Ryu2.mind

I get around 300 or so emails on an average weekday to my personal account alone, down from a peak of 400 when I was actively job hunting. (Lest anyone think that these messages are from female admirers around the world, the bulk of them are from various mailing lists that I'm on. And probably 1/3 is spam which gets filtered out. ;-) )

Anyhow, while it is a challenge trying to keep up with all (a set of good filters definitely helps), a sort of side effect is that if I get significantly less than that on a weekday, I know something's wrong.

Anyhow, over the last week or so, I noticed a significant drop in my incoming email levels, and was perplexed. Upon further discovery, it looked like many emails from Yahoo Groups hosted mailing lists were not reaching me. I sign into Yahoo, and look at my groups -- I'm still listed as being a subscriber. Then I do a bit more digging, and see a message in small font saying that one of my email addresses was bouncing.

Apparently, someone sent a email containing a ".scr" virus script to a Yahoo-hosted list that I'm on. The message goes through (Yahoo should have rejected it, of course), and is then correctly rejected by Stanford's email server. This triggers a "bounce" message alerting Yahoo of that fact. Now, unfortunately for me, Yahoo interpreted the bounce to mean that my Stanford CS address was no longer active, which it most certainly was. It wasn't until I noticed that no Yahoo groups mail had been coming to my cs.stanford.edu address that I knew something was wrong, and in the few days it took, I've probably missed several hundred messages.

Now, most of them were not critical for me to have received, but I can certainly imagine a easy denial of service attack whereby a user subscribes to a large mailing list, intentionally sends out a email with an unwanted file extension, and cause the receipients' mail servers to bounce the message, and effectively and automatically mass-unsubscribes many people from the group without notice.

I can definitely understand the good intentions of this 'feature': to prevent bounced messages when an email address expires. Yet, my experience is an example of several good-intentioned things gone wrong: failure to differentiate between a bounce due to an invalid email address versus a bounce due to a virus email, and most fundamentally, glaringly bad user design -- and from Yahoo, no less.

One of the first principles any software designer learns is to always alert the user of an error condition, if at all possible. At the very least, Yahoo groups should alert the user that one of their addresses is bouncing via an alternate non-bouncing email address if they have one registered with Yahoo, which I certainly do.

So, with the proliferation of email viruses going around, if anyone reads this and is wondering why they've suddenly stopped receiving Yahoo groups mail, now you know. And as they say, knowing is half the battle. =)