evenwicht

joined 2 months ago
MODERATOR OF
 

cross-posted from: https://lemmy.sdf.org/post/22571649

According to 15 U.S.C. 7704 §5(a)(5):

INCLUSION OF IDENTIFIER, OPT-OUT, AND PHYSICAL ADDRESS IN COMMERCIAL ELECTRONIC MAIL.—

(A) It is unlawful for any person to initiate the transmission of any commercial electronic mail message to a protected computer unless the message provides—

(i) clear and conspicuous identification that the message is an advertisement or solicitation;
(ii) clear and conspicuous notice of the opportunity under paragraph (3) to decline to receive further commercial electronic mail messages from the sender; and
(iii) a valid physical postal address of the sender.

When my text-based mail client receives an HTML-only email message, it tries to render the HTML as text. It’s sometimes a jumbled up unreadable heap of garbage because the HTML is malformed and relies on a forgiving/tolerant rendering engine. Even when the HTML is proper and standards compliant, links are not exposed to text rendered. E.g. a msg will say “to unsubscribe and stop receiving emails, update preferences here.”

Where is “here”? That is just raw text. Sure, an advanced user can do a number of things to dig up that link. But I doubt that would pass the legal standard of “clear and conspicuous”.

Anyone have confidence either way whether HTML-only spam is legally actionable on this basis?

 

According to 15 U.S.C. 7704 §5(a)(5):

INCLUSION OF IDENTIFIER, OPT-OUT, AND PHYSICAL ADDRESS IN COMMERCIAL ELECTRONIC MAIL.—

(A) It is unlawful for any person to initiate the transmission of any commercial electronic mail message to a protected computer unless the message provides—

(i) clear and conspicuous identification that the message is an advertisement or solicitation;
(ii) clear and conspicuous notice of the opportunity under paragraph (3) to decline to receive further commercial electronic mail messages from the sender; and
(iii) a valid physical postal address of the sender.

When my text-based mail client receives an HTML-only email message, it tries to render the HTML as text. It’s sometimes a jumbled up unreadable heap of garbage because the HTML is malformed and relies on a forgiving/tolerant rendering engine. Even when the HTML is well formed, hyperlinks are not exposed in the text rendered. E.g. a msg will say “to unsubscribe and stop receiving emails, update preferences here.”

Where is “here”? That is just raw text to me. Sure, an advanced user can do a number of things to dig up that link. But I doubt that would pass the legal standard of “clear and conspicuous”.

Anyone have confidence either way whether HTML-only spam is legally actionable on this basis?

(update) I should mention the most annoying offenders-- corporate senders (e.g. banks) that attach a plaintext MIME part, but then the motherfuckers use it to just say (in so many words) “You need to update your software”. This makes it extra difficult to see the content of the message because the text mail client of course shows the text MIME part by default.

 

Some banks have started demanding proof of address when they realize that the address they have on file is “commercial”, e.g. like a UPS Store PMB type of address. How would this play out in court? The law¹ states:

“(i) Customer information required—(A) In general. The CIP must contain procedures for opening an account that specify the identifying information that will be obtained from each customer. Except as permitted by paragraphs (b)(2)(i)(B) and (C) of this section, the bank must obtain, at a minimum,the following information from the customer prior to opening an account:

  1. Name;
  2. Date of birth, for an individual;
  3. Address, which shall be:
    (i) For an individual, a residential or business street address;
    (ii) For an individual who does not have a residential or business street address, an Army Post Office (APO) or Fleet Post Office (FPO) box number, or the residential or business street address of next of kin or of another contact individual; or …
  4. Identification number, which shall be: …

(emphasis mine)

Banks seem to be over-reacting to law that is more lenient than what banks are interpreting. Not only are business addresses allowed, but a bank customer can even supply someone else’s address. The law also seems to distinguish between old customers and new. Yet out of the blue banks are harrassing customers who have had an account for years. They have a gov-issued ID doc and SSN, yet suddenly the banks get anal and persnickety about the address to the extreme of freezing people’s accounts as databases grow (DBs that track the zoning an address is in).

Has this been challenged in court? It’s clear from the linked thread that customers either dance for the banks or get their accounts frozen. It could be hard to challenge in court since banks can demand whatever info they want even if not required by law. But if they suddenly close an account that has been established, that could cause damages to the customer.

