Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #211099 > unrolled thread
| Started by | Greg Wooledge <wooledg@eeg.ccf.org> |
|---|---|
| First post | 2019-07-09 19:00 +0200 |
| Last post | 2019-07-17 09:10 +0200 |
| Articles | 20 on this page of 48 — 20 participants |
Back to article view | Back to linux.debian.user
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: chromebook Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-09 19:00 +0200
Re: chromebook Dan Purgert <dan@djph.net> - 2019-07-10 02:20 +0200
Re: chromebook John Crawley <john@bunsenlabs.org> - 2019-07-10 03:40 +0200
Re: chromebook Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 06:30 +0200
Re: chromebook Joe <joe@jretrading.com> - 2019-07-10 09:20 +0200
Re: chromebook <tomas@tuxteam.de> - 2019-07-10 09:30 +0200
Re: chromebook Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-10 22:00 +0200
Re: chromebook Reco <recoverym4n@enotuniq.net> - 2019-07-10 08:40 +0200
Re: chromebook Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-10 15:10 +0200
Re: mutt vs HTML (was: chromebook) Reco <recoverym4n@enotuniq.net> - 2019-07-10 16:10 +0200
Re: HTML mail (was: chromebook) John Crawley <john@bunsenlabs.org> - 2019-07-11 05:50 +0200
Re: HTML mail (was: chromebook) Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-11 08:30 +0200
Re: HTML mail John Crawley <john@bunsenlabs.org> - 2019-07-11 09:00 +0200
Re: HTML mail Gene Heskett <gheskett@shentel.net> - 2019-07-11 09:20 +0200
Re: HTML mail Andrei POPESCU <andreimpopescu@gmail.com> - 2019-07-11 09:20 +0200
Re: HTML mail <tomas@tuxteam.de> - 2019-07-11 10:10 +0200
Re: HTML mail Brad Rogers <brad@fineby.me.uk> - 2019-07-11 11:20 +0200
Re: HTML mail <tomas@tuxteam.de> - 2019-07-11 11:40 +0200
Re: HTML mail Brad Rogers <brad@fineby.me.uk> - 2019-07-11 16:00 +0200
Re: HTML mail Greg Wooledge <wooledg@eeg.ccf.org> - 2019-07-11 16:10 +0200
Re: HTML mail Dan Purgert <dan@djph.net> - 2019-07-11 19:00 +0200
Re: HTML mail Carl Fink <carl@finknetwork.com> - 2019-07-11 20:20 +0200
Re: HTML mail John Hasler <jhasler@newsguy.com> - 2019-07-11 14:30 +0200
Re: HTML mail <tomas@tuxteam.de> - 2019-07-11 14:50 +0200
Re: HTML mail Gene Heskett <gheskett@shentel.net> - 2019-07-11 18:00 +0200
Re: HTML mail Thomas D Dial <tdial@acm.org> - 2019-07-11 21:30 +0200
Re: HTML mail tomas@tuxteam.de - 2019-07-12 09:30 +0200
Re: HTML mail Brad Rogers <brad@fineby.me.uk> - 2019-07-11 16:00 +0200
Re: HTML mail David Wright <deblis@lionunicorn.co.uk> - 2019-07-11 17:20 +0200
Re: HTML mail John Crawley <john@bunsenlabs.org> - 2019-07-11 13:20 +0200
Re: chromebook Kenneth Parker <sea7kenp@gmail.com> - 2019-07-11 04:40 +0200
Re: chromebook <tomas@tuxteam.de> - 2019-07-11 10:30 +0200
Re: Own MTA is hard (was: chromebook) Reco <recoverym4n@enotuniq.net> - 2019-07-11 10:40 +0200
Re: Own MTA is hard (was: chromebook) <tomas@tuxteam.de> - 2019-07-11 10:50 +0200
Re: chromebook John Hasler <jhasler@newsguy.com> - 2019-07-11 18:40 +0200
Re: chromebook <tomas@tuxteam.de> - 2019-07-12 09:40 +0200
Re: chromebook Curt <curty@free.fr> - 2019-07-12 10:00 +0200
Re: chromebook <tomas@tuxteam.de> - 2019-07-12 10:40 +0200
[Off-topic] John Hasler <jhasler@newsguy.com> - 2019-07-12 16:00 +0200
Re: [Off-topic] <tomas@tuxteam.de> - 2019-07-12 16:30 +0200
Re: [Off-topic] Reco <recoverym4n@enotuniq.net> - 2019-07-12 19:00 +0200
Re: [Off-topic] Diagonal Arg <debian.org@niwas.net> - 2019-07-17 04:20 +0200
Re: [Off-topic] Nicholas Geovanis <nickgeovanis@gmail.com> - 2019-07-17 18:30 +0200
Re: chromebook rhkramer@gmail.com - 2019-07-11 14:00 +0200
Re: chromebook <tomas@tuxteam.de> - 2019-07-11 14:50 +0200
