Hacker Newsnew | past | comments | ask | show | jobs | submit | iamacyborg's commentslogin

Why shouldn't they? There's plenty of scenarios where you might want to swap images after a period of time has elapsed, or to fix a mistake.

The ability to swap images but not text seems arbitrary.

You could imagine a system more like the notification tray on iOS/Android where at any time a notification can appear, be edited, timeout, or be deleted.

Your email inbox could be like that. The email saying "Your parcel has been dispatched" could be edited to say "Your parcel has been delivered".

When you refund something you've bought, the original purchase receipt could be crossed out or hidden. When you get invited to a wedding but then the wedding is cancelled, the original invite could be deleted, etc.


It's counter to the principle of what e-mail is. It's supposed to be static. Just because you can doesn't mean you should.

> It's supposed to be static.

Says who? It's not in the original RFC as far as I'm aware.


I'm pretty sure the original RFC (RFC 821) does not include remote resources and it was written far before HTML or HTTP was invented.

It was text delivered over SMTP.


specifically to prevent this kind of tracking

This is why SVG isn't supported well for email clients.

https://www.caniemail.com/features/html-svg/


A CRM for the tattoo industry.

https://www.pencild.co


So, is the breach for substack users or for people who subscribed to substack users’ newsletters?

As far as I know, it only contains users who have made Substack profiles. Regular subscribers don't seem to be included, though I could be wrong.

> On the other extreme you can tell an agent "make me an app that's Facebook for dogs" and it'll make so many assumptions about the architecture, code and product that there's no chance it produces anything useful beyond a cool prototype to show mom and dad.

Amusingly, this was my experience in giving Lovable a shot. The onboarding process was literally just setting me up for failure by asking me to describe the detailed app I was attempting to build.

Taking it piece by piece in Claude Code has been significantly more successful.


You think government staff just use whatever software they want?

I’m not sure the world needed yet another CMS

It doesn't. The person is saying they built just the functionality they needed. Probably 25% of a CMS. That's the point.

Exactly.

And the big advantage for us is two things: Our content marketers now have a "Cursor-light" experience when creating landingpages, as this is a "text-to-landingpage" LLM-powered tool with a chat interface from their point of view; no fumbling around in the Webflow WYSIWYG interface anymore.

And from the software engineering department's point of view, the results of the work done by the content marketers are simply changes/PR in a git repository, which we can work on in the IDE of our choice — again, no fumbling around in the Webflow WYSIWYG interface anymore.


This is the benefit few understand properly. The storage layer is where you get a lot of benefits.

This fails under CASL (Canadian Anti Spam Law) where transactional mail is required to provide an unsub mechanism. A lot of senders likely don’t bother personalising those emails based on recipient country.

There must be some nuance to this - e.g. I just double-checked a bank 2FA email from a bank that only has Canadian operations, and it doesn't have an unsub mechanism. I don't know how an unsubscribe mechanism for a 2FA email that you get after entering a correct password would even function.

The unsub would only be for marketing emails, not for transactional ones, even if included in the transactional email.

Maybe it’s ok to email a person after they click a button that says “mail me my 2fa” code? Not a lawyer but it feels right that if I say it’s ok to send me a one off email explicitly, it can omit an unsubscribe

I don't think I've ever seen a button that says "mail me my 2fa code". The workflow basically always goes like this:

1. I enter username/password and click "sign in". 2. Agorithms run on the server. 3. If the algorithms think "suspicious" I'm redirected to an "enter your emailed code" page and automatically send me an email.

In any case, the top of this thread was specifically referring to this type of transactional email.

Taking a quick look at my email history, I have a whole pile of transactional mail (from Canadian entities) with no unsubscribe links: a bank email notifying reception of a complaint, a bank email about my paycheque saying "You received this mandatory email alert to update you on transaction details", various order confirmation emails for things I purchased online, etc.


I see them all the time. Usually it’s in the form of “choose your 2FA method” and it gives you a choice between SMS/email/phone call or whatever.

If you’re letting it access websites then presumably it’s open to prompt injection from those sites you’re accessing? I guess the attack surface is reduced if it doesn’t have access to anything useful beyond that.

Google API scopes for email are pretty restrictive, which is generally a good thing from a security perspective.

Retrieving e-mail using the Google API is just about trivial. You can generate a code snippet in Grok or what have you in about 30 seconds to do it.

Alternatively you can set up IMAP access.

Obviously you have to be able to configure proper OAuth2 keys to do this, but again, that's another 30 seconds spent in Grok/GPT/Claude/whatever.


Most gmail scopes are restricted which means you’ll need to pass a CASA assessment to have proper production access to them.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: