With the old Outlook Express you could add one with just an insert.
Why not in Thunderbird?

Ed

On 2023-11-04 14:30, Ed Cryer wrote:
> With the old Outlook Express you could add one with just an insert.
> Why not in Thunderbird?

My guess is, that is done with Javascript, and that's a first order
security risk.

--
Cheers,
Carlos E.R.

Am 04.11.23 um 14:30 schrieb Ed Cryer:
> With the old Outlook Express you could add one with just an insert.
> Why not in Thunderbird?

Ask the developers. I have an idea why not.

--
Gutta cavat lapidem (Ovid)

On 11/4/2023 9:30 AM, Ed Cryer wrote:
> With the old Outlook Express you could add one with just an insert.
> Why not in Thunderbird?
>
> Ed

Example of the same question, here.

https://support.mozilla.org/en-US/questions/1072714

https://web.archive.org/web/20141222142441/http://www.tudor-anghelina.com/2013/10/using-html5-audio-tag-to-add-background.html

I gather that Thunderbird has been "tightened up" on what
it will do with HTML, so no guarantee that will play
(without opening the platform browser).

The computer has so many "defenses" now, it's hard to say
what will happen when that arrives.

Paul

Paul wrote:
> On 11/4/2023 9:30 AM, Ed Cryer wrote:
>> With the old Outlook Express you could add one with just an insert.
>> Why not in Thunderbird?
>>
>> Ed
>
> Example of the same question, here.
>
> https://support.mozilla.org/en-US/questions/1072714
>
> https://web.archive.org/web/20141222142441/http://www.tudor-anghelina.com/2013/10/using-html5-audio-tag-to-add-background.html
>
> I gather that Thunderbird has been "tightened up" on what
> it will do with HTML, so no guarantee that will play
> (without opening the platform browser).
>
> The computer has so many "defenses" now, it's hard to say
> what will happen when that arrives.
>
> Paul
>

Many websites play background music. Quite apart from Youtube where I
can get a full Brahms-like symphony orchestra blasting in my ears.
Are they dangerous? Are they beyond the scope of my AV?

I've visited many recently, fallen in love with the music of Borodin and
Mussorgsky, and still there's no sign of malware aboard.

"Health and Safety" go protect kids on the playground; save them from
the bullying of older kids.

Ed

On 11/4/2023 3:22 PM, Ed Cryer wrote:
> Paul wrote:
>> On 11/4/2023 9:30 AM, Ed Cryer wrote:
>>> With the old Outlook Express you could add one with just an insert.
>>> Why not in Thunderbird?
>>>
>>> Ed
>>
>> Example of the same question, here.
>>
>> https://support.mozilla.org/en-US/questions/1072714
>>
>>     https://web.archive.org/web/20141222142441/http://www.tudor-anghelina.com/2013/10/using-html5-audio-tag-to-add-background.html
>>
>> I gather that Thunderbird has been "tightened up" on what
>> it will do with HTML, so no guarantee that will play
>> (without opening the platform browser).
>>
>> The computer has so many "defenses" now, it's hard to say
>> what will happen when that arrives.
>>
>>     Paul
>>
>
> Many websites play background music. Quite apart from Youtube where I can get a full Brahms-like symphony orchestra blasting in my ears.
> Are they dangerous? Are they beyond the scope of my AV?
>
> I've visited many recently, fallen in love with the music of Borodin and Mussorgsky, and still there's no sign of malware aboard.
>
> "Health and Safety" go protect kids on the playground; save them from the bullying of older kids.
>
> Ed

In an email environment, it's a question of whether you want
an attack surface (HTML/JS) enabled on your email client or not.

Accepting and playing HTML emails immediately, might give no
opportunity to vet whether an email is legit or not. From
a legit source, and not some sort of clever phish.

If it were not for Black Hats, we could have nice things.

A regular on USENET, had his computer room sacked by a phishing
email (ransomware on all machines on LAN). The threat is real.
He made the classic mistake, of clicking on an attachment.
He was never the same after that (he was a small businessman
at threads ends).

While the people here are moderately careful and suspicious of
stuff, you never know what is really in your Inbox in the morning.
It could be Mahler or it could be Malware.

Paul

Ed Cryer wrote:
> With the old Outlook Express you could add one with just an insert.
> Why not in Thunderbird?

*Who the fuck* wants to hear *your* "background music" while reading EMails
or Newsgroup-Postings?!
That's the biggest insult you can make on the recipient. Unexpected and
unwanted Sounds.

Am 04.11.23 um 20:22 schrieb Ed Cryer:
> Many websites play background music. Quite apart from Youtube where I
> can get a full Brahms-like symphony orchestra blasting in my ears.
> Are they dangerous? Are they beyond the scope of my AV?

Apart from the technical security aspects I think it is not very polite
to force people to listen to music in a mail. Thankfully this can be
stopped in TB and other software or even at the OS-level.

> I've visited many recently, fallen in love with the music of Borodin and
> Mussorgsky, and still there's no sign of malware aboard.

I doubt that other users share your love for classic music when you send
them e-mail. Everywhere it is preached not to send or receive HTML or
any other executable code in Mails.

--
Gutta cavat lapidem (Ovid)

On 11/5/2023 1:31 AM, Frank Miller wrote:
> Ed Cryer wrote:
>> With the old Outlook Express you could add one with just an insert.
>> Why not in Thunderbird?
>
> *Who the fuck* wants to hear *your* "background music" while reading EMails
> or Newsgroup-Postings?!
> That's the biggest insult you can make on the recipient. Unexpected and
> unwanted Sounds.
>

You're right, Ed could have a collection of Mantovani or Zamfir.
He must be stopped :-) Before he strikes again. That elusive
pimpernel.

https://en.wikipedia.org/wiki/Mantovani

Zamfir.

https://www.youtube.com/watch?v=OSIKzVWvxzc

Or a little Krupa on the drums. (Benny Goodman "Sing, Sing, Sing" Gene Krupa Drums)

https://www.youtube.com/watch?v=1F89BI6rxQg

*******

While I was looking for the per-app volume control, I
found a reference to Stereo Mix. The stuff you find under rocks.
I bet this went missing, the moment I plugged in the Bluetooth
transmitter.

[Picture] W11Home 22H2

https://i.postimg.cc/tgZhR7y7/stereo-mix-is-in-Win11.gif

So some good has come of all this music trivia. This could
well disappear when 23H2 comes in. It is getting harder to find this.
It's cut off like sysdm.cpl.

You can mute the sound on your email client, if necessary.

{Picture] W11Home 22H2

https://i.postimg.cc/SRdqFqxV/W11-Per-App-Volume-Control.gif

Paul

Ed Cryer, 2023-11-04 20:22:

[...]
> Many websites play background music. Quite apart from Youtube where I
> can get a full Brahms-like symphony orchestra blasting in my ears.
> Are they dangerous? Are they beyond the scope of my AV?

"Many"? I don't know any website at all which does this. Do you have
some example URLs?

--
Arno Welzel
https://arnowelzel.de

Ed Cryer, 2023-11-04 14:30:

> With the old Outlook Express you could add one with just an insert.
> Why not in Thunderbird?

Because it is a stupid idea in the first place. Why should an e-mail ne
allowed to start "background music"?

Most likely this is also a security problem since it may require
JavaScript and you really don't want to allow JavaScript in e-mails you
get from other people.

--
Arno Welzel
https://arnowelzel.de

On 11/5/2023 1:19 PM, Arno Welzel wrote:
> Ed Cryer, 2023-11-04 14:30:
>
>> With the old Outlook Express you could add one with just an insert.
>> Why not in Thunderbird?
>
> Because it is a stupid idea in the first place. Why should an e-mail ne
> allowed to start "background music"?
>
> Most likely this is also a security problem since it may require
> JavaScript and you really don't want to allow JavaScript in e-mails you
> get from other people.
>

The example was HTML.