One interpretation is that legislators intended the business address to be that of the customer’s workplace. But the law does not seem to specify that.

¹ 31 C.F.R. § 103.121

[–] evenwicht@lemmy.sdf.org 1 points 2 weeks ago* (last edited 2 weeks ago) (1 children)

Accounts and digital assets seem directly applicable to assets held.

And? Holding assets does not in itself trigger tax. Esp. how they are held. Whether your $100 is in a banknote or $100 in gold coins or Second Life game money, or $100 in a cheese wheel, in the absence of a transaction there’s no tax to speak of.

W.r.t accounts, it’s just foriegn accounts they want to know about, not domestic accounts. Walk me through the tax difference between the two (not interest, not cap gains, just having the account).

Occupation sounds like it could have to do with tax credits, if you’re in something that’s subsidised.

If that’s the case, that’s declared on a form that actually has effects on figures, which is not what I’m talking about. That would be an enumeration with a code that discretely assigns an activity from a list to an outcome. If you look at the signature box of the 1040, that’s just a freehand field. You can write “contractor” there or any number of vague things without affecting subsidies. I’m specifically talking about information that does not affect the figures.

Residence is weird but in the opposite way, because usually countries don’t tax residents abroad. 'Murca is the exception there, although I don’t know all the exact details.

Residence indeed affects the figures (whether you are inside or outside the US), but that’s already accounted for by the forms being submitted and the data on them. When a form arbitarily has a field for country of residence and that field in no way affects the figures, it’s extraneous info. Just a data collection that makes no difference to the bottom line. I just had a look at the 1116 form. Whether you write USA or Japan on the residence field makes no difference whatsoever in the in the calculation. You can write anything on that line and it does not change the calculation AFAICT.

[–] evenwicht@lemmy.sdf.org -5 points 2 weeks ago* (last edited 2 weeks ago) (3 children)

Off the top of my head I recall questions about the taxpayer’s occupation, whether foreign bank accounts are held by the taxpayer and whether any digital assets are held. I think some forms (1116, perhaps) ask for country of residence but IIRC this has no influence on the calculations.

 

Some tax forms ask information that seems to have no effect on the bottom line. No matter how you answer the question, your tax bill is the same either way. In Europe, this sort of thing would violate the data minimization principle of the GDPR. So the question is, what happens to people who either leave the intrusive fields blank, or they give bogus info? I’ve heard that tax penalties are generally a constant × the amount of underpayment. If underpayment is zero then so is the penalty, correct?

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago* (last edited 1 month ago)

It’s not a binary statement. it’s a measure of proportions. So my statement was factually correct. Cloudflared banks are quite rare in Western Europe, for example. I actually cannot think of any off the top of my head. Step into the US, and credit unions are mostly pawned by Cloudflare. It’s a shit show. Hard to find non-Cloudflared CUs, which is an artifact of shoestring-budget funding.

I heard someone talking about a European bank that was considering using Cloudflare and it was met with protest. The bank backed off the idea. In the US people don’t give a shit.. they don’t even notice. There’s a bit more blind trust for big corps.

[–] evenwicht@lemmy.sdf.org 0 points 1 month ago* (last edited 1 month ago) (2 children)

Cloudflare is mostly a US thing. Banks outside the US are a bit more competent¹ in this regard. But there are thousands of banks and CUs in the US and I only need one in the end. The problem is the Discover network narrows the choice down to a tiny fraction of banks. So I’m looking for an intersection of two small sets. If I can find one that functions offline and does not charge extra for paper statements that might be good enough.

¹ (edit) Guess I should clarify. A website that has good security does not rely on the crude practice of DoSing based on IP reputation. If an admin believes they can protect a website by using arbitrary guesswork about IP addresses, that’s alarming because the kind of criminals that should be in their threat models as threat agents would be in control of botnets that give them countless normal residential IPs. Use of Cloudflare is a sign of a poorly secured bank because it suggests they don’t have good enough security to protect from malicious traffic regardless of IP address. Also: not my problem. As a non-clearnet user, I am nixing banks that cannot serve me. That means they must either serve Tor users or they must work offline.

 

I hope this question doesn’t piss anyone off.. it was censored on lemmy.ml.

I’m looking for 3rd-party banks that issue debit cards for use on the Discover / Diner’s Club network. It’s quite rare. Visa, Mastercard, and AmEx are more common and easier to find, but I have a number of objections to those companies. Discover is a clear lesser of evils. This is what I know from past and present searches:

If I overlooked any please mention it (even if it’s Cloudflare, just to know the options). It’s a paltry list considering there are thousands of banks and credit unions nationwide.. and I only found 9.

True Value hardware used to have a Discover credit card but discontinued that in 2020.

There’s some chatter that Capital One may acquire Discovercard. It will be a shame if that happens, but the upside could be that more 3rd-party Discovercards emerge from it.

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago* (last edited 1 month ago)

I asked them in writing. It will be interesting to see if they comply.

To be clear, the purpose of the post is to understand the law (the forum being !law_us) because I want to fix this problem for everyone not just myself. I believe these digital rights abuses are so rampant because so few people step up to the plate to fix the problem for everyone. Most people just pragmatically fix the problem for themselves and move on. I want to understand the law to get an idea of the legal actionablity so that I can work out whether I have a pathway to force the CU to make their workflow with all customers legally compliant -- which would be a process I can recycle with other similar data abusers (other banks).

I blame Taylor Swift, telling people to “shake, shake, shake it off…” instead of fighting back.

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago* (last edited 1 month ago)

When I visit the opt-out website and it simply prints on the screen “403 Forbidden”. No reason given¹. No recourse given. That is not giving opportunity. When they conceal the URL from some demographics of people, that is also withholding an opportunity to opt-out.

Let’s suppose the opt-out procedure were completely disclosed and fully transparent. Suppose they sent a properly formed email that reveals the opt-out procedure to everyone (inluding those with text-based MUAs). If they were to outright state something like “you must use our preferred network (clearnet, not Tor, not VPN, not CGNAT), you must share your personal IP address with a 3rd party with no expectation of privacy, and you must solve a series of CAPTCHA tests after traversing our cookie wall.” That would still be giving exclusive opportunity. IOW, not everyone has opportunity, just those who are both willing and able to dance for them. When strings are attached to the opt-out, that “opportunity” is conditional. I believe the law would have to specifically state that conditional opportunity is permissable. Otherwise the only valid interpretation of law (IIUC) is that the opportunity be unconditional. Hence my question.

If you believe arbitrarily conditional opportunity is lawful, what’s your limit? What if the procedure requires driving to a remote location, crossing a river with crockodiles, and running through an area with snakes and scorpions in order to reach a form (written in a blend of Mandarin and Apache) that you must fill out requesting an opt-out? Would you still regard that as giving opportunity?

¹ When I say that they are blocking people who are on the Tor network, that is merely my guess. A “403 Forbidden” can manifest for many reasons and in this case the site does not state why a 403 was pushed. But regardless of their undisclosed reason, when they lock someone out of their gate, it is of course denying opportunity to opt out.

 

My credit union has been spamming me for years. As the volume of their bulk junk mail increases, I’m looking for a way out. Their email is HTML-only. So my text mail client only renders the raw text “To unsubscribe and stop receiving emails click here”. And “here” is obviously just text because it’s a text terminal.

Is that legal?

Suppose it is. So I dissect the HTML and fish out the link from a heap of garbage. The link does not go to the credit union’s website (if it did, that would be a non-starter anyway because I canceled my web account when they started blocking Tor). The link goes to a 3rd party site which also blocks Tor. So apparently as a precondition to opting out of spam I must share my personal IP address with a 3rd party agent of spam. Perhaps I can play whack-a-mole with a series of VPNs but I’m not interested. I just want to know if the opt-out procedure can legally be exclusive in this way. Can a legal challenge be mounted that forces them to provide an opt-out mechanism that’s inclusive?

The legal text is this:

(ii) clear and conspicuous notice of the opportunity under paragraph (3) to decline to receive further commercial electronic mail messages from the sender;

I don’t know the legal meaning of “clear and conspicuous”, so I’m not sure if nesting it in HTML satisfies that requirement. But it’s strange that they must merely give notice of the opportunity to opt-out, apparently without actually giving the opportunity to opt-out (just notice thereof IIUC).