Re: chromebook Keith Bainbridge <keithrbau@gmail.com> - 2019-07-17 06:30 +0200
Re: chromebook Diagonal Arg <debian.org@niwas.net> - 2019-07-17 06:50 +0200
Re: chromebook <tomas@tuxteam.de> - 2019-07-17 09:10 +0200
Page 1 of 3 [1] 2 3 Next page →
| From | Greg Wooledge <wooledg@eeg.ccf.org> |
|---|---|
| Date | 2019-07-09 19:00 +0200 |
| Subject | Re: chromebook |
| Message-ID | <yi1Db-5NE-9@gated-at.bofh.it> |
On Tue, Jul 09, 2019 at 06:48:22PM +0200, mjonsson1986@gmail.com wrote: > <html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!-- Please post only text, not HTML. If your email agent *cannot* do plain text alone, at least configure it to send both plain text and HTML. Or, y'know, get a better email agent.
[toc] | [next] | [standalone]
| From | Dan Purgert <dan@djph.net> |
|---|---|
| Date | 2019-07-10 02:20 +0200 |
| Message-ID | <yi8v0-1DH-3@gated-at.bofh.it> |
| In reply to | #211099 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Greg Wooledge wrote: > On Tue, Jul 09, 2019 at 06:48:22PM +0200, mjonsson1986@gmail.com wrote: >> <html xmlns:o="urn:schemas-microsoft-com:office:office" >> xmlns:w="urn:schemas-microsoft-com:office:word" > > Please post only text, not HTML. If your email agent *cannot* do plain > text alone, at least configure it to send both plain text and HTML. Or, > y'know, get a better email agent It's like he attempted to send a word doc as mail. Great lord cthulhu, is that what the latest iteration of outlook does?! -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEBcqaUD8uEzVNxUrujhHd8xJ5ooEFAl0lK44ACgkQjhHd8xJ5 ooEJ5gf/YrhR5DVLmnCbrt7lHT/0wsFYLND3LL9t2yhtkl7jXMQnBAvHaowznhI3 PMkKp4vm8CNog2j04BzwdpXRIUcNfLXIJc5Vg4IlpscSTyUcT7s/o2AqPWxD4iAS ZgVddn95iT34P5OPAfHHFmo8OsIpy4U9oAJNmnajiizTfWG39m/m0Mt/o5ax+oEb NB2KevVP6Y3lMgkum2t9BMOpfiyyGM3GjtnEfFgqdJ4hZ/sFVABZHNWrGnCU62CL KtSmjo9cW0wRkRQwcll9YeicKIHGlbwv7WlJk/njnvnQkOa8ScpcJPVABj8qEHZA C5gy+zZJLbUdnrUbJwQNbHZX3Z442w== =+8Cn -----END PGP SIGNATURE----- -- |_|O|_| |_|_|O| Github: https://github.com/dpurgert |O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5 4AEE 8E11 DDF3 1279 A281
[toc] | [prev] | [next] | [standalone]
| From | John Crawley <john@bunsenlabs.org> |
|---|---|
| Date | 2019-07-10 03:40 +0200 |
| Message-ID | <yi9Kp-2hH-5@gated-at.bofh.it> |
| In reply to | #211099 |
On 2019-07-10 01:52, Greg Wooledge wrote: > On Tue, Jul 09, 2019 at 06:48:22PM +0200, mjonsson1986@gmail.com wrote: >> <html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!-- > > Please post only text, not HTML. If your email agent *cannot* do plain > text alone, at least configure it to send both plain text and HTML. Or, > y'know, get a better email agent. > > Of course text messages are best (and what I use all the time) but surely a decent mail agent on the receiver's end will display that OK? On Thunderbird the OP was perfectly readable, and I had no idea it wasn't plain text till I checked the source. -- John
[toc] | [prev] | [next] | [standalone]
| From | Andrei POPESCU <andreimpopescu@gmail.com> |
|---|---|
| Date | 2019-07-10 06:30 +0200 |
| Message-ID | <yicoW-43C-5@gated-at.bofh.it> |
| In reply to | #211124 |
[Multipart message — attachments visible in raw view] — view raw
