Marketing people absolutely love having an 'invite your friends' featureon your website, where your existing users can stick in the emailaddresses of their friends to have you send invitations to your serviceto them. Unfortunately, there are a number of problems with it that meanyou can't have one any more.

First, if you provide any way to have user-entered text (even inthe form of the sending user's nominal real name), spammerswill exploit it . Second, even with no

As a practical matter, I think that registration confirmation emailshould have at least three characteristics:

• it should always be initiated by that user; there should be none ofthe invite-your-friends features that are beloved by marketers.

  ( Yes, I'm completely serious about this .)

• it should not have any user-entered text whatsoever. Any userentered text will be exploited by spammers ,and you don't have any need for it anyways.

• it should be devoid of marketing material in general.

As I mentioned in the last entry , wehave an internal subnet for laptops and other generic user machines.For various reasons, we require machines on this subnet to be registeredso that we can identify who is (theoretically) responsible for them.One of the ways that people can do this is with a 'plug in and go'registration portal; you plug in, try to go somewhere, and you windup on a simple registration web page instead.

Behind the scenes, it works like this:

• our

Like other places, we have an automatic DHCP registration portal (to usethe term I've heard). In the abstract, you plug your new laptop intoour laptop network, try to visit some website, and instead wind up ona registration web page. You supply your local login and password, themachine you're using is registered as yours, and then you can go on toget Internet access.

(Some registration portals will automatically send you on to whateverwebsite you were trying to visit.