Capital One Says Breach Hit 100M Individuals in U.S - <AUTHOR> https://www.bloomberg.com/news/articles/2019-07-29/capital-one-data-systems-breached-by-seattle-woman-u-s-says <comment><USER3> The way they are disclosing this is pretty disgusting, in my opinion. Go check out their info page about this[1]. In bold it says:

> No bank account numbers or Social Security numbers were compromised, other > than:

Then below that, in non-bold, it basically says "oh, except for these 140,000 social security numbers and 80,000 bank account numbers" \- which is the _primary reason_ folks are worried about this!

To me, the first thing you are going to see is "No bank account numbers or Social Security numbers were compromised" in bold letters. Which is completely false and misleading. _Technically_ they are telling the truth, but the way they've done it is clearly meant to be misleading.

On top of that, I'm a Capital One customer myself, and I can't figure out how to find out if I was affected at all!

[1] [https://www.capitalone.com/facts2019/](https://www.capitalone.com/facts2019/)

<comment><USER4> But the those 140k and 80k number are their own bullet points that I feel make them stand out more then the bold line. I feel like this is clear enough.

<comment><USER3> This is obviously anecdotal, but that was not my personal experience. I was getting ready to go to bed last night when I saw this and grabbed my tablet to see if I needed to worry. This bolded bit was the first thing I saw, and I immediately thought "hm, must have been over-exaggerated, no SSNs were exposed". Now I obviously read on and saw the bullet point, but for someone skimming this, it's not at all obvious.

But further, why even word it that way? It was clearly done intentionally. There's no need for this to be presented in this way other than to intentionally try to mislead. Why not just say, in bold letters "140,000 social security numbers and 80,000 bank account numbers were compromised". Or say it "The following were compromised".

</comment></comment></comment><comment><USER5> > hacked into a cloud-computing company server, federal prosecutors in Seattle > said

> the cloud-computing company, on whose servers Capital One rented space, > wasn't identified in court papers.

Does this feel like it was just an S3 bucket with permissions set incorrectly? I've come across sensitive documents in S3 buckets with a well crafted google search.

<comment><USER6> Actually looks like she worked for Amazon on S3. So there might have been some insider knowledge. From the complaint below, and googling her name you can find her resume

I won't link it here, but here's a screenshot of a snippet: [https://i.imgur.com/NezWVKw.png](https://i.imgur.com/NezWVKw.png)

<comment><USER7> I know that reading the actual linked content on HN is verboten, but the Bloomberg story says

"Thompson was previously an Amazon Web Services employee. She last worked at Amazon in 2016, spokesman Grant Milne said. The breach described by Capitol One didn't require insider knowledge, he said."

<comment><USER8> "Didn't require" is a very precise way of stating a truth about the vulnerability that was exploited, while neither confirming nor denying whether her role at Amazon was in some way responsible for her discovering the vulnerability.

(If I could query all AWS permissions for publicly exploitable permissions, that would comply, for example.)

<comment><USER9> The AWS spokesman quoted in the article also explicitly says it wasn't a vulnerability.

<comment><USER8> Do you consider an access control misconfiguration to be a vulnerability? Does Amazon?

Point stands; they're being very careful to say that there aren't any CVEs, but they are also very carefully _not_ saying whether she abused the privileges of her role to identify misconfigurations more rapidly than she could have otherwise.

<comment><USER10> Detailed knowledge of a system gives you all kinds of knowledge about how to exploit it. You don't need special access if you know X% of users misconfigure feature Y.

<comment><USER8> It's not about _knowing_ that X% are misconfigured, it's about whether special access or circumstances led to _locating_ them more efficiently than the general public could have.

Special access can make the difference between "locating X% of misconfigured users in a single admin panel query" and "locating X% of misconfigured users by scanning every S3 bucket in existence without being caught".

Or to draw a weak analogy, knowing that a closed-source PRNG algorithm is defective does not necessarily help locate all keys generated by it, but having access to force it to generate numbers for you (or to study its source code) absolutely does help.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I downloaded the indictment (edit: complaint, not indictment) from PACER: [https://www.dropbox.com/s/z7u5rxcdajuvw6t/19718675504.pdf?dl...](https://www.dropbox.com/s/z7u5rxcdajuvw6t/19718675504.pdf?dl=0)

<comment><USER12> Good lord.

-Paige left code used in the "attack" on her GitHub.

-Paige left text files with unencrypted data there, too.

-Paige openly posted about it in an open (!!!) Slack channel and publicly named her VPN service of choice, which of course, matched access logs AND GitHub server logs. (Also tor, which the FBI agent was able to confirm and add yet another data point)

-Paige said "I have a leak proof IPredator router setup." nice.

Nice opsec there. Sheesh.

EDIT: Thanks for the PACER share, by the way.

<comment><USER13> It says she posted on "social media" (Twitter) about it, claiming to have Capital One information, "and that she recognizes that she acted illegally".

Nothing about Opsec here. She basically asked them to arrest her. Probably had some of the usual motivations: "look at me I'm clever", "look at this stupid big company with bad security", or maybe used the opportunity for some political thing with banks. Not the sophisticated hacker type. But who knows.

Edit: originally I asked about her Github profile listed in the complaint as paigea(5x * characters)thompson but was iffy on whether that was okay on HN.

<comment><USER14> [https://gist.github.com/paigeadelethompson](https://gist.github.com/paigeadelethompson)

Not much is left.

<comment><USER15> Her gitlab account shows it was updated just few hours ago. How is this possible?

[https://gitlab.com/netcrave](https://gitlab.com/netcrave)

<comment><USER14> When you star a project it gets "updated" even if you unstar it. Kinda like Unix's _touch_ command.

</comment></comment></comment></comment></comment></comment><comment><USER16> Instead of focusing on the lady involved, perhaps holding Capital One accountable for their part in the matter may be a better thrust to this thread.

While it might not be okay to instigate such breaches, we might also consider it the actions of a whistleblower. Especially given the unusual way she went sbout disclosing things.

Sure, perhaps there is a little bit of hey look at me about it, but at the bottom of the trough it is actually the corporation that has ultimate responsibility.

I look forward to a statement from Capital One of regret that they allowed the breach to happen and will strive for better standards of security.

And that is actually a message for the entire industry.

</comment><comment><USER17> If I came across an s3 bucket with my credit application details and I could delete it, I would probably do it and then report to their security team. It's MY data security they're being casual with.

It occurs to me now that if I did that it would likely be a crime because of the harm to the company. The irony.

<comment><USER13> Who cares if it has your data in it or not. Just report it to authorities and the guy who runs haveibeenpwned.

Plus what are you going to do with credit card applications anyway? Sell them to a marketing company with some phony story? Or the 'sell them on the darknet to fraudsters in Russia' angle? Unless you're already involved in some dirty business already this isn't very valuable.

<comment><USER18> I would imagine complete credit card applications contain the type of information identity thieves would be willing to pay good money for.

<comment><USER19> By now everyone's identity data is already widely disseminated, no?

<comment><USER20> I operate under the assumption my name, address, email, social media profiles, social security number, place of birth, and mother's maiden name are all easily available in the wild. I've bought one of those online background checks before, at the very least I can be confident the info on that report is available to anyone.

</comment></comment></comment></comment></comment><comment><USER21> Why am I finding out about this from the news and not an email from Capital One themselves? I wish there was legal liability to inform customers in the event of a data breach.

