Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Krebs on Microsoft Suspending "Patch Tuesday" Emails and Blaming Canada

samzenpus posted about 4 months ago | from the who's-to-blame dept.

Canada 130

tsu doh nimh writes In a move that may wind up helping spammers, Microsoft is blaming a new Canadian anti-spam law for the company's recent decision to stop sending regular emails about security updates for its Windows operating system and other Microsoft software. Some anti-spam experts who worked very closely on Canada's Anti-Spam Law (CASL) say they are baffled by Microsoft's response to a law which has been almost a decade in the making. Indeed, an exception in the law says it does not apply to commercial electronic messages that solely provide "warranty information, product recall information or safety or security information about a product, goods or a service that the person to whom the message is sent uses, has used or has purchased." Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.

Sorry! There are no comments related to the filter you selected.

Blame Canada! (5, Funny)

BenSchuarmer (922752) | about 4 months ago | (#47351749)

Seems like a no brainer

Re: Blame Canada! (2)

irbeginner (3412409) | about 4 months ago | (#47351761)

Yeah. With their flappy heads and stuff.

Re: Blame Canada! (0)

Anonymous Coward | about 3 months ago | (#47352965)

That "stuff" is called beady eyes. Turn in your SP card please.

Happy Monday from The Golden Girls! (-1)

Anonymous Coward | about 4 months ago | (#47351753)

Thank you for being a friend
Traveled down the road and back again
Your heart is true, you're a pal and a cosmonaut.

And if you threw a party
Invited everyone you knew
You would see the biggest gift would be from me
And the card attached would say, thank you for being a friend.

Re:Happy Monday from The Golden Girls! (1)

jargonburn (1950578) | about 4 months ago | (#47351955)

I should know better than to feed the trolls....but I just don't get this "Happy Monday from The Golden Girls" thing.
I've seen it a few times on various articles (maybe not always "Happy Monday"). I guess I could Google it, but that seems like a lot of work for something as unimportant as this.
*shrug*

Re:Happy Monday from The Golden Girls! (1)

ganjadude (952775) | about 4 months ago | (#47352081)

no more work than posting that post. on the same note im with you, i just dont get it. now sharks with frickin lazers on the other hand....

Re:Happy Monday from The Golden Girls! (1)

mjm1231 (751545) | about 4 months ago | (#47352171)

I have no desire to learn more about any Golden Girls fanfic where Bea Arthur has retired from the Russian space program, either.

Re:Happy Monday from The Golden Girls! (0)

Anonymous Coward | about 4 months ago | (#47351993)

It's supposed to by 'confidant' not 'cosmonaut'

Re:Happy Monday from The Golden Girls! (1)

Anonymous Coward | about 4 months ago | (#47352399)

Being that Bea Arthur looks a lot like like Brezhnev, cosmonaut is appropriate here.

Re:Happy Monday from The Golden Girls! (0)

Anonymous Coward | about 3 months ago | (#47353379)

it's COFFEE POT, nothing else makes sense.

Blame Canada (-1)

Anonymous Coward | about 4 months ago | (#47351757)

With a title like that you're just asking for it. [youtube.com]

Email is expensive? (2)

fahrbot-bot (874524) | about 4 months ago | (#47351759)

Several people have observed that Microsoft likely is using the law as a convenient excuse for dumping an expensive delivery channel.

Wait, what? I thought Email was cheap, 'cause, you know ... spam.

Re: Email is expensive? (0)

Anonymous Coward | about 4 months ago | (#47351775)

Welcome to corporate finance.

Re: Email is expensive? (1)

NatasRevol (731260) | about 4 months ago | (#47352405)

Somebody is accountable for bandwidth expense.

I doubt it's trivial at this level.

Re:Email is expensive? (5, Funny)

Penguinisto (415985) | about 4 months ago | (#47351869)

I thought Email was cheap...

It is unless you use Exchange server farms to send it. Then it's gawdawful expensive.

Re:Email is expensive? (1)

X0563511 (793323) | about 4 months ago | (#47352219)

I can't imagine Microsoft has to pay Microsoft for Microsoft products. Accounting may want them to move the money around, but that's stupid and pointless because it doesn't actually cost them money to give it to themselves.

Re:Email is expensive? (1)

jeffmeden (135043) | about 3 months ago | (#47352547)

I can't imagine Microsoft has to pay Microsoft for Microsoft products. Accounting may want them to move the money around, but that's stupid and pointless because it doesn't actually cost them money to give it to themselves.

If the cost license doesn't get you, then the compute cycles, ram allocations, and administrators' salaries will... /troll

Re:Email is expensive? (1)

X0563511 (793323) | about 3 months ago | (#47353257)

Ah, derp - I didn't consider the resources involved, just licensing.

Re:Email is expensive? (1)

Anonymous Coward | about 3 months ago | (#47352577)

You really have no idea how budgeting, and accounting and divisions and tax laws and outsourcing works. Got it. Now, for the rest of us, on the triplicate recieving end of notifications that we aren't going to patch till the weekend, this is still slightly good news. Breaking a stick off in some lawmaker while shrugging your shoulders is just funny.