On Mi, 10 iul 19, 10:35:33, John Crawley wrote: > On 2019-07-10 01:52, Greg Wooledge wrote: > > > > Please post only text, not HTML. If your email agent *cannot* do plain > > text alone, at least configure it to send both plain text and HTML. Or, > > y'know, get a better email agent. > > > Of course text messages are best (and what I use all the time) but surely a > decent mail agent on the receiver's end will display that OK? On Thunderbird > the OP was perfectly readable, and I had no idea it wasn't plain text till I > checked the source. 1. As far as I know html e-mail is not standardized. This means that one's messages might look entirely different at the receiver's end to what the sender intended. Computer output needed to diagnose problems is best sent unchanged. Good luck in figuring out how to do this in a html message. Bonus points for e-mail clients trying to apply the same formatting to the text part as well, making it less readable. 2. Some (many?) of us are reading messages on text-only clients. This may be for objective or subjective reasons, but it's probably quite common here. Sure, there are ways to display html content, but see 1. 3. The html (part) can add significant overhead. It's not a major issue for the few messages usually currently sent to the list, but if all posters would be using html it could have a significant impact for readers on a data cap. Hope this explains, Andrei -- http://wiki.debian.org/FAQsFromDebianUser
[toc] | [prev] | [next] | [standalone]
| From | Joe <joe@jretrading.com> |
|---|---|
| Date | 2019-07-10 09:20 +0200 |
| Message-ID | <yif3r-5H6-3@gated-at.bofh.it> |
| In reply to | #211129 |
On Wed, 10 Jul 2019 07:21:39 +0300 Andrei POPESCU <andreimpopescu@gmail.com> wrote: > 2. Some (many?) of us are reading messages on text-only clients. > > This may be for objective or subjective reasons, but it's probably > quite common here. > > Sure, there are ways to display html content, but see 1. > > 3. The html (part) can add significant overhead. > > It's not a major issue for the few messages usually currently sent > to the list, but if all posters would be using html it could have a > significant impact for readers on a data cap. Yes. The large majority of most HTML, on the web or in emails, is formatting stuff. It's often difficult to actually spot the two or three lines of text in half a dozen pages of font instructions and special display tweaks for different browsers and mobiles. I use Claws, which can do HTML but never does here. -- Joe
[toc] | [prev] | [next] | [standalone]
| From | <tomas@tuxteam.de> |
|---|---|
| Date | 2019-07-10 09:30 +0200 |
| Message-ID | <yifd7-5K8-9@gated-at.bofh.it> |
| In reply to | #211129 |
[Multipart message — attachments visible in raw view] — view raw
On Wed, Jul 10, 2019 at 07:21:39AM +0300, Andrei POPESCU wrote: > On Mi, 10 iul 19, 10:35:33, John Crawley wrote: > > On 2019-07-10 01:52, Greg Wooledge wrote: > > > > > > Please post only text, not HTML. If your email agent *cannot* do plain > > > text alone, at least configure it to send both plain text and HTML. Or, > > > y'know, get a better email agent. > > > > > Of course text messages are best (and what I use all the time) but surely a > > decent mail agent on the receiver's end will display that OK? On Thunderbird > > the OP was perfectly readable, and I had no idea it wasn't plain text till I > > checked the source. > > 1. As far as I know html e-mail is not standardized. > > This means that one's messages might look entirely different at the > receiver's end to what the sender intended. > > Computer output needed to diagnose problems is best sent unchanged. > Good luck in figuring out how to do this in a html message. > > Bonus points for e-mail clients trying to apply the same formatting > to the text part as well, making it less readable. > > 2. Some (many?) of us are reading messages on text-only clients. > > This may be for objective or subjective reasons, but it's probably > quite common here. > > Sure, there are ways to display html content, but see 1. > > 3. The html (part) can add significant overhead. > > It's not a major issue for the few messages usually currently sent to > the list, but if all posters would be using html it could have a > significant impact for readers on a data cap. 4. html viewers are known for being exploitable in many and surprising ways. Complexity gotta give, somewhere. Some folks (go figure!) don't like the idea of their mail user agents being exploitable. Cheers -- t