<comment><USER22> They are legally obligated, especially in California, to disclose part or all of this breach to customers. But that obligation is not immediate. Give it some time.

<comment><USER23> Do they need to notify those of us not located in California?

<comment><USER24> YMMV, but all 50 U.S. states require some sort of notice for security breaches.

</comment></comment></comment></comment><comment><USER25> I was there when C1 negotiated that deal with Amazon and they swore it couldn't happen but of course, we all know that's false.

<comment><USER26> Miss the LevelMoney folks...

Yeah AWS can't protect you against a misconfigured environment

<comment><USER27> Are there AWS experts who can do some sort of quick audit or "sanity check" of an environment's configurations? AWS almost makes it _too_ easy for someone who only sort of knows what they're doing (like me) to get things up and running.

<comment><USER28> There are many different automated systems for checking for misconfigurations in your AWS organization. Capital One even developed a very popular one (Cloud Custodian). Like most automated configuration checkers or monitoring systems they rely on being configured by experts because at their default settings they are mainly a source of annoying alerts that end up auto-filed to email folders you never look in because this is agile and we can rationalize the alert rules in the next iteration (we won't). They can also auto apply actions. Have fun debugging your Cloud Formation stack that failed because the automated checker system terminated the instance without notifying anyone because it was missing a required tag.

As useless as these checkers are, the main problem is that there are so many different ways to gain access to resources that it's almost impossible to have a system that's useful to the business while also provably secure either manually or automatically.

Don't forget even AWS themselves created a "managed" policy for some minor service which accidentally gave users root access in the account: [https://medium.com/ymedialabs-innovation/an-aws-managed- poli...](https://medium.com/ymedialabs-innovation/an-aws-managed-policy-that- allowed-granting-root-admin-access-to-any-role-51b409ea7ff0)

</comment></comment></comment></comment><comment><USER29> Generally it's not a good idea to sabotage your employer's clients, but I wonder how many engineers across the Big 3 US cloud providers have the know- how to exploit holes in how Forture 500 companies use their platforms.

<comment><USER30> This is a legitimate risk.

At a minimum, AWS Support has near complete read access to AWS accounts in connection with support cases.

It would be interesting to hear from an AWS employee how access to customer information is controlled.

<comment><USER31> Metadata, yes. But not content. So they can see you have 200 c5.9xlarges running in 3 AZs in 3 subnets in one VPC, for example.

But they can't see what you have on the volumes attached to those instances, what processes are running, etc.

<comment><USER32> I've had AWS support tell me exactly what processes are running on my instance. They do seem to have some visibility beyond metadata.

<comment><USER33> I'm an Amazon employee here - but my words don't represent the company.

Internally we also talk to AWS support. They absolutely don't have much visibility into our accounts at all - much to my frustrations. They only see metadata - even for internal accounts.

The only teams that have some access to such information is security team, or when you Grant access explicitly to the other person via standard AWS auth mechanism (IAM)

</comment></comment></comment></comment></comment><comment><USER34> This spooked me. I thought I recognized the name, and then I remembered she had recently contacted me out of the blue on meetup.com to ask if I was interested in doing some urban exploration. I said yes, but we never got around to picking a day. Now I'm kind of glad we didn't!

<comment><USER35> I'd be kinda bummed I didn't

</comment></comment><comment><USER36> After reading the affidavit it was a former AWS employee. The accused worked there from 2015-2016 and it's not immediately clear that it was a misconfigured S3 bucket. There's a particular IAM role she used to execute API commands (ListBuckets, etc..). The buckets contained credit card applications and other data including DOB and SSN. She gloated about it on Slack and said she was using a VPN and Tor.

The affidavit is a good read. Linked elsewhere in this thread.

</comment><comment><USER37> Anyone have a copy of the complaint handy? I'd love to read the Government's allegations in more detail.

(Edited: complaint, not indictment.)

<comment><USER37> DOJ press release:

[https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker- arr...](https://www.justice.gov/usao-wdwa/pr/seattle-tech-worker-arrested- data-theft-involving-large-financial-services-company)

""" A former Seattle technology company software engineer was arrested today on a criminal complaint charging computer fraud and abuse for an intrusion on the stored data of Capital One Financial Corporation, announced U.S. Attorney Brian T. Moran. PAIGE A. THOMPSON a/k/a erratic, 33, made her initial appearance in U.S. District Court in Seattle today and was ordered detained pending a hearing on August 1, 2019.

According to the criminal complaint, THOMPSON posted on the information sharing site GitHub about her theft of information from the servers storing Capital One data. The intrusion occurred through a misconfigured web application firewall that enabled access to the data. On July 17, 2019, a GitHub user who saw the post alerted Capital One to the possibility it had suffered a data theft. After determining on July 19, 2019, that there had been an intrusion into its data, Capital One contacted the FBI. Cyber investigators were able to identify THOMPSON as the person who was posting about the data theft. This morning agents executed a search warrant at THOMPSON's residence and seized electronic storage devices containing a copy of the data. """

<comment><USER38> Sounds less like intrusion and more like accidental exposure by Capital One.

<comment><USER39> It sounds like an internal threat to me (she was an employee at Amazon).

<comment><USER40> Not at the time of the hack. Insider access was not used.

</comment></comment></comment></comment></comment><comment><USER41> I don't trust in the U.S. justice system to handle every crime and person as it should but for us, context is important: This person's Twitter is 0xA3A97B6C, y'all can go there and get a better picture of the situation.

<comment><USER42> So much evidence of mental illness there (see also Facebook). I hope this person gets help, but given their claim to also be in the country illegally (Tuvalu), who knows.

I was ready to think this person was being set up by someone who didn't like her, given how exposed she was to being identified, but the Twitter and FB posts strongly suggest a vulnerable person making poor decisions instead.

<comment><USER43> Given that Ms. Thompson is transgender [0], it's likely a lot was stacked against her emotionally. 40% of trans-identifying individuals to attempt suicide [1]. This is a disappointing omission from the reporting and the road that lies ahead for Ms. Thomson in the hands of the federal prison system is surely horrifying.

[0] [https://twitter.com/0xA3A97B6C/status/1152518528907354112](https://twitter.com/0xA3A97B6C/status/1152518528907354112) [1] [https://transequality.org/sites/default/files/docs/usts/USTS...](https://transequality.org/sites/default/files/docs/usts/USTS- Executive-Summary-Dec17.pdf)

<comment><USER44> I wonder if it could be an effective legal defense for her, akin to plot of Soderbergh Side Effects (2013). "not guilty by reason of insanity" due to hormonal treatment, there are precedents

[https://www.charlotteobserver.com/news/local/crime/article64...](https://www.charlotteobserver.com/news/local/crime/article64105547.html)

[https://ps.psychiatryonline.org/doi/full/10.1176/appi.ps.53....](https://ps.psychiatryonline.org/doi/full/10.1176/appi.ps.53.1.27)

[https://www.mercurynews.com/2012/08/21/man-acquitted- after-a...](https://www.mercurynews.com/2012/08/21/man-acquitted-after-ambien- defense-now-faces-parole-board/)

<comment><USER45> As a transgender person, I can tell you that estradiol absolutely cannot induce insanity. At the absolute _most_ , it can screw with your emotions in the same exact ways as PMS (and PMS is indeed caused by hormonal fluctuations).