Re:Email is expensive? (2)

weszz (710261) | about 3 months ago | (#47352583)

sure it would... the salary of the people doing the work to move money around and account for it.

A few months ago I put a request into the company I work for asking for a $20 piece of software (against policy to buy it and install it myself, gotta go through the process...)

Looking at the process, it would have cost thousands in employee time to document, review and approve the purchase of the $20 piece of software at all the different levels of management involved in it. it's insanely wasteful.

Re:Email is expensive? (1)

Anonymous Coward | about 4 months ago | (#47351889)

Sending email is cheap. Paying off the people to get it to show up in people's inbox isn't.

Re:Email is expensive? (0)

freeze128 (544774) | about 4 months ago | (#47351891)

Email requires bandwidth, and you can't distribute it through a CDN like you can with downloads. It's cheap for spammers because they anonymize their email, but security notifications say they come from microsoft.com. Now consider that you have BILLIONS of emails to send. That can get costly.

Re:Email is expensive? (1)

jeffmeden (135043) | about 3 months ago | (#47352571)

Email requires bandwidth, and you can't distribute it through a CDN like you can with downloads. It's cheap for spammers because they anonymize their email, but security notifications say they come from microsoft.com. Now consider that you have BILLIONS of emails to send. That can get costly.

Why can't you distribute it via a CDN, exactly? I mean someone like Microsoft has either direct control over, or actually runs their own CDN servers: firing up a SMTP service (to route mail based on proximity to destination MX) should be the easy part.

Re:Email is expensive? (0)

Stan92057 (737634) | about 3 months ago | (#47352937)

its cheap for spammer because they steal others bandwidth/computers/servers. 100,s and thousands of automatically made yahoo accounts/google/MS and so on to send there junk. MS is pissed they can add in an email buy win 8 or buy from one of our trusted 3rd party partners. Which they already think its there god given right to spam. Thank AOL for this at the very end advertisements were in every email you got from a friend or business.

Re:Email is expensive? (1)

bob8766 (1075053) | about 3 months ago | (#47352999)

Combine this with the fact that they have all of the email infrastructure in place already to support message delivery for Hotmail and Exchange Online, and it does literally cost them almost nothing to deliver these messages which are a tiny drop in a huge ocean of mail they deal with. I'm inclined to think that email cost has anything to do with it.

Re:Email is expensive? (1)

mythosaz (572040) | about 3 months ago | (#47353317)

Most spam is sent from "legitimate" ISPs on pink contracts.

Real world spam (1)

sjbe (173966) | about 3 months ago | (#47353043)

Wait, what? I thought Email was cheap, 'cause, you know ... spam.

No, you're confusing email with the US Mail spam delivery system. The whole thing is subsidized by spam you can actually throw in the trash can.

Re:Email is expensive? (0)

Anonymous Coward | about 3 months ago | (#47353121)

you know, i just don't get this...
*what* skeevy sites are 99% of you visiting that you have a *real* 'spam' problem ? ? ?
(NOT an 'imaginary' spam problem, which is that you get ANY non-zero spam at all...)

i'm online a lot, and while i visit a basic set of websites regularly, i also smoosh on other links all the time that take me to a lot of different sites...
why don't i have 'tons' of unacceptable spam like you guys -evidently- do ? ? ?
i have LOTS of stuff that i specifically signed up for, but other than that, i get hardly get any spam, and nothing that i can't get through with hardly an eyeblink...
i don't get it...
spam just *isn't* a 'problem', it just isn't...
(this is across a couple different email address, work and home, and i just don't get my inbox clogged with spam; what are you guys doing to get unacceptable amounts of spam ? ? ?)

Just visit the website? (0)

Anonymous Coward | about 4 months ago | (#47351791)

https://technet.microsoft.com/en-us/security/advisory

Are calendars with recurring reminders a thing anymore?

You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.

Of all the things to bitch about with respect to Microsoft...

Re:Just visit the website? (1, Flamebait)

Jeff Flanagan (2981883) | about 4 months ago | (#47351949)

>You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.

Yes, because that's something normal people routinely do...or you're totally disconnected from reality, but just smart enough to realize that you're stupid, so you posted as an AC.

Re:Just visit the website? (1)

aevan (903814) | about 4 months ago | (#47352005)

So it's the new 30k oil change then?

Re:Just visit the website? (1)

Anonymous Coward | about 4 months ago | (#47352059)

"Normal" people don't routinely read emails about Microsoft's security updates, either.

Re:Just visit the website? (1)

ganjadude (952775) | about 4 months ago | (#47352095)

normal people no, but to the people these are targeted to, it should be trivial to set up

Re:Just visit the website? (1)

Penguinisto (415985) | about 4 months ago | (#47352135)

https://technet.microsoft.com/en-us/security/advisory

Are calendars with recurring reminders a thing anymore?

You can even setup a cronjob or a windows task to open the website on a regular basis if you are extra forgetful or lazy.