[toc] | [prev] | [next] | [standalone]
| From | Andrei POPESCU <andreimpopescu@gmail.com> |
|---|---|
| Date | 2019-07-10 22:00 +0200 |
| Message-ID | <yiqUV-4Xo-3@gated-at.bofh.it> |
| In reply to | #211140 |
[Multipart message — attachments visible in raw view] — view raw
On Mi, 10 iul 19, 09:25:02, tomas@tuxteam.de wrote: > > 4. html viewers are known for being exploitable in many and > surprising ways. Thanks, forgot about that one. A recent example: https://efail.de/ In the 'Responsible Disclosure' section there is nice coloured table with popular clients. Note the green for mutt and Claws Mail ;) Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@enotuniq.net> |
|---|---|
| Date | 2019-07-10 08:40 +0200 |
| Message-ID | <yieqK-5eJ-9@gated-at.bofh.it> |
| In reply to | #211124 |
Hi. On Wed, Jul 10, 2019 at 10:35:33AM +0900, John Crawley wrote: > On 2019-07-10 01:52, Greg Wooledge wrote: > > On Tue, Jul 09, 2019 at 06:48:22PM +0200, mjonsson1986@gmail.com wrote: > > > <html xmlns:o="urn:schemas-microsoft-com:office:office" > > > xmlns:w="urn:schemas-microsoft-com:office:word" > > > xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" > > > xmlns="http://www.w3.org/TR/REC-html40"><head><meta > > > http-equiv=Content-Type content="text/html; charset=utf-8"><meta > > > name=Generator content="Microsoft Word 15 (filtered > > > medium)"><style><!-- > > > > Please post only text, not HTML. If your email agent *cannot* do plain > > text alone, at least configure it to send both plain text and HTML. Or, > > y'know, get a better email agent. > > > Of course text messages are best (and what I use all the time) but > surely a decent mail agent on the receiver's end will display that OK? A subverted XHTML produced by Microsoft Word? You're joking, right? It will display *somehow*, that's for sure. But to display it as "intended" you'll need something from M$. > On Thunderbird the OP was perfectly readable, and I had no idea it > wasn't plain text till I checked the source. It was readable in my mutt too. Still does not make it right. Reco
[toc] | [prev] | [next] | [standalone]
| From | Greg Wooledge <wooledg@eeg.ccf.org> |
|---|---|
| Date | 2019-07-10 15:10 +0200 |
| Message-ID | <yikwa-A3-7@gated-at.bofh.it> |
| In reply to | #211136 |
On Wed, Jul 10, 2019 at 09:31:13AM +0300, Reco wrote: > On Wed, Jul 10, 2019 at 10:35:33AM +0900, John Crawley wrote: > > On Thunderbird the OP was perfectly readable, and I had no idea it > > wasn't plain text till I checked the source. > > It was readable in my mutt too. Still does not make it right. Your mutt must be configured very differently than mine. All I saw was the raw HTML.
[toc] | [prev] | [next] | [standalone]
| From | Reco <recoverym4n@enotuniq.net> |
|---|---|
| Date | 2019-07-10 16:10 +0200 |
| Subject | Re: mutt vs HTML (was: chromebook) |
| Message-ID | <yilse-18m-5@gated-at.bofh.it> |
| In reply to | #211157 |
On Wed, Jul 10, 2019 at 09:06:32AM -0400, Greg Wooledge wrote:
> On Wed, Jul 10, 2019 at 09:31:13AM +0300, Reco wrote:
> > On Wed, Jul 10, 2019 at 10:35:33AM +0900, John Crawley wrote:
> > > On Thunderbird the OP was perfectly readable, and I had no idea it
> > > wasn't plain text till I checked the source.