The idea that it's on the same level as ambien is absurd.

<comment><USER44> NGRI is just a legal term covering committing a crime while not in full possession of ones faculties, not limited to the put me in the cuckoo house stuff people tend to associate with the word.

</comment></comment></comment></comment></comment></comment><comment><USER46> Stolen from someone else but:

I wonder if we should create a new BSI (Broken System Interconnection) model

1 - <USER2>

2 - Former Employee

3 - Current Employee

4 - Bitcoin Miners

5 - Unknown Hackers

6 - Own Government

7 - Foreign Government

8 - Hardware Vulnerability

</comment><comment><USER47> What was Slack's role in all of this?

They appear to have turned over historical images and chat logs, not just for the person indicted, but even others in the same channel.

Did the FBI ask nicely or was there actually some formal process?

<comment><USER48> Some of the conversation occurred on her Slack server, which as of an hour or two ago was still completely open/public via an invite linked shared on Meetup.

The entire server chat log is a few Google searches away.

<comment><USER12> Right. It was an open Slack group. It's likely the Special Agent is the source of those logs and photos; no need for Slack to confirm anything except for metadata to authenticate the logs (if that's even necessary for yet another nail in the coffin).

</comment></comment></comment><comment><USER49> "According to Capital One, its logs show a number of connections or attempted connections to Capital One's server from TOR exit nodes"

Now there's a fail.

<comment><USER50> How's that a fail?

<comment><USER51> They should not be letting egress traffic through to a Tor node.

<comment><USER31> Is there enough space in an S3 bucket access policy to include DENY rules for every known Tor IP address?

<comment><USER49> By the sounds of it, the s3 bucket was internally accessible only. But attacker connected through the corp's Web Application Firewall after grabbing the credentials to login to the S3 bucket.

<comment><USER31> "Internally accessible only" just means you have to have credentials to access it.

You can also add IP address restrictions to a bucket access policy; this was obviously not done here because once she had the credentials, it didn't matter where she was accessing from.

</comment></comment></comment></comment></comment></comment><comment><USER52> How is this person's information wiped off the Internet? I literally cannot find anything related to her. Is it just me?

<comment><USER53> Just keep refreshing this page, people seem to have no problem linking her information all over this thread.

I get that much of this info is already public, but this feels like borderline doxxing.

</comment></comment><comment><AUTHOR> The New York Times has also picked up the story: [https://www.nytimes.com/2019/07/29/business/capital-one- data...](https://www.nytimes.com/2019/07/29/business/capital-one-data-breach- hacked.html)

<comment><USER54> >Seattle Warez Kiddies

That is some old school naming.

</comment></comment><comment><USER55> Apparently she used "erratic" as a pseudonym.

After reading through some of the complaint, it seems quite fitting.

<comment><USER49> Quite possibly self-aware of their own ups and downs.

But that can get you in trouble when you're playing with fire.

</comment></comment><comment><USER56> I wonder why data security professionals don't practice compartmentalization. 100 million accounts should not be accessible from one account. It should be like watertight compartments in a ship. Breaching one doesn't sink the ship.

<comment><USER40> Data security professionals don't make these decisions, random developers do. And they do what is easiest.

<comment><USER57> At most large companies, IT sets the policy and developers are required to work within that policy. I've worked at about 10 jobs. The only one where devs could write their own ticket was a startup

<comment><USER40> IT doesn't have any involvement when it comes to S3 buckets at any company I've seen. Anything in a cloud tenancy is devops acting with autonomy. Sometimes they have a security person review it, but many companies don't do that, and the ones that do have way more moving parts than their security engineers are capable of reviewing, so stuff gets through.

Even then, it's unlikely that a security person would recommend compartmentalizing this particular data set. Any application that needs access to some of it probably needs access to all of it, and it makes little difference if you compromise a server and get one key or if you get 30 keys. The trust boundaries haven't moved, so it would increase cost without really mitigating any threats.

</comment></comment></comment></comment><comment><USER58> I guess this is how we all finally get paid for our data. Just continually file for our $125 check as every company that exists is hacked over the next decade.

<comment><USER59> FYI, getting a $125 check from Equifax is contingent on most of the people that are eligible to get one not actually requesting it. It'll probably be less

<comment><USER60> Yeah, there's only $31M allocated for those payouts :/

<comment><USER61> So less than 5% of the settlement goes to people affected? Yes, that seems reasonable...

<comment><USER60> Right? Also just FYI I pulled that number from

[https://www.theverge.com/2019/7/26/8932398/equifax- settlemen...](https://www.theverge.com/2019/7/26/8932398/equifax- settlement-125-claim-wont-get-money-alternative-reimbursement-compensation)

</comment></comment></comment></comment></comment><comment><USER62> Company statement discussed here: [https://news.ycombinator.com/item?id=20561212](https://news.ycombinator.com/item?id=20561212)

</comment><comment><USER63> > Capital One Financial Corp. lost data from as many as tens of millions of > credit card applications after a Seattle woman hacked into a cloud-computing > company server

> The cloud-computing company, on whose servers Capital One rented space, > wasn't identified in court papers

I can't tell whether the company virtual server got hacked or whether the cloud provider was who got breached. Hopefully just the vm

<comment><USER51> Well, the main cloud Capital One uses is Amazon as far as I know.

If you think about the attack vectors here, it was most definitely the virtual server that got attacked. If it was the cloud provider (Amazon), there are a lot of safeguards that these banks use to make sure that any data that touches the shared server persistent storage is encrypted. And when I say safeguards, I mean automation to make sure that this sort of scenario shouldn't ever happen.

This is a huge blow for the public cloud and financial services companies, unfortunately.

Edit: Seemingly a WAF firewall issue. I wonder what happened. These rules should be applied automatically for Capital One using Cloud Custodian [0], so a config issue definitely occurred somewhere.

Final edit: A leaked account with access to IAM permissions. Good lord was occam's razor correct here.

[0] [https://github.com/cloud-custodian/cloud- custodian](https://github.com/cloud-custodian/cloud-custodian)

<comment><USER64> so I wrote the majority of cloud custodian and still maintain it. I no longer work at capitalone (since jan 2019). afaics the suspect ([https://www.linkedin.com/in/paige-t-704a29188/](https://www.linkedin.com/in/paige-t-704a29188/)) worked at AWS 3 years ago is also irrelevant which its why its not part of the filing.

the best link for understanding what happened is actually the court case filing not the media reports. [https://www.justice.gov/usao-wdwa/press- release/file/1188626...](https://www.justice.gov/usao-wdwa/press- release/file/1188626/download)

so this isn't a case of s3 bucket being public/wide open, its a case of a waf iam permissions being overly broad if I'm parsing the filing correctly. Its unclear how the waf product was hacked/bypassed and its credentials obtained.

wrt to custodian in this equation, its not really related afaics, custodian has lots of filters to help determine stuff like is my ec2 or anything with iam role (lambda, etc) overly permissive wrt to permissions (check-permissions filter). it also has the ability to filter individual statements and access on any resource (s3, lambda, etc there are many) with an embedded iam policy on a fine grained basis (allow y accounts but not x accounts) to protect against account level access (cross-account filter). And the ability on ec2 via guard duty alerts to auto remediate (suspend, memory snapshot, yank role, volume snapshot). its used by lots of users/enterprises across the governance, security, cost-optimization domains because its flexible and supports many clouds.

