I ran into an interesting bug today. I was trying to update my address on a mailing list, and it sent an email to the new address, with a unique URL that I was supposed to visit to confirm my request. However, when I clicked it, I received an error that the link had already been used and was now invalid.
Upon further investigation, it seems that some host in my organization's email system visits URLs in incoming email before delivering it (GETs the page), presumably to check whether the link points to some sort of virus or other malware. Apparently the mailing list's confirmation page requires an extra click to actually confirm the request, so this doesn't actually update my subscription, but it does invalidate the URL. As a result, I can't update my subscription at all!
The question is:
Who is wrong in this situation? To whom should I complain? The mailing list server which sends links that only work once, or my own email admins who have a scanner set up to visit links?
And which of these practices should I avoid (or both)? They both seem kind of antisocial, but each seems to make sense in its own way.
I can imagine more serious results from automatically visiting loading random URLs from incoming email; for instance, simply requesting the URL could trigger some irreversible action, maybe one that I didn't want to do at all. On the other hand, it doesn't seem unreasonable to want to check whether an email contains malicious links, and how can you check this except by seeing what's at the other end?