Of all the things to bitch about with respect to Microsoft...

Because, you know, the typical small businesses are overflowing with IT-wizard-like employees who are masters at using these things, and hold the process in high enough regard to keep an eye peeled for patches.

Oh, wait, they aren't.

Re:Just visit the website? (1)

Shakrai (717556) | about 4 months ago | (#47352315)

Because, you know, the typical small businesses are overflowing with IT-wizard-like employees who are masters at using these things, and hold the process in high enough regard to keep an eye peeled for patches.

A business that can't be bothered to keep competent IT most likely has automatic updates turned on, even for their servers, thus the e-mails to them would be redundant. Businesses with competent and dedicated IT people are most likely using WSUS, which provides its own mechanism to get e-mails about newly available updates, as well as total control over when and where they're installed.

Conspiracies, please. (1)

Anonymous Coward | about 4 months ago | (#47351843)

OK, what's the real reason for this? It's obviously not the law, and it's obviously not the cost associated with sending out e-mail - if you think ASCII e-mail is a bloated bandwidth hog, you should try watching the average HTTP transaction.

So, here's my conjecture: they are initiating a corporate policy of phasing out e-mail in favour of... something with more lock-in. Just like they wanted to show that they were so hip-against-the-desktop and in favour of walled garden app stoers that they tried to phase out the Start menu.

But what is the alternative they are planning over which they are prematurely beginning their masturbatory fantasy of full control?

Re:Conspiracies, please. (1)

datapharmer (1099455) | about 4 months ago | (#47351881)

RSS.

Re:Conspiracies, please. (2, Interesting)

Anonymous Coward | about 4 months ago | (#47351951)

Specifically,

Basic Alerts: http://technet.microsoft.com/en-us/security/rss/bulletin
Comprehensive Alerts: http://technet.microsoft.com/en-us/security/rss/comprehensive
Security Advisories Alerts: http://technet.microsoft.com/en-us/security/rss/advisory
Microsoft Security Response Center Blog Alerts: http://blogs.technet.com/b/msrc/rss.aspx

Re:Conspiracies, please. (1)

X0563511 (793323) | about 4 months ago | (#47352269)

I don't suppose there's a way to get a feed for only the products you care about?

Re:Conspiracies, please. (0)

Anonymous Coward | about 4 months ago | (#47352003)

That's not a reason to abandon e-mail. Many think RSS is a horrible kludge, me included. And some just prefer e-mail.

Re:Conspiracies, please. (0)

tepples (727027) | about 4 months ago | (#47352039)

RSS and other HTTP documents can be cached on a proxy at the border. Mail can't so easily, especially with spam filters breaking large Bcc lists. If you prefer mail, write a proxy that polls RSS feeds and sends mail when one changes.

Re:Conspiracies, please. (0)

Anonymous Coward | about 4 months ago | (#47352153)

especially with spam filters breaking large Bcc lists

Limiting number of RCPT TO lines is a fucking awful way to handle spam, and explicitly discouraged by RFC 2821:

              The minimum total number of recipients that must be buffered is 100
              recipients. Rejection of messages (for excessive recipients) with fewer
              than 100 RCPT commands is a violation of this specification. The general
              principle that relaying SMTP servers MUST NOT, and delivery SMTP
              servers SHOULD NOT, perform validation tests on message headers suggests
              that rejecting a message based on the total number of recipients
              shown in header fields is to be discouraged. A server which imposes a
              limit on the number of recipients MUST behave in an orderly fashion,
              such as to reject additional addresses over its limit rather than
              silently discarding addresses previously accepted. A client that needs
              to deliver a message containing over 100 RCPT commands SHOULD be
              prepared to transmit in 100-recipient "chunks" if the server declines to
              accept more than 100 recipients in a single message.

In any event, consider ten million subscribers. That's 100,000 copies pushed out per month. If each e-mail were 200k in length, we're talking 20 gig a month. if you think that's a significant dent in Microsoft's bandwidth budget, you're crazy.

Re:Conspiracies, please. (1)

tepples (727027) | about 4 months ago | (#47352393)

Under a strict interpretation of that RFC, how should filtering of abusive mail be accomplished at all?

Re:Conspiracies, please. (0)

Anonymous Coward | about 3 months ago | (#47352485)

Please highlight specifically what in the RFC you're referring to.

Also, if you want, assume the unrealistic worst case scenario: 1 mail per RCPT line, so we're now talking 2 terabytes a month. I, as an individual of reasonable means can afford that with beer money, and I don't have any peering agreements with anyone.

Re:Conspiracies, please. (0)

Anonymous Coward | about 3 months ago | (#47352511)

200k? Their GIF header/footers are probably bigger than that.

10M subscribers? Probably 10x that amount.

Assuming only one email sent per month? Ludicrous.