<comment><USER65> Thanks for writing Cloud Custodian. What are you working on these days?

<comment><USER64> Still working on custodian, k8s integration up next. else atm. trying to ensure that the next 20 years of opensource are open.

</comment></comment></comment></comment></comment><comment><USER66> "I sincerely apologize for the understandable worry this incident must be causing those affected." \- CEO

He worded it carefully. He's not apologizing for the actual and potential harm of the breach so as to not take responsibility for it. Not a real, sincere, apology, but just a legally defensive move.

</comment><comment><USER67> I'm still not clear what I need to do to protect myself from a similar class of misconfiguration mistakes.

"The first command, when executed, obtained security credentials for a role known as ____*-WAF-Role " says the affadavit.

Was some web app of CapOne coded so the JavaScript app fetched IAM credentials over HTTP so it could do its job by accessing some other S3 bucket?? And thats how Paige or someone she knew found the toehold in? That would be pretty brain dead. Or was it more subtle in terms of pure WAF misconfiguration?

</comment><comment><USER68> Can someone ELI5 how one bank has critical information on 100M US individuals? Is this metric representative of accounts or anyone involved in a transaction with a Capital One account?

</comment><comment><USER69> Is it just me or is there no mention from Capital One WHERE customers can go to

1) check if they were affected by this breach and

2) what customers who are affected should do??

great way to start the day...

<comment><USER70> What to do? Freeze your credit!

[https://krebsonsecurity.com/2018/09/credit-freezes-are- free-...](https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the- ice-age-begin/)

Not just for this breach but for all the past and current ones we don't know about and future ones that will happen.

The real problem is there is zero security/identity management in our financial systems which is beyond nuts in this day and age.

</comment></comment><comment><USER70> If you haven't frozen your credit report yet, what are you waiting for?!?

[https://krebsonsecurity.com/2018/09/credit-freezes-are- free-...](https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the- ice-age-begin/)

</comment><comment><USER71> Capital One's response:

[https://www.capitalone.com/facts2019/](https://www.capitalone.com/facts2019/)

<comment><USER72> >Importantly, no credit card account numbers or log-in credentials were compromised and over 99 percent of Social Security numbers were not compromised.

Cool, just other stuff, such as name, address, income, credit score, _transaction history_ , payment history, ya know, nothing too important or personal..

Arguably the least important data element is the account number...

</comment></comment><comment><USER73> How does one find out if their account info was part of this?

</comment><comment><USER74> this breach does not add up alot of inconsistencies. Also right during the passing of the new law Shield Act

</comment><comment><USER75> Yeah but AWS had better tooling

</comment><comment><USER76> Dear "Seattle Woman": while you're in there, please dump Capital One's junk mail database, and set their address label printer on fire.

Sincerely, another Seattle resident with a mailbox.

<comment><USER77> [https://www.optoutprescreen.com/](https://www.optoutprescreen.com/) should handle most of that. Yes, its legit [0].

[0] [https://www.consumer.ftc.gov/articles/0148-prescreened- credi...](https://www.consumer.ftc.gov/articles/0148-prescreened-credit-and- insurance-offers)

<comment><USER78> Sorry not going to hand my SSN over to some random website to opt out from junk mail.

</comment></comment></comment><comment><USER79> Hi all. To anyone concerned that Capital One holds your personal data, you can find out if they do by using our free tool. Hope this helps

Apple [https://apps.apple.com/gb/app/tap-my- data/id1436042237?mt=8%...](https://apps.apple.com/gb/app/tap-my- data/id1436042237?mt=8%20%E2%80%A6)

Android [https://play.google.com/store/apps/details?id=io.taprewards....](https://play.google.com/store/apps/details?id=io.taprewards.app)

And if you're personal data has been involved in the Capital One breach. Find out what steps you should take next (TLDR):

• Change your usernames and passwords

• Keep an eye on your bank accounts and credit report

• Be wary of any emails regarding the breach

[https://tapmydata.com/my-personal-data-has-been-involved- in-...](https://tapmydata.com/my-personal-data-has-been-involved-in-a-breach- what-can-i-do-next/)

</comment><comment> grayed-down I'll be spec'ing a project soon where I think the organization's data should be self hosted. I'm going to show them this piece.

<comment><USER80> A news article is a terrible reason to make engineering decisions.

<comment> grayed-down I single news article, certainly. A handful of news articles, probably. But news articles can be effectively used to support strategic decision making. It's done all the time.

In my case I believe that putting trade secrets on an AWS cloud instance just doesn't seem like a good idea.

</comment></comment></comment><comment><USER81> > She is charged with a single count of computer fraud and faces a maximum > penalty of five years in prison and a $250,000 fine. Her lawyer declined to > comment.

We need to start putting the hammer down on these people; maximum five years, meaning she/he will probably do one year. The US needs to start making examples and these people and increase penalties.

<comment><USER82> I'd rather see the hammer applied to the companies that allow the data to be stolen.

<comment><USER81> From what I read in the complaint, it wasn't as blatantly bone headed as other breaches. Seemed to be an IAM permission issue related to AWS WAF.

This argument is constantly made on HN and it is analogous to; you left your back door open at your house, and instead of arresting and prosecuting the robber, we are going to arrest you. Sure, I made a mistake and left my back door open, but that doesn't give the robber the right to break in and steal my stuff. It is lacking a moral compass and sense of right and wrong. There needs to be consequences for bad behavior.

<comment><USER82> I think it's more like I left the back door of _your_ house open, without ever having permission to access your house, and you got robbed because of that.

I admit the Equifax situation was worse. The people whose data was lost by Capitol One probably at least have some sort of business relationship with that company (for example, they may have applied for a credit card). I had no business relationship with Equifax at all, yet apparently information about me was leaked. I don't buy anything on credit, so I don't give a tinker's damn what my credit score is. Equifax provides no value to me whatsoever, yet I now have to worry about information they collected about me with no authorization from me. I'd like that company to be sued into bankruptcy.

<comment><USER83> The closest analogy would be that you gave me your house key so I could go in and water your plants while you're on vacation (signing up for an account), but someone grabbed the key off my counter because I left my back door unlocked. The folks who had their information leaked in this instance had signed up for accounts with C1.</comment></comment></comment></comment></comment>


The Noob Guide to Online Marketing - <AUTHOR> http://www.seomoz.org/blog/the-noob-guide-to-online-marketing-with-giant-infographic-11928

<comment><USER2> To save time, here are the main points:

Set up your pages for SEO Have a blog Use Adwords Get your name on Twitter & Facebook Submit blogposts to reddit, digg, hn, etc... Create an email list Use Feedburner Monitor, Track, and Test Everything

Nothing groundbreaking.

<comment><USER3> But I think that's the point - there are no shortcuts. It takes persistence, measurement, and a sound strategy to get where you want to go.

<comment><USER4> I agree. If you don't have time to read this and you're starting off then you might want to figure out another career path. This article is great because it truly is a large task list that you can use. A handful of them are a little out there for the average person/startup, but overall I think this is a great list to start with.

</comment></comment></comment><comment><AUTHOR> Question: The article mentions you should guestblog. I know this is important but writing is a chore to me.

I am in the outsourcing space but I find outsourcing writing really hard to outsource because I need someone who can express my ideas or who have a good experience in outsourcing.

Is there a place where I can contact great writers?