> >
> > It was readable in my mutt too. Still does not make it right.
>
> Your mutt must be configured very differently than mine. All I saw
> was the raw HTML.
A relevant snippet from .muttrc:
alternative_order text/plain text/html
unauto_view *
auto_view = text/html
An appropriate entry at .mailcap:
text/html; /usr/bin/w3m -dump -o display_link_number=true -I %{charset} -T text/html '%s'; copiousoutput; description=HTML Text; %nametemplate=%s.html; needsterminal; priority=1
Literally all it takes. As a bonus, sender's HTML is converted to a
plain text on reply.
Reco
[toc] | [prev] | [next] | [standalone]
| From | John Crawley <john@bunsenlabs.org> |
|---|---|
| Date | 2019-07-11 05:50 +0200 |
| Subject | Re: HTML mail (was: chromebook) |
| Message-ID | <yiyfL-Wf-3@gated-at.bofh.it> |
| In reply to | #211136 |
On 2019-07-10 15:31, Reco wrote: > On Wed, Jul 10, 2019 at 10:35:33AM +0900, John Crawley wrote: >> On 2019-07-10 01:52, Greg Wooledge wrote: >>> On Tue, Jul 09, 2019 at 06:48:22PM +0200, mjonsson1986@gmail.com wrote: >>>> <html xmlns:o="urn:schemas-microsoft-com:office:office" >>> >>> Please post only text, not HTML. If your email agent *cannot* do plain >>> text alone, at least configure it to send both plain text and HTML. Or, >>> y'know, get a better email agent. >>> >> Of course text messages are best (and what I use all the time) but >> surely a decent mail agent on the receiver's end will display that OK? > > A subverted XHTML produced by Microsoft Word? You're joking, right? > It will display *somehow*, that's for sure. But to display it as > "intended" you'll need something from M$. Well, just to display the text, without the html tags is not that hard. As to how it was "intended" to be, who knows? >> On Thunderbird the OP was perfectly readable, and I had no idea it >> wasn't plain text till I checked the source. > > It was readable in my mutt too. Still does not make it right. I was never trying to claim that it was OK to send messages as html - I always use plain text myself - but I thought there might be something to be said for user agents that could deal with html in some sane way, and without exposing the recipient to attacks. Simply not following any web links would be enough I'd have thought? Or are there some more subtle attack paths? As you've pointed out, mutt does OK. If all the posters to debian-user refrained from including html in their messages, it would not remove the need for MUAs to cope with it. -- John
[toc] | [prev] | [next] | [standalone]
| From | Andrei POPESCU <andreimpopescu@gmail.com> |
|---|---|
| Date | 2019-07-11 08:30 +0200 |
| Subject | Re: HTML mail (was: chromebook) |
| Message-ID | <yiAKB-2xQ-1@gated-at.bofh.it> |
| In reply to | #211197 |
[Multipart message — attachments visible in raw view] — view raw
On Jo, 11 iul 19, 12:31:07, John Crawley wrote: > > I was never trying to claim that it was OK to send messages as html - I > always use plain text myself - but I thought there might be something to be > said for user agents that could deal with html in some sane way, and without > exposing the recipient to attacks. Simply not following any web links would > be enough I'd have thought? Or are there some more subtle attack paths? Yes, look up the EFAIL vulnerability (I posted a link in another message). It enabled a potential attacker to trick e-mail clients parsing html e-mail to decrypt an (old) encrypted message. In most cases users only had to open the message. Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser
[toc] | [prev] | [next] | [standalone]
| From | John Crawley <john@bunsenlabs.org> |
|---|---|
| Date | 2019-07-11 09:00 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiBdD-2Ho-3@gated-at.bofh.it> |
| In reply to | #211198 |
On 2019-07-11 15:25, Andrei POPESCU wrote: > On Jo, 11 iul 19, 12:31:07, John Crawley wrote: >> ...user agents that could deal with html in some sane way, and without >> exposing the recipient to attacks. Simply not following any web links would >> be enough I'd have thought? Or are there some more subtle attack paths? > > Yes, look up the EFAIL vulnerability (I posted a link in another > message). It enabled a potential attacker to trick e-mail clients > parsing html e-mail to decrypt an (old) encrypted message. > > In most cases users only had to open the message. Since enforcing no-html, and particularly no-malevolent-html on all incoming mail is not an option available to us, the only remaining choices for a "good" MUA would then be: A) Display html as-is, tags and all B) Strip out the tags and display what's left, like html2text I think B) is the better option. -- John
[toc] | [prev] | [next] | [standalone]
| From | Gene Heskett <gheskett@shentel.net> |