Re:Conspiracies, please. (0)

Anonymous Coward | about 3 months ago | (#47352885)

1) Pictures don't have to be embedded in HTML e-mail;

2) Anyway, didn't even realise you could receive security alerts in HTML format. Plaintext, please. In fact, the idea of an HTML e-mail full of pictures for distributing security advisories is pretty horrendous, so if they want to switch to plaintext-only, that's fine with me;

3) OK, 10x, and 10 RCPT lines per e-mail. That's 2 TB/month. Still spare change for me, let alone Microsoft;

4) For the monthly security alerts, mails are sent, on average, I would say... once a month. If you include out of band updates for operating system software, twice a month.

Re:Conspiracies, please. (2)

nabsltd (1313397) | about 3 months ago | (#47353151)

Limiting number of RCPT TO lines is a fucking awful way to handle spam, and explicitly discouraged by RFC 2821:

All that says is that you should not reject the message based on the number of recipients. You can, however, temporarily reject (using a 4xx status code) recipients after some set number. Any good MTA will retry the tempfails.

I currently have a variation of this in place where any e-mail to a "special" address (like postmaster or webmaster) can't have any other recipients at my mail server. Right now, it's a log-only rule, and hasn't been triggered very often, but I wanted to make sure I don't reject or filter messages to those addresses, but I also don't want them to be used to allow unfiltered spam to be sent to everyone else in the domain.

OTOH, if the e-mail is a bounce (defined as from ""), I do reject it if it has multiple recipients, directly in violation of the RFC portion you quote. The is because a bounce is to notify the sender that something went wrong, and it's impossible to have more than one sender.

Suck my dick (-1)

Anonymous Coward | about 4 months ago | (#47351899)

Your mom does and likes it, so maybe you should try too

Re:Suck my dick (1)

dysmal (3361085) | about 4 months ago | (#47351929)

Clearly school is out for the summer and the kiddies are bored.

Solitaire is to blame not Canada (1)

Anonymous Coward | about 4 months ago | (#47351849)

The average game lasts three minutes, three games a day. That's about 10 minutes lost productivity a day. 200 days a year that's 2000 minutes, or 34 hours a year. That's an entire work-week (FR) spent playing solitaire, each year. Blame it on the rain? Canada? No! Blame Microsoft!

they might be right. (5, Interesting)

nimbius (983462) | about 4 months ago | (#47351939)

for the windows crowd: Unix Linux and BSD sending and receiving an email is pretty mundane business (even to millions of people.) Sendmail begat postfix, which tidied up the nuts and bolts of SMTP in the land of penguins neckbeards and that cartoon blowfish you occasionally see.

sending email from Exchange is orders of magnitude more complex by the nature of Exchange as a monolithic communications product. Because exchange does scheduling, calendaring, contacts, unified messaging, failover management, automatic load balancing, remote configuration management, archival, database storage, advanced RBAC permission delegation and cool stuff like shadow redundancy, outlook servers themselves have become increasingly divorced from the RFC for the SMTP. It isnt a bad thing for businesses that rely on being constantly connected, but it does mean the simple act of sending an email means relying on what for us would be an OS in itself. Exchange 2013 requires 2 gigabytes of free disk and recommends 16 gigabytes of free RAM. To compare and contrast, many in the BSD community can handle millions of messages per day with 2 gigabytes of ram and 1 gigabyte of free disk. that includes storage for the message being sent.
I think microsoft is doing this because exchange wasnt designed to just "send an email" anymore. it expects interactivity, redundancy, and universal access to the information being sent by default. the *nix solution runs hard and fast, but as an SMTP implementation requires significantly more engineering to provide the same level of service and feature set as outlook.

Re:they might be right. (1)

Richard_at_work (517087) | about 4 months ago | (#47352041)

You don't need to install Exchange to handle mail on a Windows box, the included SMTP, POP and IMAP services work fine.

Re:they might be right. (0)

Anonymous Coward | about 4 months ago | (#47352057)

Oh, you *nix kids and your fancy email implementations....

Why on earth would they use Exchange to do such a task? Exchange is a product aimed at corporate users, not customers. They would just use some flavor of their SMTP service and a program of some sort to pump the messages into it.

Also, no matter how many sendmail servers you have you can't get around the fact that egress still takes bandwitdth. And they are working at a little higher scale than the "watch me nerd out more than you" listserv.

Re:they might be right. (1)

Dishevel (1105119) | about 4 months ago | (#47352317)

Oh, you *nix kids and your fancy email implementations....

Why on earth would they use Exchange to do such a task? Exchange is a product aimed at corporate users, not customers. They would just use some flavor of their SMTP service and a program of some sort (Perl. Perl fixes everything.) to pump the messages into it.

Also, no matter how many sendmail servers you have you can't get around the fact that egress still takes bandwitdth. And they are working at a little higher scale than the "watch me nerd out more than you" listserv.

Re:they might be right. (0)

Anonymous Coward | about 4 months ago | (#47352071)

Bullshit. This is exactly the type of real-world environment they should be load testing Exchange with. If Exchange can't send email efficiently what good is it? This is an even better environment than REPY ALL because you have real servers across the planet that may greylist you, timeout, etc.

Microsoft should have no issues tuning for this environment.

Re:they might be right. (0)

Anonymous Coward | about 4 months ago | (#47352419)

I just read this a couple days ago, and /. editors, and the submitter got blasted for coming up with imaginary conspiracy against MS.

Laughable how many people believe MS is the savior of everything, and never makeup bulls**.

FOSS Calendaring, Contacts etc. (1)

Dr. Evil (3501) | about 3 months ago | (#47353029)

Most FOSS people I know just gave up waiting for good calendaring/contacts etc, and use Gmail and Android.

Twitter? Windows Update? Fools (0)

Anonymous Coward | about 4 months ago | (#47351961)

Is there no reason they couldn't just use Twitter?

And besides, isn't this solved by Windows Update? Why are they sending email at all? Shouldn't Windows Update just tell you 'Hey, Idiot, you have a patch to install' like every other piece of software does these days?

Haven't they heard about Help-->About-->Check for Updates?

Amateurs

Fail whale (4, Insightful)

tepples (727027) | about 4 months ago | (#47352013)

Is there no reason they couldn't just use Twitter?

Using RSS instead of Twitter allows Microsoft not to rely on the single point of failure that is Twitter Inc.

And besides, isn't this solved by Windows Update?

For one thing, having thousands of PCs in a company individually download multi-megabytes updates from Windows Update wastes the bandwidth compared to use of WSUS. For another, some administrators prefer to test Windows patches before deploying them because Windows patches some are known to break programs that inadvertently rely on underspecified behavior.

Re:Fail whale (0)

Anonymous Coward | about 3 months ago | (#47353133)

Fair enough, both excellent points. I was not thinking of corporate clients (I was instead focusing on single user use-cases), and also realize that yes, Micro$oft wouldn't want to rely on another company to disperse communications. But still, this smells, since the legislation specifically has a loop hole designed to protect companies informing customer's about software updates via email.

It is Canada's fault! (4, Informative)

Anonymous Coward | about 4 months ago | (#47352009)

Canadian IT head here. Just spent the morning reading over the law that this is in knee-jerk reaction to. I think Microsoft's reaction is warranted. According to the new law, a company can be charged up to 10 Million dollars for an infraction (read single email) of un-solicited email. The law is poorly formed, and not well thought out, as well as lengthy and vague enough to create a broad swatch of culpable people.

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable. Also if you install software on someone's computer without explicit, but easy to understand examples of what the software is/does you can also be held culpable.

All email a company produces in Canada form this point on have to include a link in the bottom or ability to opt out of all future email.

Canadian businesses, no matter how small, are beholden to this law. Small companies are going to fold left and right because they cannot afford to comply wiht the new regulations, and those that don't try to comply run the risk of paying a huge penalty.

In my personal opinion this is a grab at trying to make Canada Post relevant again (and financially viable). At the moment bulk mail is the only thing keeping Canada post afloat, and if you couldn't send an email to try to drum up business, you can always send a mailer...

While anti-spam law is well intentioned, in it's current form it is so broken it should not have seen the light of day.

Re:It is Canada's fault! (2)

XanC (644172) | about 4 months ago | (#47352079)

Thank you!

The summary makes me want to laugh and cry at the same time. So the people who wrote the law don't think there are any costs of compliance? I'm sure that's not news. That right there is a HUGE problem with government solutions.

Re:It is Canada's fault! (0)

Anonymous Coward | about 4 months ago | (#47352113)

Seriously?

You think the anti-spam laws which people have asked for are a ploy to boost Canada post?
Conspiracy theory much?

"Canadian IT head here. Just spent the morning reading over the law that this is in knee-jerk reaction to. "

So are you speaking on behalf of all Canadians, as in you are the head of IT for Canada?
Is the fact you spent the morning reviewing a complex law important to your point?

Were you part of the review process for CASL and therefor are speaking from authority/direct involvement?

Let me guess, your company sends what can be considered "spam"?

Re:It is Canada's fault! (1)

Anonymous Coward | about 4 months ago | (#47352389)

Nope, neither I nor my company send the spam. No I wasn't on the CASL. Just trying to give a perspective from someone in the IT field who's clients are about to have to change their business practices, not just the spammers but ALL business using email as a point of contact with their clients AT ALL. So as an IT person in Canada who does contract work with small businesses my load is about to significantly increase, and my clients profitability (regardless of whether they use email to self promote) is about to dive. For some, not using email at all, will be a better business practice than the cost of compliance.

I am not saying the goal of reducing spam is bad, in fact I agree an opt in system would make more sense, but unfortunately businesses have had this law sprung upon them, with little warning, and the penalties for infraction are huge. Of course people want less spam, but, since the law became public people have been extra-inundated with email from everyone they have ever done business with asking them to opt-in to all future email correspondence.

