Disposable email warning #174

Sometimes when I try to register with disposable email address I just never see confirmation email.

I think it is better to display warning that using disposable email addresses is not allowed and let user choose non-disposable one.

I know this is probably a delicate subject, but I believe that, if we do care about users privacy, there should be little reason for blocking disposable emails.

Enforcing users to continue using hotmail, gmail, outlook, yahoo email accounts, will detriment their feeling of privacy here. After all, privacy is a common subject many OSS stand up for.

I hope this comment doesn't trigger any sort polemic reactions, but instead, serve as a mean to make us reflect about what we are really standing up for when taking decisions like blocking disposable emails.

I may be missing something vital here, in which case, I'd like to invite the maintainers of the project to shed their light on this matter.

Thank you

I know this is probably a delicate subject, but I believe that, if we do care about users privacy, there should be little reason for blocking disposable emails.

We need to be able to reach out to users in case we get notified with claims that repos contain illegal content, so that repo-owners have a chance to clarify the situation.

Disposable/Single-send email accounts for obvious reasons do not allow us to do so.

Enforcing users to continue using hotmail, gmail, outlook, yahoo email accounts, will detriment their feeling of privacy here. After all, privacy is a common subject many OSS stand up for.

There are plenty alternatives, please also consider creating+maintaining new alternatives. A community is only a community if members can by some means communicate, a community of ghost avatars is dead by definition.

[...] vital [...]

yeah, building a vital community is what Codeberg's bylaws and statutes are aiming for.

Thank you for your comments.

We need to be able to reach out to users in case we get notified with claims that repos contain illegal content, so that repo-owners have a chance to clarify the situation.

Would this be the only option, though? Don't we have the in-app notification for this?
I believe that, from the moment someone willingly decides to create an account with a disposable email account, they are probably very aware of the implications and will make the necessary provisions to keep on top of Codeberg's notifications instead of relying on email. I don't believe that email is the only form of communication available.

The difference between this and creating a Gmail account only for the purpose of creating an account on Codeberg won't really help, if that email account is not to be checked ever besides the first verification message.

There are plenty alternatives, please also consider creating+maintaining new alternatives.

Yes, disposable emails are indeed an alternative for people who no longer want to have their inbox filled with spam and advertising and only share their true inbox with family and close friends.

A community is only a community if members can by some means communicate, a community of ghost avatars is dead by definition.

Apologies, I'm not sure in which context this is meant to apply, a community in this case would be able to communicate inside the community (Codeberg) and has little to do with which email account you used for registering or which email provider you use. I could be the most active member on Codeberg and yet having no mailbox associated with it.

The important thing here is to ask ourselves: Whenever a company such as Google or Facebook tries to acquire our data, we immediately stand against it, however when it's our platform, are we willing to something similar without even questioning why we are doing it and if that's extremely necessary?

Apologies, I'm not sure in which context this is meant to apply, a community in this case would be able to communicate inside the community (Codeberg) and has little to do with which email account you used for registering or which email provider you use. I could be the most active member on Codeberg and yet having no mailbox associated with it.

Not really. Users are identified by one of their configured email aliases (yes, you can have more than one in your account settings).

There is nothing special on codeberg with this. This is just how git works. You configure your email address by doing git config user.email <email@somewhere>, and all your actions will be stored/linked/signed using this email alias in your repository. (You can of course change this, and this involves rewriting git history.)

Also, in gitea, user actions (commits, issues, comments, PRs, ...) are identified and linked to user accounts registered as primary/secondary email address in the account settings.

If you for example create or import a repository, and all collaborators create a codeberg account with the same email address as used in the git history, imported issues, PRs, wiki history etc will reference the right user. If you transfer your project to another platform, users will there again get referenced with the email aliases they used to identify/sign their work.

Note that you can easily use an anonymous or pseudonymous email address like the one used for changes you apply using the WYSIWYG GUI online-editor (<username>@noreply.codeberg.org), which is automatically linked to your account. Nobody is required to expose his friends-and-family-email address for working with GIT.

Would this be the only option, though?[...}

Currently, yes. There's no direct message feature within Codeberg at the moment.

[...]creating a Gmail account only for the purpose of creating an account on Codeberg won't really help[...]

It will ensure that most users are contactable via email by default. Of course there is always the possibility that people ignore the mail sent to them or close down their account, but I think this is the exception rather than the rule.

The important thing here is to ask ourselves: Whenever a company such as Google or Facebook tries to acquire our data, we immediately stand against it, however when it's our platform, are we willing to something similar without even questioning why we are doing it and if that's extremely necessary?

There are plenty of independent email providers - we're not forcing anyone to go to Google, Facebook or any other big company with their email account. Email, by its nature, is decentralized and as such a very good fit as a default communication protocol for free and open communities, in my opinion :)

Thank you for taking the time to clarify and sharing your perspective over this subject. I can genuinely appreciate your standpoint by understanding the motivation behind it.

@circuitbit @lhinderberger @hw

You all are not honest to your users.

Have a look at Mastodon service. They clearly tell you "Sorry, disposable email not allowed" when you type in such address.

Codeberg is dishonest. Codeberg tell you to check your email

Activate Your Account
A new confirmation email has been sent to WHATEVER
Please check your inbox within the next 3 hours to
complete the registration process.

But the email never arrive and people who are not aware this (for example they are new to Codeberg) will think your site is broken.

@circuitbit @lhinderberger @hw

You all are not honest to your users.

Have a look at Mastodon service. They clearly tell you "Sorry, disposable email not allowed" when you type in such address.

Codeberg is dishonest. Codeberg tell you to check your email

Activate Your Account
A new confirmation email has been sent to WHATEVER
Please check your inbox within the next 3 hours to
complete the registration process.

But the email never arrive and people who are not aware this (for example they are new to Codeberg) will think your site is broken.

Also had issues with cock.li email account. If there was message that this email address is blocked, or, at least, i had possibility to change email after submitting registration form, it would be much more understandable and user-friendly. That dishonesty causes troubles with new codeberg users. Please, fix it.

@about___blank : Feel free to contribute a PR! :)

tbh, I can't see how the blocking is currently done. How is a warning supposed to work then? I think this must either be solved on our side or we should at least provide some more assistance in finding the required information.

currently we simply do not peer (no email communication at all) with any hosts listed in common spam and abuse filter lists. All the email "providers" requested above are pretty much all the time listed as abuse and spam.

we could change the CreateUser template to show a info about Disposable emails ...

That's cool! PR welcome

I think this comment will just fall into the digital void, but...

This is not a Codegerg's fault, but we make things depend on an email to much. But, email is leaking a lot of private info, as it is registered to a domain that is trackable and even maybe with an Impressum. To prevent that, we need to create a throwaway address, but as one of the above posters mentioned, these email providers end up being FAANG companies who now know that i have an account at Codeberg (and i am giving them attention, metadata, business and keep them afloat).

I agree with the not peering with spamming/throw away servers, but as users create an account at Codeberg why would we want to "depend on contacting users" via another system (email) and assume that they read their email messages. As a user I would like to assume to be contacted via Codeberg if Codeberg want's to contact me and/or be able to set a prefered way of communication. I may choose an email to be "the prefered way", but i may also prefer not to read that email account i used for registration and choose to see a notification popup at Codeberg itself.

Gitea at the moment doesn't have a feature of "internal communication" besides issues/PRs... (because we choose to offload this to email) but it would make a ton of sense to me.

:) end of friendly rant.