|---|---|
| Date | 2019-07-11 09:20 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiBwZ-33h-5@gated-at.bofh.it> |
| In reply to | #211200 |
On Thursday 11 July 2019 02:52:56 John Crawley wrote: > On 2019-07-11 15:25, Andrei POPESCU wrote: > > On Jo, 11 iul 19, 12:31:07, John Crawley wrote: > >> ...user agents that could deal with html in some sane way, and > >> without exposing the recipient to attacks. Simply not following any > >> web links would be enough I'd have thought? Or are there some more > >> subtle attack paths? > > > > Yes, look up the EFAIL vulnerability (I posted a link in another > > message). It enabled a potential attacker to trick e-mail clients > > parsing html e-mail to decrypt an (old) encrypted message. > > > > In most cases users only had to open the message. > > Since enforcing no-html, and particularly no-malevolent-html on all > incoming mail is not an option available to us, the only remaining > choices for a "good" MUA would then be: > A) Display html as-is, tags and all > B) Strip out the tags and display what's left, like html2text > > I think B) is the better option. The TDE version of kmail will show a blank message window if there is no plain text content, but will show a click here to see the html. I rather like it that way, but spammy crap gets fed to sa-learn spam w/o a reply. Works for me. Cheers, Gene Heskett -- "There are four boxes to be used in defense of liberty: soap, ballot, jury, and ammo. Please use in that order." -Ed Howdershelt (Author) If we desire respect for the law, we must first make the law respectable. - Louis D. Brandeis Genes Web page <http://geneslinuxbox.net:6309/gene>
[toc] | [prev] | [next] | [standalone]
| From | Andrei POPESCU <andreimpopescu@gmail.com> |
|---|---|
| Date | 2019-07-11 09:20 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiBwZ-33h-3@gated-at.bofh.it> |
| In reply to | #211200 |
[Multipart message — attachments visible in raw view] — view raw
On Jo, 11 iul 19, 15:52:56, John Crawley wrote: > On 2019-07-11 15:25, Andrei POPESCU wrote: > > On Jo, 11 iul 19, 12:31:07, John Crawley wrote: > > > ...user agents that could deal with html in some sane way, and without > > > exposing the recipient to attacks. Simply not following any web links would > > > be enough I'd have thought? Or are there some more subtle attack paths? > > > > Yes, look up the EFAIL vulnerability (I posted a link in another > > message). It enabled a potential attacker to trick e-mail clients > > parsing html e-mail to decrypt an (old) encrypted message. > > > > In most cases users only had to open the message. > Since enforcing no-html, and particularly no-malevolent-html on all incoming > mail is not an option available to us, the only remaining choices for a > "good" MUA would then be: > A) Display html as-is, tags and all > B) Strip out the tags and display what's left, like html2text > > I think B) is the better option. C) Treat *all* message parts as potentially harmful, not just some attachments. If additional parsing is needed (check signature, parse html, etc.) do so in a safe way. Of course, this is not easy to do, especially if you insist on parsing all the bells and whistles in the html/css, which is probably why so many clients were vulnerable. Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser
[toc] | [prev] | [next] | [standalone]
| From | <tomas@tuxteam.de> |
|---|---|
| Date | 2019-07-11 10:10 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiCjn-3yE-1@gated-at.bofh.it> |
| In reply to | #211202 |
[Multipart message — attachments visible in raw view] — view raw
On Thu, Jul 11, 2019 at 10:10:16AM +0300, Andrei POPESCU wrote: > On Jo, 11 iul 19, 15:52:56, John Crawley wrote: [...] > > A) Display html as-is, tags and all > > B) Strip out the tags and display what's left, like html2text > > > > I think B) is the better option. > > C) Treat *all* message parts as potentially harmful, not just some > attachments. If additional parsing is needed (check signature, parse > html, etc.) do so in a safe way. D) Show the HTML /as is/, literally, as if it were text. I know it's hard on the receiver, but then, at least, there's someone motivated enough to yell at the sender to fix his/her MUA. Don't hide problems. They'll bite you in your behind. Cheers -- t
[toc] | [prev] | [next] | [standalone]
| From | Brad Rogers <brad@fineby.me.uk> |
|---|---|
| Date | 2019-07-11 11:20 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiDp7-4az-3@gated-at.bofh.it> |
| In reply to | #211205 |
[Multipart message — attachments visible in raw view] — view raw
On Thu, 11 Jul 2019 10:03:34 +0200
<tomas@tuxteam.de> wrote:
Hello tomas@tuxteam.de,
>enough to yell at the sender to fix his/her MUA.