On the Canada post thing, not I don't really believe that is the main drive behind the move, but if you read through the law, it certainly seems like it is trying to shut down the major competition. Even if that isn't the intent, that will be a major outcome. That's why I thought it relevant.

mod up (1)

ganjadude (952775) | about 4 months ago | (#47352125)

interesting take on things, and i can see why they would be concerned. a 10 million dollar fine for a single email? if they are sending tens of thousands of them out, even 1 goes to the wrong address and bam. thanks for the insight, wish i had mod points

Re:mod up (0)

Anonymous Coward | about 4 months ago | (#47352299)

Read the rules, it is a simple three point process

http://fightspam.gc.ca/eic/site/030.nsf/vwimages/ThreeThings_toThinkAbout_large-eng.jpg/$file/ThreeThings_toThinkAbout_large-eng.jpg

Re:mod up (0)

Anonymous Coward | about 3 months ago | (#47352469)

This was not an easy link to find, thanks for the heads up, and while this does simplify the ruling greatly, it is, according to the fine print "intended to provide a plain language explanation of SOME of the requirements under the act".

At a potential 10 mil per mistake are you comfortable with SOME?

Re:mod up (0)

Anonymous Coward | about 3 months ago | (#47353243)

how was it hard to find?

I used google for the term "CASL", I then clicked the first link (GC site) and the info is on the bottom of the page.

As for "comfortable with SOME"...
If i was responsible for sending "mass email" i would follow this law more closely, and have an opinion from someone with authority to provide one.

PS - you know the draft for this came out in 2011 right?

Re:mod up (0)

Anonymous Coward | about 4 months ago | (#47352357)

And sadly, intent, specifically for this law, does not matter (since that was found too difficult to prove). Even a company sending a mail to the wrong address by mistyping it can get the fine.

Re:It is Canada's fault! (2, Insightful)

Anonymous Coward | about 3 months ago | (#47352461)

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable.

Good! That is the definition of spam. Spammers should die.

And this Canadian law is completely irrelevant to most mailing lists.

To get on a mailing list, you have to submit your email address, then they send a confirmation message, then you have to click the link in the email to confirm that you actually want the messages.

That is clear consent. And many mailing lists require you to reconfirm every 6 months or so.

Also if you install software on someone's computer without explicit, but easy to understand examples of what the software is/does you can also be held culpable.

What, you think just because you paid for the computer you think it belongs to you? The computer belongs to apple/google/microsoft and they can install software on it whenever they feel like it.

All email a company produces in Canada form this point on have to include a link in the bottom or ability to opt out of all future email.

Pretty much all email from responsible companies have been doing that for years.

So in summary, there is nothing in this Canadian law that applies here.

As a "Canadian IT head", you're an idiot, or a troll.

Re:It is Canada's fault! (0)

Anonymous Coward | about 3 months ago | (#47352725)

Cost of compliance? How hard is it to provide a *real* opt-out ability in a commercial e-mail, rather than one that gets ignored or that guarantees you get onto the "more spam" list because it is confirmation the mail is read by a human? If you can't support the ability to do tracking to figure out who does and doesn't want those e-mails, then you shouldn't be in the business of sending out mass e-mail AT ALL. If you can afford to send out mass e-mails, then invest in the tools to track recipients or !@$#%! off. If you can't afford the cost of compliance to provide your business e-mail recipients with a choice about receiving further messages, and do it diligently, then don't send the message.

There are also clear exceptions for matters of warranties, security updates, and the like.

And to keep Canada Post relevant? It is to laugh. It is because people are fricking fed up with spam, and said so loudly, frequently, and angrily to regulators years ago. It was a concession to give plenty of time for businesses to figure out the technical process. The last couple of months I've already started receiving messages with the proper opt-in links at the bottom, and I've already opted-in to a few of them from businesses that I deal with regularly. I'm also glad for the ones where I haven't opted-in, which will hopefully treat my lack of response as a correct sign that I don't want to receive more of their messages. That's a lot less hassle then trying to contact them all individually and say "no thanks", or running the risk that any response is only going to get you back on the list. The rest of the ones that don't even provide that choice can burn in spammer hell for all I care. I have ZERO sympathy for them.

Re:It is Canada's fault! (1)

GrubInCan (624096) | about 3 months ago | (#47352743)

Modded Informative?

This guy is informative: http://www.michaelgeist.ca/con... [michaelgeist.ca]

You'll note that "The law also includes a three-year transition period that ensures that as long as an organization already has implied consent, it has until 2017 to upgrade to an express consent"

Re:It is Canada's fault! (2)

ZombieBraintrust (1685608) | about 3 months ago | (#47352985)

Thats the thing. Microsoft did not have implied consent. Thats was this announcement means. They likely have no record of who consented to be on this mailing list. I bet they simply have a list of of email addresses in a db somewhere. When you ask to be on the list they add you and then delete the email. When you ask off they remove you and delete the email. If they want to do an maililng list they have to start from scratch and keep better records.

Re:It is Canada's fault! (1)

Anonymous Coward | about 3 months ago | (#47353321)

If they want to do an maililng list they have to start from scratch and keep better records.

Flat out wrong.

Microsoft could just send an email to everyone asking them to click to confirm that they still want to receive the messages. Microsoft could have been doing this in the emails they sent over the last several months.