[–] evenwicht@lemmy.sdf.org -1 points 1 month ago* (last edited 1 month ago) (1 children)

Javascript clients aren’t good for that. Lemmy/kbin/mastodon nodes vanish all the time without warning. All your posts: gone. JS has no practical way to integrate local storage, thus no historic content when a server vanishes.

Not to mention as well that web UIs tend to force you to use a mouse, which is a slower workflow.

8
submitted 1 month ago* (last edited 1 month ago) by evenwicht@lemmy.sdf.org to c/debian@lemmy.sdf.org
 

Has anyone found a Debian client for Lemmy? I’m really surprised nothing exists yet and wonder if my search skills are just lacking. This is what found:

  • lemoa is non-Debian, and dying
  • neonmodem is non-Debian, and crashes
  • nnreddit is non-Debian, and only rumored to be getting ported to activitypub; the repo for that project is a broken website for me

(Non-debian just means they are not in the Debian repos, not that they don’t work on Debian).

 

Just wondering if anyone has managed access Lemmy from emacs in any way. Theoretically, this may be feasible:

emacs (gnus) → nnreddit → lemmy

But I’ve not heard anything solid about whether nnreddit has been adapted to interface with a lemmy server. This bug report has been open for the past year:

https://github.com/dickmao/nnreddit/issues/90

OTOH, the project moved to a website that’s broken (at least, for me it’s broken).

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago

I refuse to do online banking entirely because the websites have become so shitty. And I will not touch non-FOSS smartphone apps. So I only bank offline. And yes, I get screwed because most banks charge a fee for paper statements. So my options are very limited.

If you are offline you can probably still invest and have savings (in the US, not sure about Europe) but I would expect that to be quite costly. I think manual trades with human involvement are like $20 per trade or so in the US. That’s really the most fucked up part of this. If offline consumers had equal rights in terms of pricing, it would be fair enough and the online options would have pressure to be less shitty.

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago (2 children)

I think it’s hard to find a bank that doesn’t require a phone.

It really depends on where you are. The US has over 6000 banks to choose from, so the highly competitive region somewhat helps. You probably could find some small town rural banks in the US that will open an account without a phone number. In some parts of Europe they insist on having a mobile number. But what some people do not know is EU banks cannot refuse a request for a “basic” bank account. I don’t think all banks offer basic accounts, but when they do, the application form does not even have a field for a phone number. Just name, address, and date of birth.

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago* (last edited 1 month ago) (1 children)

I’m in a city where the furthest points of the city are reachable in less than 45 min on the bicycle. I took public transport for years. The commute time on public transport was about the same as cycling. This is because cycling is door-to-door. Public transport requires walking to/from the stations on both ends. That walk takes triple the time on foot than on bike. Then you have to wait, and possibly wait again at a transfer point. So that overhead time makes the door-to-door trip the same as cycling. Tram stops are also frequent enough that if I am cycling next to a tram, I pass the tram every time it stops at a stop. The trams average speed side-by-side seems to be only slightly faster than cycling. Also figure that cyclists get more direct routes, one-way streets are two-way to cyclists, and cyclists have traffic immunity and strike immunity.

A 1 hr public transport commute should not be a 2 hr cycle. I’m not sure what crazy circumstance would cause that. Unless you live next to a heavy-rail train with just ~2-3 stops.

If a city is as big as London, then I could see cycling losing the avg race against public transport because the overhead time becomes less significant over long hauls. But you can still control where you work and live to organise your situation to shrink the city, in effect.

[–] evenwicht@lemmy.sdf.org 1 points 1 month ago* (last edited 1 month ago) (3 children)

I used the proprietary apps for public transport back in my pre-Google boycott days and indeed they were quite useful for last minute changes on unfamiliar routes. Then public transport started blocking Tor which broke their app. But I eventually realised public transport is not the way forward anyway.

I switched to a bicycle (more independance and autonomy, better for the environment, better for health [not just exercise but less viral exposure], much more privacy, and cheaper). So if your travel is in cycling range or you can make it so, it makes more sense to ditch public transport entirely.

Public transport is getting increasingly more privacy hostile. More and more networks refusing cash payments, transitions to SMS tickets, more surveillance & facial recognition, more tracking, and despite all that privacy compromise in the end you are still less safe than cycling due to viruses and the unavoidable possibility of attacks (though that’s city-dependant to some extent.. some cities are rough cycling).

view more: next ›