<comment> mkr-hn The Problogger job board seems appropriate: <http://jobs.problogger.net/>

<comment><AUTHOR> Found this timely article that mentions it too: <http://maplebutter.com/content-marketing-for-startups/>

</comment></comment></comment><comment><USER5> Great article but it missed the mobile angles. It's exploding and having good mobile working content is more important every day and it's already important. :)

Working on <http://infostripe.com> which gets you online and mobile-friendly in just a few minutes. See others using it here <http://infostripe.com/network.php>

<comment><AUTHOR> I thought you were wrong saying Mobile is important so I went to check my web analytics and noticed that 5% of my visitors are coming from a mobile device.

I thought: "Meh, not worth the effort". And then I looked at the conversions from Mobile users and basically a Mobile user is worth twice a normal Web browser!

I will go on and set up a mobile stylesheet...

Thanks.

</comment></comment><comment><USER6> Excellent overview! Even if one are aware of the basics and/or one choose their own creative way of doing the marketing I really think it is perfect to have the best-practices like this like a roadmap. Even experts will get use of this.

</comment><comment><USER7> I never thought about doing email marketing, since it sounds a lot like "unsolicited email" that I hate to receive. When is it interesting to use, and beneficial to both sides?

<comment><USER8> E-mail is a great way to reach out to certain segments of your consumers. It is useful and beneficial when you are able to communicate information that is of value.For instance, company updates, product updates and offers. The idea is not to push information but to tailor relevant information and use e-mail as tool to build up communities.

As well e-mail is a great tool to test copy. When you do A/B splits to see how you can use certain copy to drive the most action out of that segment.

I would still recommend E-mail over having Facebook Fan pages because it is easier to maintain, less time consuming and communication is easier to control.

Great tool to use for small businesses to publish newsletters/e-mails. <http://mailchimp.com/>

A few other ideas to use e-mails are

1) Trigger e-mails by Sign in. If the user has not accessed their account after x period of time send gentle reminder

2) Trigger e-mails based on birthdays

</comment></comment><comment><USER9> amazing visuals. it renders me incapable of judging the content.

</comment><comment><USER10> Old, but gold</comment>


Argument Parser for Modern C++ - p-ranav https://github.com/p-ranav/argparse <comment><AUTHOR> Why use this over boost::program_options?

<comment> p-ranav Hello. If boost is already part of your workflow, there is probably no reason to switch. boost::program_options is sophisticated and widely used by the community.

If boost is not part of your workflow and you want something lightweight, then here are some reasons (some of these reasons are "in my opinion"): This library is header-only. It's a single header file and you're off. As the README suggests, the ArgumentParser class is easy to use and intuitive. Processing functions can be provided as "action" lambdas in each argument to convert the argument value from raw strings to higher-level objects and aggregates - examples in the README better represent what I mean here. The parser supports parsing and extraction of std::vector<T> and std::list<T> from a list of argument values too.

There are numerous argument parsers for C++ and this post should have been titled "Yet another argument parser for C++" but hey, I've had fun putting this together. If you think it suits your use-cases, you're welcome to try it out and give me feedback. Thanks.</comment></comment>


Ask HN: People programming before 2000: why were 2 digit years a thing? - <AUTHOR> Recently dug out one of my dad's old Apple laptops, and was amazed to find it only supported 2-digit years. And I was around as a young child for y2k, and I've been thinking about it a lot lately.
Specifically: how was it ever a problem? What kind of thinking led to people making software with 2-digit years, even in the late 80s? Did it really save a lot of effort?
The idea of someone sitting down and making the conscious choice to design an OS that uses 2-digit years is hilarious to me, but was there a good reason? <comment><USER2> There were several reasons. One, everybody used two digit years for everything. When writing checks you used two digits. When you saw a date on television or in a book it used a two digit year. So it just made sense.

Secondly there was the idea that it would save space. And really it did. When your computer new out of the box had 3.5 KB available storage, those two extra characters were very important.

And thirdly because computers were new and things were changing so rapidly that everybody assumed everything would be replaced in just a few years. It's a bit difficult to explain, but electronic data was considered a lot "less real" then than it is now. When you switch the computer off it's gone. The idea that digital data would persist for years was difficult to grasp for a lot of people. Floppy disks had a realistic lifespan measured in months and later in years, but single digits for sure. It wasn't until optical drives became commonly available that it was possible for digital personal data to last very long at all.

<comment><AUTHOR> Thanks for your reply. This is an interesting psychological perspective (the other comment offered a technical one) and it makes a lot of sense.

</comment></comment><comment><USER3> To expand on another good comment: space was precious. Really precious. If you were only a kid in the 90s you will have a hard time appreciating it. (But then again ancient UNIX greybeards will say the same to me, I guess...)

For example, my first computer was Apple II. It had 48KB RAM and 12KB ROM which contained initial bootstrap code that corresponds to BIOS, plus a Basic interpreter, plus a REPL tool with disassembler. All of that, in 12KB. The main page of Hacker news is about 42KB, not including icons and HTTP headers: it's already about three times a BIOS+Basic interpreter+disassembler.

And the monitor only had 40x24 lines (or maybe 40x25, it was a long time ago). Nobody's mad enough to waste _two_ columns, out of 40, just to print two digits that will be forever stuck at 19.

As another example, around that time Turbo Pascal was immensely popular, and every string started with a byte showing its length: so no string can be more than 255 bytes. Good enough: what kind of madman would waste precious memory on a string more than 256 characters?

If you go back to that period and think about the environment, using 4-digit years will be considered a madness, not the other way.

<comment><AUTHOR> Thank you very much for your reply. I definitely lack perspective on this. I really sympathize with the reasoning behind not printing a 4-length date on the low column displays.

But I'm still curious about just how wasteful a 4 digit year would've been to use internally (not to display). Wouldn't it only use like extra 2 bytes of memory or less per "date" structure in the memory?

<comment><USER4> I don't have much personal experience in the matter, but I believe it's the mentality of working with very constrained systems, in this case limited memory, storage, processing. It was/is considered efficient and elegant, to shave off any possible unnecessary space or operations.

Those extra 2 bytes meant and "cost" a big deal more than they do now. At least, that's what I imagine is a reason behind the decision to use 2 digits to represent a year.

Future programmers will be asking us too, why we thought it was a good idea to use signed 32-bit binary integers to represent time - when we should have known it would run out soon.

[https://en.wikipedia.org/wiki/Year_2038_problem](https://en.wikipedia.org/wiki/Year_2038_problem)

</comment></comment></comment><comment><USER5> In earlier days of computing, storage was expensive. Saving two bytes for each date field multiplied by thousands of records across hundreds of files saved real money.

Another example of contortion for storage saving was Packed Decimal used in mainframes, where a (say) 11-digit number could be stored in 6 bytes rather than 11. There were even IBM 360/370 assembler math operations for packed decimal so they didn't have to be decided and re-encoded for arithmetic use.</comment>


I am a new dad and here are some startup ideas for you - <AUTHOR>

1. Baby cry detector to activate several things. For example: iPhone app will open and turn on "white noise" to calm down baby. Then milk heater will turn on....
2. Some kind of ceiling projector to show high contrast photos like stars or cartoon characters...
3. Automatic board book flipper, maybe hanging down from the ceiling. So the baby and just keep looking awhile away and no need to hold (which you may accidentally drop on the baby's face).
4. Wholesale of everything bundled: diaper, clothing, wipes... Like a larger version of Costco but you have to buy everything at once and get a discount. <comment><USER2> I've seen number 2 on the market.

