96

Stack Overflow is sending out some E-Mails using the @stackoverflow.email domain. M0sa explains why here, but there are several downsides to this practice:

  • They confuse people as to the authenticity of incoming E-Mails. Already visible in a number of Meta posts. There are real people out there impersonating Stack Overflow. Also there's an increased risk of some bozo registering stackoverflow.network or whatever and sending E-Mails from it

  • In my experience, sender addresses with newfangled TLDs are a spam red flag. I get loads of spam and literally ALL the messages I get from .website, .email, .company, .network and such are garbage, to the point that I've considered adding a filter rejecting them all with a friendly explanation. I'm sure I'm not the only one

  • People with very strict spam regimes might have @stackoverflow.com whitelisted but not @stackoverflow.email

Now that Stack Overflow is completely on SSL, which M0sa lists as one reason why the .email domain is used - is this worth revisiting?

10
  • 5
    Facebook is also doing this work. I asked a question about it in webmasters.stackexchange.com/questions/113542/… too. Commented Mar 21, 2018 at 11:39
  • 12
    I'm past considering filtering new TLDs. I'm there.
    – John Conde
    Commented Mar 22, 2018 at 12:16
  • There's also stackoverflow.net (which is apparently now owned by a web development software firm)
    – Machavity Mod
    Commented Mar 22, 2018 at 12:20
  • 1
    There is still a problem with the 3th party software required for tracking the emails, now they are free to change it, but if emails come (and have tracking links to) stackoverflow.com, you need to security screen them
    – Ferrybig
    Commented Mar 22, 2018 at 12:23
  • If they pick one official one to use for correspondence does it matter which one it is? It does seem odd to get it from multiple domains unless this is some sort of AB test
    – Matt
    Commented Mar 22, 2018 at 12:23
  • 2
    Well I guess people are going to miss emails from me if you all block the new fangled TLDs! Another reason we need to find an alternative to email really, it's an awful communication mechanism.
    – DavidG
    Commented Mar 22, 2018 at 12:28
  • 3
    @DavidG did you get my smoke signals?
    – rene
    Commented Mar 22, 2018 at 16:37
  • 5
    @David LOL! Yours is the first justifiable use of a newfangled TLD I've ever seen. If I ever create a filter like that, I'll make sure to whitelist .glass.
    – Pekka
    Commented Mar 22, 2018 at 16:39
  • 1
    @rene I thought something was on fire...
    – DavidG
    Commented Mar 22, 2018 at 16:59
  • 2
    @Pekka웃 The moment I saw it was available, I bought it. Slightly more expensive than a standard TLD but worth every penny. Worth it just for the confused look on people's faces when I read out my email address.
    – DavidG
    Commented Mar 22, 2018 at 17:00

1 Answer 1

42

We cannot use the same domain because we send email through some third parties for scale (like SendGrid and Iterable). Independent from the HTTPS/SSL issue, for any requests made through them (even redirects), they would get your cookies if we were using the same second level domain.

The split is very intentional, so that this cookie theft cannot happen and remains under our control.

If we relied on them being HTTP-only forever (let's also try to agree this is a bad idea from the start), these third party image and click relays would be able to, at will, enable SSL and start viewing the cookies (even via HSTS or via preload) without our consent or knowledge. Since I'm also working on getting us added to the HSTS preload list for Chrome (which feeds downstream to all major browsers), this path would also break completely very soon.

HTTPS was the initial reason (HSTS), but cookies is an equal concern today we cannot work around (at least within the current constraints of web browsers). That's the primary reason for our .email and .blog domains.

7
  • 43
    If you don't understand what Nick is saying, here's a handy illustration
    – Machavity Mod
    Commented Mar 23, 2018 at 17:24
  • 1
    @Machavity ugh you got me
    – Sam Rueby
    Commented Mar 23, 2018 at 19:42
  • Well, I don't want any third-party website to either steal my cookies or track me, so I won't click on those wanky links in your wanky new e-mail anyway. Way to shot in your foot...
    – SasQ
    Commented Jan 6, 2019 at 1:40
  • 1
    @SasQ For what it's worth, we don't care what a user clicks, but we have to care in aggregate as we want to improve what newsletters people like, increase usability overall, etc. and we have to measure to see if we're doing better or worse. This is fairly normal for anyone at scale. Note though that your behavior isn't reflected in the vast majority of users, so I don't agree with a "shooting ourselves in the foot" assessment. We know we can't please everyone - it's just not possible when talking about many millions of users.
    – Nick Craver Mod
    Commented Jan 6, 2019 at 1:47
  • I might have believed that if the usability were actually improving. (cough!%logout button, for one%cough!). As for the brilliant idea with fishy TLDs for official mailings, you've got my feedback above.
    – SasQ
    Commented Jan 6, 2019 at 1:53
  • 1
    @SasQ Noted - I just don't think we'll agree here. It's part of my job to maintain the security of our users and network and this was a necessary step. We're working on a lot of usability in many places (for example, load this page in desktop mode on mobile). There's a lot to do, but we are working on it. As with all things, resources are finite.
    – Nick Craver Mod
    Commented Jan 6, 2019 at 1:57
  • Can someone share some more info (or articles/docs) about how third-party can access the cookies. It went over my head. Commented Jun 10, 2019 at 9:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .