripping query params off urls, so you can just add a recipient ID to any URLs in the email e.g.
https://newsletter.com/linked-page?uid=7b32e2f7gsich
That is ... not reliable tracking.
epigen
Click tracking
tekacs
> Given Apple's monopoly advantage with their preinstalled Mail app, we don't need much of an uptake from what they're calling Mail Privacy Protection to break the dam on spy pixels. You can't really say anything authoritatively about open rates if 5-10-30-50% of your recipients are protected against snooping, as you won't know whether that's why your spy pixel isn't tripping, or it's because they're just not opening your email.
This doesn't seem true -- I imagine that most tracking providers will start to simply ignore all link opens from Apple's proxy (I assume they'll be using Apple's IP ranges or otherwise be 'detectable').
DHH doesn't seem to recognize that Apple opens the link irrespective (the spy pixel will /always/ trip, not /never/ trip), so it should even be really easy to figure out which users are using Apple Mail.
That being the case, folks will only lack open data for Apple customers, without polluting the rest of the dataset.
partido3619463
Is it possible that Apple Mail is a huge proportion of opens because they’re one of the last to NOT block it? I thought Gmail and outlook already blocked images by default…
58% of desktop opens just seems extreme given proportion of Mac vs PC use.
itsdrewmiller
Yeah, that stat is totally unbelievable. iPhone being 20x more mobile opens than Android is also pretty sus with about 50/50 US market share and Android dominating globally.
lucasjans
Hacker News: Big tech stiffles competition, the little guy can't compete
Also Hacker News: small independent publishers leveraging email for publishing shouldn't get engagement data on their independent newsletters.
Aggregate open rate data is vital to a newsletter. It makes it easy to spot delivery issues. It's an early indication of content quality, and important feedback loop.
I'm fully for blocking identifiable tracking. But isn't there room for a solution for anonymous engagement metrics?
Email newsletters are a great way for individuals to control their distribution channel built on top of federated, decentralized technology.
Adtech is the enemy.
sneak
> Aggregate open rate data is vital to a newsletter.
No, it's not. Mine exists without it, and yours can too.
tyingq
This doesn't prevent creating unique names for the same image and sending a unique name per email. Apple's new approach hides the IP, but Gmail already does that[1], and they have more email market share, don't they?
[1] https://gmail.googleblog.com/2013/12/images-now-showing.html
Get the top HN stories in your inbox every day.
Difficult to feel pity for business models built on abusing HTML capabilities to track email viewing.
I don’t load remote images by default, so this already doesn’t work for me. However, basically every mail platform creates tailored links to track click engagement. So you’re screwed anyway, just maybe a little later.