<comment><AUTHOR> I have seen some plugin projector to the iPhone. But they are a pain. You really have to make adjustment. Why can it detect the ceiling surface and adjust the angle, tilt, lighting...?</comment></comment>


Ask HN: Does GPT-3 have original thoughts? - <AUTHOR> Is it simply regurgitation of what it's read or can it actually put pieces of information together to make new ideas?<p>Has it been shown to have any insights that aren't directly from what it's been trained on?<p>(Im just trying to sort the hype from the chaff) <comment><USER2> Does you have original thoughts? Are you simply regurgitating what you've read or can you actually put pieces of information together to make new ideas?

How can you prove that any of your or mine ideas are original?

From a previous article:

> _Q: Who was president of the United States in 1620?_

> _A: James I was president of the United States in 1620._

Does it count like an original brilliant idea or an error?

</comment><comment><USER3> It's no more insightful than using Markov Chains. Clever algorithms blend up pre-existing combinations of words and spits them out. Once in a while those words will make sense and might even apply to a useful idea previously unthought of. GPT-x increases the likelihood its output will at least make sense to a human reader.

It still requires a human to determine if its output is useful. The program itself has no practical way of determining if its output (an "idea") is meaningful or useful, let alone novel.

</comment><comment><USER4> It generates words, it doesn't have "insight". If you are looking at it and thinking it got some "insight" it is your brain brainwashing itself.</comment>


Nokia becomes top Windows Phone vendor after just one quarter - <AUTHOR> http://www.bgr.com/2012/02/24/nokia-becomes-top-windows-phone-vendor-after-just-one-quarter/

<comment><USER2> Well isn't it almost the _only_ windows phone out there that doesn't feel experimental and a quick hack job?

I have a lumia and like it a lot better than android, but the screen feels incredibly lo-rez compared to my iphone 4 so surfing the web is a little bit painful. Also the browser is a little bit buggy. But over all a really good effort.</comment>


Ask HN: How to make a digital black box? - <AUTHOR> I've been researching how to make a black box of my digital life.
Currently these are the situations I want to engineer for (with scripts / software tools)
* Suspension of my Google account (emails/photos/ contacts) * Suspension of my Flickr (photos) - not really an issue as I have backups of photos * Suspension of dropbox account * Backup of music (MP3s) * Backup of personal files * Phone gets stolen or destroyed
I have a HTPC (home theatre pc) with Ubuntu Server 18.04 running and sufficient storage.
I want to have it running at home in a secure location (well ventilated).
My first phase I am currently doing, is figuring out how to make it connectable outside ADSL router. How can I communicate with it from a non fixed IP address?
Second phase is synchronising with all trusted devices using Nextcloud self hosted server.
Third phase is to write a script to check for my emails from Gmail or perhaps just use an email client like Thunderbird?
Fourth phase is checking for sending notifications or log events e.g. "Synchronised as of 9:04GMT.", "Low storage.", "96 Duplicate photos removed"
Any suggestions or instructions? <comment><USER2> I'm sure there will be many useful suggestions. Mine are limited to some specific issues:

Power: strongly recommend that you install an intelligent UPS. That is one that can shutdown the server on command once the battery power is below a set threshold.

Non-fixed IP address: the simple solution is to configure one of the many dynamic DNS services. Most firewall/routers have support for this feature.

Internet facing server: Although you can use DDNS, I personally would rather have a well firewalled server doing suitable pull requests.

Gmail: you can configure either LDAP or POP3 and periodically copy down all your emails. POP3 is a bit simpler to set up, whilst LDAP has more features. You could use Thunderbird or simply a suitably configured SMTP daemon.

Duplicate files: the 'fdupes' utility can be very useful. However, I recommend doing a backup before you run it. There are scenarios when a malformed command can delete more than you had intended.

Backups: no matter how much storage you have on your HTPC it would be prudent to configure scheduled backups to external hard-drives which then you store securely, preferably with at at least one set at another location.</comment>


Why does unsubscribing from a newsletter take "a few days"? - <AUTHOR> https://twitter.com/Joe8Bit/status/1156312965265707013 <comment><USER2> I work for a company in a department that sends out on average, 2 million emails a day. These are emails to people who (1 or more):

\- have signed up and are receiving a verification email.

\- are giving us money

\- are using our site at least once a week during the first month, and even if they taper off, are at least using it every 180 days.

So, we're not sending email to people who we've never met, as it were. We have an unsubscribe link in all our emails, and an account email settings page that has about half the mailings we can send as initially subscribed (we like money), but which can be turned off. We even have links to our settings page in the emails and on all the site pages.

I like to think we're being fairly responsible, all in all.

Like I said, we send 2 million emails a day. That goes out on a lot of machines, and we have lots of automation going on nearly every minute, and lots of email queues being prepopulated to send out in volumes acceptable to gmail, outlook, yahoo, etc.

So, you've asked to unsubscribe to the email you received last week. We got you, fam. I analyzed logs and did some live testing using our VPN at offices across the world. Over the past 3 years, you've been removed from your chosen lists within 2 seconds of clicking the button. This obviously doesn't cover hardware/network/server problems.

So we're cool, right? Nope. You're unsubscribed all right. However, we already placed you in the queue for our most recent mailing about 4 hours ago, and you're going to get the last one from us anywhere within 2 seconds from now to maybe late tomorrow.

You really won't get anymore from us after that, though.

<comment><USER3> It doesn't seem that complicated to remove a single entry from the e-mail distribution list of millions that's going out in one to two days. Harder problems have been solved. This doesn't adequately explain it.

The reality: it's financially a waste of time for a company to create an A+ off-boarding experience. Getting 1-2 extra emails isn't the end of the world: it's good enough for the company, you get off the list, they don't have to think about that unprofitable problem any further.

Most companies don't put much effort into off-boarding. Some go out of their way to make it even less palatable. But for removing yourself for a mailing list, I don't consider this to be the worse. Things surrounding payments are much more important: if I cancel service, you better not continue charging me.

Most people don't consider the full lifecycle of anything, and I wish they did. We've created a society, for example, that consumes disposable plastics, as an ordinary daily activity, and that ends up in our waterways as microplastics. It's easy to make things. It's an order of magnitude more difficult to manage the full lifecycle of the thing.

<comment><USER4> The technology behind it all could actually function perfectly but in reality an overworked marketing intern grabs a csv file from their desktop, opens it in Excel, compares and manually removes the unsubscribes (from another csv file that's delivered to them daily by email because that's easier) because "that's how it's always been done around here", then saves it as "June email push (1)(1) copy 2 (1)(1)(1)(1).xls" on their desktop, deletes all their subscriber lists in Mailchimp, as per the usual procedure, and imports "June email push (1)(1) copy 2 (1)(1)(1).xls" from their desktop, and sends out whatever.

<comment><USER5> So much this. These kinds of workflows are far more common than you would think they'd be, looking in from the outside.

This is true even if your company has in-house developers. At the small company I work for, we have barely enough developer bandwidth to cover most things related to our core products as it is. Improving internal support processes just isn't even on the radar for us as a dev team. So those things either get contracted out (where we as a dev team may have limited or no evaluation input with regards to the quality of the solution), purchased (again with little or no input from us as devs) or are built ad-hoc by the less technical side of the business.