Except that the worst offenders are commercial entities such google,
ebay(1), all banks, amazon, etc, etc. ad nauseam. *None* of them are
going to remove HTML and/or CSS from their emails until something
'better'(2) comes along.
Don't forget, either, that most computer users simply don't care what
comes in as long as they can read it. They have little or no idea what
HTML is, much less care.
(1) Possibly the worst; 150kbyte+ emails to say, essentially, "You've
been outbid". Why, FFS?!
(2) Better for them that is. IOW, something that makes it easier for
them to make more money out of us.
--
Regards _
/ ) "The blindingly obvious is
/ _)rad never immediately apparent"
I must be hallucinating, watching angels celebrating
There Must Be An Angel (Playing With My Heart) - Eurythmics
[toc] | [prev] | [next] | [standalone]
| From | <tomas@tuxteam.de> |
|---|---|
| Date | 2019-07-11 11:40 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiDIt-4gT-13@gated-at.bofh.it> |
| In reply to | #211211 |
[Multipart message — attachments visible in raw view] — view raw
On Thu, Jul 11, 2019 at 10:10:46AM +0100, Brad Rogers wrote:
> On Thu, 11 Jul 2019 10:03:34 +0200
> <tomas@tuxteam.de> wrote:
>
> Hello tomas@tuxteam.de,
>
> >enough to yell at the sender to fix his/her MUA.
>
> Except that the worst offenders are commercial entities such google,
> ebay(1), all banks, amazon, etc, etc. ad nauseam. *None* of them are
> going to remove HTML and/or CSS from their emails until something
> 'better'(2) comes along.
But giving up is not an option.
> Don't forget, either, that most computer users simply don't care what
> comes in as long as they can read it. They have little or no idea what
> HTML is, much less care.
That's where talking to people comes in.
"Discontent is the first step in the progress of a man or a nation."
-- Oscar Wilde
Cheers
-- t
[toc] | [prev] | [next] | [standalone]
| From | Brad Rogers <brad@fineby.me.uk> |
|---|---|
| Date | 2019-07-11 16:00 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiHM6-6DS-9@gated-at.bofh.it> |
| In reply to | #211213 |
[Multipart message — attachments visible in raw view] — view raw
On Thu, 11 Jul 2019 11:31:54 +0200
<tomas@tuxteam.de> wrote:
Hello tomas@tuxteam.de,
>That's where talking to people comes in.
By and large, people simply do not care.
In fact, it seems most would rather have pretty than be safe. For a
certain value of 'safe', obviously.
--
Regards _
/ ) "The blindingly obvious is
/ _)rad never immediately apparent"
A friend of a friend he got beaten
I Predict A Riot - Kaiser Chiefs
[toc] | [prev] | [next] | [standalone]
| From | Greg Wooledge <wooledg@eeg.ccf.org> |
|---|---|
| Date | 2019-07-11 16:10 +0200 |
| Subject | Re: HTML mail |
| Message-ID | <yiHVM-6Xa-7@gated-at.bofh.it> |
| In reply to | #211222 |
On Thu, Jul 11, 2019 at 02:49:41PM +0100, Brad Rogers wrote: > By and large, people simply do not care. > In fact, it seems most would rather have pretty than be safe. For a > certain value of 'safe', obviously. And a certain value of "pretty".
[toc] | [prev] | [next] | [standalone]
Page 1 of 3 [1] 2 3 Next page →
Back to top | Article view | linux.debian.user
csiph-web