The LISTSERV (http://en.wikipedia.org/wiki/LISTSERV) email list software package has had this feature for more than a decade. It would be trivial for Microsoft to do this if they wanted to.

So, there is some ulterior motive here, and it has nothing to do with this anti-spam legislation.

Re:It is Canada's fault! (1)

Mashiki (184564) | about 3 months ago | (#47352767)

"Upto" is the key wording. Remember this is the key point in case law, especially for setting abuse precedents. And it's sure not going to cause small companies to fold left and right. If it does, the business is already doing something wrong, and thriving off of bulk spam in the first place. What this is, is an extension of the DNC, and since we're moving in a direction of tossing mail to the wind--especially with companies now charging between $1 to $8 for a bill to be physically mailed, I'm sure you can see where there is a problem.

But let's be realistic, if Canadapost can operate Purolator with a massive positive income, where are they going wrong at operating their letter carrier service. If anything, their latest stunt of pushing people to corner-boxes and no home delivery is what's simply going to kill them faster.

Re:It is Canada's fault! (1)

cdrudge (68377) | about 3 months ago | (#47352943)

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable.

Easy solution: don't email people that you don't have reasonable proof that they explicitly opted in sometime in the previous 2 years. I can't think of too many situations where a 2+ year old lead would be valuable from a marketing standpoint without a more recent business relationship.

Re:It is Canada's fault! (1)

ZombieBraintrust (1685608) | about 3 months ago | (#47353227)

That is exactly what Microsoft has done. They likely have poor records for this massive list. The list also no longer serves a marketing purpose as they can't include advertisements for services and still be exempt. So they canned it. RSS was the cheapest replacement.

Re:It is Canada's fault! (1)

cdrudge (68377) | about 3 months ago | (#47353443)

They could have easily complied with the law by sending out a non-advertisement security-related email saying that if they wished to remain on the mailing list they would need to explicitly "opt-in" to the list again, (re)confirming their desire to receive the emails. At that time they could either specify that the newly reconfirmed opt-in list might receive security AND/OR advertisements, or make the list security only without plugging any of their products/services.

Re:It is Canada's fault! (0)

Anonymous Coward | about 3 months ago | (#47353149)

What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable. Also if you install software on someone's computer without explicit, but easy to understand examples of what the software is/does you can also be held culpable.

Why would Microsoft be sending me security updates if I didn't ask for them? Is Microsoft buying lists of e-mail address that fell off the side of a proverbial truck from shady characters?

All email a company produces in Canada form this point on have to include a link in the bottom or ability to opt out of all future email.

IIRC, the same is true of the CAN-SPAM Act that the US passed in 2003: there needs to be an IRL address in the message, and an unsubscribe mechanism as well.

Re:It is Canada's fault! (1)

ZombieBraintrust (1685608) | about 3 months ago | (#47353313)

It isn't about reality. It is about what Microsoft can prove in court if you decide to sue them. Can they prove to a judge or jury that you consented to the email you recieved?

Re:It is Canada's fault! (1)

Garfong (1815272) | about 3 months ago | (#47353195)

Based on the number of "please click here to continue getting our newsletter" messages I've been getting in my inbox, other companies don't seem to think the sky is falling.

Re:It is Canada's fault! (0)

Arker (91948) | about 3 months ago | (#47353615)

"What it boils down to is this. If you send an un-solicited email to someone you have not done business with in the last 2 years, and they have not opted in before and, and they believe your email to be spam, boom, you are culpable."

Sounds good to me. If you are spamming you should be culpable. I'd prefer to see public hanging brought back as the punishment, but failing that, a fine big enough to matter is not a bad idea.

Any periodic e-mails should be RSS feeds (2, Insightful)

iamacat (583406) | about 4 months ago | (#47352019)

This law or not, any recurring e-mails are spammy. E-mail should be reserved for one time interactions like order confirmations and of course personal communication. With RSS feeds, user can unsubscribe, suspend and resume viewing updates at their convenience.

Re:Any periodic e-mails should be RSS feeds (3, Funny)

Anonymous Coward | about 4 months ago | (#47352127)

What the fuck is RSS?

Re:Any periodic e-mails should be RSS feeds (1)

ZombieBraintrust (1685608) | about 3 months ago | (#47352527)

What the fuck is RSS?

RSS is just markup. A simple rss feed is just a an xml document you host like a web page that contains a list of items. Each item having a title, description and pubDate with rss as the root of the document.

Re:Any periodic e-mails should be RSS feeds (0)

Anonymous Coward | about 3 months ago | (#47352567)

What the fuck is RSS?

I think it's some kind of repetitive strain injury.

(And on the off chance that you're serious, let me Google that for you [lmgtfy.com] .)

Re:Any periodic e-mails should be RSS feeds (1)

jbmartin6 (1232050) | about 4 months ago | (#47352213)

Why is it better to have to maintain a whole separate infrastructure of servers, protocols, and clients, when basic email does the job just fine? I can unsubscribe, suspend, and resume at my convenience now, I don't see why we would need another delivery channel. You could just as well say that interested parties should just go to the website when they want to know something.