Companies have a lot of internal moving parts and resource limitations that together lead to these kinds of things.

</comment></comment></comment></comment><comment><USER6> Let's imagine you use 3 different marketing providers, plus an in-house one, because you're a big company and your teams all want to use whichever tool works best for them.

A user unsubscribes. This creates an entry in one specific system. In order for that to be reflected across all systems, it needs to be copied somewhere central, then synced back out.

Ideally you'd have a webhook hit a Lambda function and call it a day.

But, again, largish company with a gotta-move-fast employee growth mindset, engineering doesn't want to work on it (or, if not a tech company, you don't have in-house engineering).

So you hire some consultants who convince you that your email marketing is a "big data" problem, and they contract out the work on some Enterprise Infrastructure Platform as a Service product (an expensive, slow Lambda). The resulting system is slow, and often breaks, and you run it every few days in one bulk load/unload.

Poor engineering is why it takes a few days.

<comment><USER7> If they don't want to make it easy to unsubscribe me immediately I just report it as spam. Hopefully that goes into Gmail's whatever "big data" of spammers and starts getting them classified as spam across the entire network.

<comment><USER8> Why not simply always report as spam? I have a zero strike policy with spammers. I'm not going to even try your "unsubscribe" link. You're going to get marked as spam if you're spamming me, and I'll have the satisfaction of knowing you're 0.000001% more along the way towards not being able to have your emails received.

<comment><USER9> If I subscribed, I'll try to unsubscribe. That's just fair.

If the newsletter appeared from nowhere, then yes, it's spam.

<comment><USER8> Yea, and it's insulting to even call it "unsubscribe" since I did not subscribe in the first place! The word itself subtly tries to shift blame onto the victim, as if it's their fault they are getting spammed.

<comment><USER10> Like those Robocalls that leave you a voicemail featuring someone clearly reading from a script, intimating that they're "returning your call" about something you know for a fact you never called about?

Go away Janice, I don't need an extended vehicle warranty, and no I didn't contact you for information.

</comment></comment></comment></comment></comment></comment><comment><USER11> One of the problems with unsubscribing is that I've seen a LOT of marketers re-using old lists and importing me back into a new list from some obscure snapshot, often with names like "new-list-feb-2019". There's no guarantee that, even when I unsubscribe from a given list, the company hasn't already exported my email address to some CSV file for future marketing efforts.

<comment><USER12> Or the linkedin approach of "oh, you opted out of featured posts and featured comments on featured posts but we've just invented a new category of "your three hop connections commented on a featured post" and you're included

</comment></comment><comment><USER13> This is an awesome story.

Oh, and in case you're wondering how they did (similar) things in the Good Old Days(TM), let me tell you a story from the late 70's/early 80's.

I subscribed to "Cycle" magazine in my youth, and due to mistakes on their part, for a couple of years I got two copies, and when I finally decided to unsubscribe, I got only one copy a month (but for another year).

My mother had written to them to unsubscribe me (it was a recurring birthday present).

My first year of college I wound up meeting a guy in the magazine subscription business, and told him my story, and told me how it worked.

Turns out that they got a LOT of mail at the (US) publisher. So they had a machine with a gripper that grabbed each letter, held it while a grinder ground off (!) three edges of the letter, and then put it on a conveyer belt. One person was tasked with folding the top page of the envelope back so the letter was revealed, and a few people (IIRC) took them and put them in boxes, taping the letter back together (!) when part had been ground off with the edge of the envelope.

These boxes of letters were then sent to Ireland (!) to be processed, where people entered what should be done on some kind of mainframe application, which then cut 9-track tapes that were sent back to the US for processing.

Told this to my Mom, with the delightful result of seeing her collapse in tears of laughter.

</comment><comment><USER14> The actual reason is that CAN-SPAM dictates that an opt-out must be honored within 10 days. [1]

[1] [https://www.ftc.gov/tips-advice/business- center/guidance/can...](https://www.ftc.gov/tips-advice/business- center/guidance/can-spam-act-compliance-guide-business)

<comment><USER15> CAN-SPAM is US only and doesn't allow for a "REALLY REALLY want to unsubscribe?" confirmation email.

</comment></comment><comment><USER16> I've always assumed that the answer is that due to the way email works, mail can, in certain (rare) situations, end up stuck in a queue somewhere between mail servers and not delivered until a couple days later.

Saying that unsubscribing takes a few days means that in the off-chance that this happens, the sender has some coverage against annoyed users who have one of these mails delivered after unsubscribing.

But this is just my guess.

<comment><USER17> I'm sure that's some of it, but it's also a result of lists being pulled ahead of time. Imagine you have 100,000 subs and 10,000 of them are going to get promotion A and then another 15,000 (with some overlap) promotion B. Often, the lists are pulled before the content is ready. Sometimes getting the final approval on marketing emails takes a bit, and so the person who unsubbed when they got email A are already on the list for email B.

<comment><USER18> As someone who works in email I've never used a platform that's not using real-time lists or segments. A business could certainly do it this way but it would be a lot more work and a lot less effective.

<comment><USER17> I'm not saying it's best practice. I'm just describing some things I've seen.

</comment></comment></comment></comment><comment><USER19> Nice story of enterprise life. But personally, I still apply strict standards - if your unsubscribe link doesn't unsubscribe immediately, then you are spam, and will be marked and treated as such.

<comment><USER20> Pretty tough when it's your bank. I get marketing phone calls from Bell all the time trying to sell me on more TV channels. Joke's on them - I don't even own a TV! I tell them every time they call, they say thank you, and I get a call from them again every four weeks or so.

<comment><USER21> For most big banks/institutions, important account emails are usually sent from a different domain than marketing campaigns. YMMV though.

<comment><USER22> I don't think I've ever had a single marketing email from my bank (cahoot), tbh.

</comment></comment></comment></comment><comment><USER23> It's because of permissions there's different databases, plus most importantly the drop lists are usually keyed up 48 hours in advance (you have to do in advance because of all the checks you have to do, etc.). They can take you out of the main but you're probably in some drop lists that have already been send to the provider -- that's why they say a few days/72 hours.

</comment><comment><USER24> At least in India some companies sell/leak their user email list to others; those others also cultivate these details from domain names, company registration etc; & then fake or referred-link emails on genuine companies' name (with or without Genuine Company's consent).

I got bombarded with 35+ emails every day few years back; & documented it at [https://gitlab.com/davchana/gmail-indian-spam- domains/blob/m...](https://gitlab.com/davchana/gmail-indian-spam- domains/blob/master/readme.md)

Unsubscribe link click marks your email as live/hot; & gets them a higher price everytime it is clicked by you & then sold by them as fresh hot.

<comment><USER25> I don't click on "unsubscribe". My standard procedure is to look up the sending IP-Address in WHOIS and send a note to the operator's abuse address. The good ones take reports about unsolicited mails seriously, and the bad ones end up on blacklists.

Based on the responses I (rarely) get, I've helped boot a few spammers from their servers by providing evidence to the operator.

</comment></comment><comment><USER26> At my company, we prepare one-off marketing and legal email blasts in advance, and need the final recipient list a couple days before sending. This allows time for processing the list for opt-outs, duplicates, etc.

<comment><USER27> That sounds like O(minutes) processing time with a reasonably written program/indexed db and a few million subs? And I'm sure you could get it to be faster than that. Based on all these comments, it frankly sounds like the real answer is that no one gives enough of a shit to do this right.

</comment></comment><comment><USER28> I would say because

* This gives cover in case it takes a bit of time. Better to promise a few days and do it sooner than vice versa.

* Letting people go is, in general, bad for business so hasn't been optimized.

* Multiple systems are involved, increasing complexity.

</comment><comment><USER29> I think this is the first time that I have preferred to read something as a long twitter thread instead of as a single blog post.

Seeing the explanation go on and on and on without a clear indication of how close we are to the end enhanced the kafkaeske atmosphere.

</comment><comment><USER30> So often I assume a process is totally automated, but a lot of the time I should be more empathetic, because there is a person in the loop and they are usually just trying to keep the system they inherited from blowing up. They have no time to fix it.

This illustrates something that I think a lot of us in the "computer industry" often misunderstand. We see a mass email system (or anything happening at scale) and assume the whole thing is automated, because that's how we would do it.

Too often a system is cobbled together, only barely works, and is only semi- automated. Even something that is 99% automated but generates thousands of actions per day ends up creating a high workload for a human.

I've even seen where my email address was clearly hand-typed from a form (not even copy/paste), because I usually sign up for website accounts using Gmail's plus feature. I created an account at Website A with the address "firstname.lastname@example.com" and then received an email a day layer sent to "firstname.lastname@example.com" which Gmail still delivered because they ignore everything after the plus sign. The only way that error happens is if someone typed it by hand. [Plus emails are a great way to find out which companies sell your info to spammers. Most of the time nobody bothers to run a regex to fix "plus" addresses into the original address, so the evidence of data selling ends up right in the email header.] I feel sorry for the person that is eventually going to have RSI because they hand-type the entire list from their web form into their email software.

</comment><comment><USER31> What's with the large number of 'unroll' requests to some bot in that thread? Can't they just click the first response from it?

</comment><comment><USER32> In our case we often have people write or call our global support number and request they be unsubscribed. They don't have that ability be they create a ticket. That ticket gets sent along and eventually winds up in an admin's inbox. That's why it takes a few days.

</comment><comment><USER33> > marketing team in Swindon

Presumably this refers to Nationwide Building Society, then.

</comment><comment><USER34> This was a decade or so ago, but we used to get a list of ~2 million email addresses that we'd import into a new database and a single mailing would take anywhere from 2 to 3 days to complete. Sometimes it would take us a few days to get to it though.

The one to two weeks lead time always made a lot of sense to me.

(And yeah, you don't need to tell me how horrible everything about that process is... but it worked and no one's motivated to fix it. I wouldn't be surprised if that's the same process they're using today)

</comment><comment><USER35> Creating a Mailchimp (or similar) account and using that for your newsletters doesn't take much effort and would be so much more efficient than the mess described.

Why are big and medium companies usually such a mess?

Is it because the bigger the company the less people care?

Maybe it's that the complexity and discipline required is simply too much for the average human?

Maybe companies do not have or are unwilling to invest the needed resources? (which ironically creates more waste)

<comment><USER23> Giving over your list to a third-party provider like Mailchimp can be a risk. One thing most publishers is more protective over than anything else is the database. Also, Mailchimp just isn't ideal for high volume mailings/companies who do this as a revenue generator. It's designed more for the mom-and-pop operations.

<comment><USER35> Ok, Mailchimp was a bad example (we actually use Sendgrid for our newsletters) but my point was about using a service that solves this for you instead of having such a convoluted process.

</comment></comment></comment><comment><USER36> The reason it takes a few days is because the next mailshot you're going to be getting in the next couple of days will be sent out by some third party to list of email addresses which was exported to a csv file and sent unencrypted to their gmail account yesterday.

</comment><comment><USER37> I came across this if you are using Gmail, pretty efficient: [https://ctrlq.org/code/19959-gmail- unsubscribe](https://ctrlq.org/code/19959-gmail-unsubscribe)

</comment><comment><USER38> I suspect the bank they are talking about is most likely Nationwide.

They are based in Swindon. I am quite surprised their in house tech is this bad because their online bank account is one of the better ones.

</comment><comment><USER39> I used to work at an email service provider that managed email marketing campaigns for some pretty large companies. It's been quite a number of years now, but I don't imagine things have changed all that much.

Mostly, it's just CYA language because of the way the various old and slow systems work, plus the CAN-SPAM act legally allows up to 10 days to process an unsub.

There are multiple checkpoints that prune lists as they get churned through the machine, so typically you'll be fully unsubbed within 24 hours (often much less), but they don't catch all cases at all times.

The abbreviated process for sending out a marketing campaign at a large ESP typically looks like:

\- Marketing manager makes a request for a list of people that match x/y/z analytics criteria (e.g., purchased within last x months, typically opens email, geographic region, etc). Depending on how "sophisticated" the criteria are and how backed up the analyst department is, this may take a couple of days to get turned around.

\- The list of addresses is created and then pruned down by known unsubscribes or other do-not-email constraints in the system at the time the query runs.

\- The resulting list gets sent out for review and approval by the marketing manager and client (how many people are we going to mail, what is it going to cost, what sort of metrics do we expect, etc). Since this is a human-in-the- loop process, it may again take up to several days to turnaround.

\- After approval, the list gets churned through the unsubscribe list again, dropping any new unsubs. This step _should_ catch new unsubs within that "it may take up to few days" window mentioned in the title.

\- The final list is then queued up for sending, which depending on the size and meter rate may go out over the course of several hours. If you've already been queued up your unsubscribe request is typically going to get missed for this run.

Now, add on the complexity of syncing up multiple databases between the ESP and the customer, which is typically a nightly batch job at best. So even though your unsubscribe hit some web server instantly, it may take a couple of days for it to fully filter through from the web server to the client's marketing databases into the ESP's database. It's similar to why banking and ACH is so terrible: it's just ancient design patterns and slow process and nobody wants to pay money to modernize it. And if they miss a few unsubs they are still well within the legal bounds so it's whatever.

tl;dr: A lot of email marketing still runs on chains of batch jobs which can introduce windows of unsynchronized lists getting sent out.

<comment><USER23> It 100 percent is still this way. But generally your queued list can be set up 1-2 days beforehand, so that's why it's often 48-72 hours, because you're already in that list that's been cleaned at the provider for drop.

</comment></comment><comment><USER40> The next campaigns' subscriber lists are compiled in advance whilst being drafted.

</comment><comment><USER35> Off topic, but god I hate the new Twitter for desktop.

<comment><USER41> Why they use twitter for what I think would fit way better in a short concise blog post is beyond me.

<comment><USER42> You get a lot more eyeballs posting directly on Twitter than posting an external link. Sharing, liking, commenting are all one tap away.

<comment><USER35> Yes, but it's hard to follow branching conversations in Twitter unlike Reddit or HN.</comment></comment></comment></comment>


Things Hardly Anyone Knows About Nike - <AUTHOR> https://www.businessinsider.com/history-of-nike-facts-about-its-50th-anniversary-2014-11 <comment><USER2> There's a best selling book on all of this called Shoe Dog. You can't walk through an airport without seeing it. How is this "hardly anyone"

<comment><AUTHOR> That's just the title of the article, as conceived by its author, not me. Did not know about "Shoe Dog". Sounds like a good book suggestion... will check it out...</comment></comment>