Re:Any periodic e-mails should be RSS feeds (1)

DarkOx (621550) | about 3 months ago | (#47352955)

Its not another channel its just a XML document on a webserver (pretty sure MS already runs a number of those)

The law is to blame, not MS. (1)

Anonymous Coward | about 4 months ago | (#47352033)

MS's emails may not be exempt, for example a security notice for an XP security hole suggesting users to upgrade from XP to windows 8, even if it's only a time component of the email, would not be exempt, and they could face a $10 million fine. Per email. Furthermore, the onus is 100% of MS to have documented proof they had consent to send the email if they are charged.

The law is horrible, how many spam emails are actually coming from Canadian companies? Less then 1%? It will be legitimate businesses that get hit with this, meanwhile it's business as usual for actual spammers.

Re:The law is to blame, not MS. (0)

Anonymous Coward | about 3 months ago | (#47353439)

why do you think the law targets "canadian companies" sending the spam?

International law is complex but often has provisions to allow some stuff like this to fly (spamming canadians in violation of canada laws).

Timeline (4, Insightful)

ZombieBraintrust (1685608) | about 4 months ago | (#47352053)

The Canada Anti Spam Law requires very specific opt in from the people recieving emails. It requires that certian content not be in the email. It has fines. Microsoft is going to have to train its people and change its templates. It is going to have to get its emails approved by Canadian lawyers. It will take time for it to get in complience of the law. But the deadline is tommorow. So they will RSS feeds instead. It is very easy for an expert to say the emails are exsempt to the press. But I bet if you showed them a few emails they would find a few problems. Things Microsoft needs to fix or get fined.

Re:Timeline (1)

taustin (171655) | about 4 months ago | (#47352109)

Or maybe this is Microsoft admitting that they, as a corporation, are simply incapable of passing up an opportunity to shove advertising down people's throats, largely because they have no desire to do so.

Re:Timeline (0)

Anonymous Coward | about 4 months ago | (#47352225)

Or maybe this is XYZ admitting that they, as a corporation, are simply incapable of passing up an opportunity to shove advertising down people's throats, largely because they have no desire to do so.

Replace XYZ with your favorite villain company: e.g, Google, Apple, Facebook, Sony, Netflix, Amazon, Microsoft, etc

Re:Timeline (0)

Anonymous Coward | about 3 months ago | (#47353565)

Or maybe you're a fucking moron that shouldn't be allowed to breed.

NSA... (0)

Anonymous Coward | about 4 months ago | (#47352105)

Probably told MS not to tell security IT's about new updates so they have more time to exploit them.

Great for RSS adoption. (2)

mbourgon (186257) | about 3 months ago | (#47352505)

I automated this a while ago, using Powershell to query the RSS feed, pull out the details, and send the proper parties an email if there's a new message relevant to us.

It probably seems like reinventing the wheel, but allowed us to split out the emails to relevant for each group, rather than one monolithic email. Which meant each affected party was liable to actually read it.

Overall though, anything that shows how useful RSS is, is a good thing.

Canadian here... (0)

Anonymous Coward | about 3 months ago | (#47352769)

Most of my contacts have already sent out message of the type "new law coming, please reply to opt-in".

My guess is that Microsoft was asleep, left it too late (law goes into effect tomorrow, Jul.1) and decided to skip it rather than trying to hustle.

Email expensive? (1)

khb (266593) | about 3 months ago | (#47352775)

"dumping an expensive delivery channel"....

Aside from the $CDN potential fines, just how is email *expensive"?

RSS is the right way! (1)

DarkOx (621550) | about 3 months ago | (#47352861)

RSS is the right way. Distributions lists for notifications of this type have been done with mail historically because it was there not because it was a good medium.

Consider if you use e-mail for this sort of thing you need to take care of several functions e-mail does not itself take care of:
*allow people to subscript
*allow people to unsubscribe
*scrub you mailing lists for dead addresses.

Your mail servers might be stuck with large disk queues waiting on dead domains where the MX server does not answer etc too because well that his how mail works. All of these things are not as simple as they first appear. Do you remove an address the first time you get a 500 error? Because some admins server sends an improper error code, then a bunch of users start screening about how they signed up and never get their news letter.

With RSS you just put the link out there, you don't have to manage your subscribers. You don't have to provide any unsubscribe function users can take care of themselves. You if anything from your web logs get better feedback about how often the messages are viewed because you can assume people pulling the feed actually receive it and that its not just getting filtered off to junk/spam folders.

I applaud this action (1)

Dishwasha (125561) | about 3 months ago | (#47353457)

How easily people forget and get in to a comfort zone. When Microsoft first announced switching to a patch Tuesday email, everybody on /. criticized them for waiting up to a week to announce 0-day vulnerabilities and patch information.

A once a week email is close to worthless. It's better to leave vulnerability notification to people who are serious about it and stop wasting Internet bandwidth, cycles. and storage.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?