"In the write windows select insert HTML and paste in the following

<audio autoplay="" controls="" loop="" preload="">
</source> <=== file references go in here
</source> <=== the example is not complete.
Your browser does not support the audio element.
</audio>

You now have music."

When approaches like this are used, the question becomes whether the
"audio element" is there or not (when the HTML is "played"). .

Presumably you could send an Outlook Express message to yourself
with this kind of thing in place, and then examine the raw
message and look at the HTML code.

As an example of a test environment,
I have an email server set up in a VM, and multiple email clients
loaded in there, and the clients email to each other at 127.0.0.1
otherwise known as mail.local :-) That way, no real mail servers
are involved. But that's a lot of work for a little fun. Currently
the setup is broken, and I am unable to produce a new certificate
for it, and it appears I didn't write notes on the steps to make
the cert.

Paul

Paul, 2023-11-05 19:30:

[...]
> The example was HTML.
>
> "In the write windows select insert HTML and paste in the following
>
> <audio autoplay="" controls="" loop="" preload="">
> </source> <=== file references go in here
> </source> <=== the example is not complete.
> Your browser does not support the audio element.
> </audio>
>
> You now have music."
>
> When approaches like this are used, the question becomes whether the
> "audio element" is there or not (when the HTML is "played"). .

The autoplay attribute may be blocked. And that is good. I do *not* want
*anything* to play automatically without my interaction first. And not
"receiving an e-mail" is not "interaction".

Also video is often only allowed to start automatically, if it is silent
(e.g. as background video effect or animation etc.).

--
Arno Welzel
https://arnowelzel.de

On 2023-11-05 06:01, Paul wrote:
> On 11/4/2023 3:22 PM, Ed Cryer wrote:
>> Paul wrote:
>>> On 11/4/2023 9:30 AM, Ed Cryer wrote:

>
> In an email environment, it's a question of whether you want
> an attack surface (HTML/JS) enabled on your email client or not.
>
> Accepting and playing HTML emails immediately, might give no
> opportunity to vet whether an email is legit or not. From
> a legit source, and not some sort of clever phish.
>
> If it were not for Black Hats, we could have nice things.
>
> A regular on USENET, had his computer room sacked by a phishing
> email (ransomware on all machines on LAN). The threat is real.
> He made the classic mistake, of clicking on an attachment.
> He was never the same after that (he was a small businessman
> at threads ends).

"clicking on an attachment"... Windows, I guess? What type of
attachment, a diguised .exe, or some type of document with scripting? Or
something else?

I'm curious :-)

--
Cheers,
Carlos E.R.

On 2023-11-05 19:17, Arno Welzel wrote:
> Ed Cryer, 2023-11-04 20:22:
>
> [...]
>> Many websites play background music. Quite apart from Youtube where I
>> can get a full Brahms-like symphony orchestra blasting in my ears.
>> Are they dangerous? Are they beyond the scope of my AV?
>
> "Many"? I don't know any website at all which does this. Do you have
> some example URLs?

I have seen some, and I find it offensive.

Specially if I have a hundred tabs open and I don't know which one is
playing music at full blast.

--
Cheers,
Carlos E.R.

On 2023-11-05 19:30, Paul wrote:
> On 11/5/2023 1:19 PM, Arno Welzel wrote:
>> Ed Cryer, 2023-11-04 14:30:
>>
>>> With the old Outlook Express you could add one with just an insert.
>>> Why not in Thunderbird?
>>
>> Because it is a stupid idea in the first place. Why should an e-mail ne
>> allowed to start "background music"?
>>
>> Most likely this is also a security problem since it may require
>> JavaScript and you really don't want to allow JavaScript in e-mails you
>> get from other people.
>>
>
> The example was HTML.
>
> "In the write windows select insert HTML and paste in the following
>
> <audio autoplay="" controls="" loop="" preload="">
> </source> <=== file references go in here
> </source> <=== the example is not complete.
> Your browser does not support the audio element.
> </audio>
>
> You now have music."

that file reference is an url to a remote site, or an attachment on the
email perhaps?

>
> When approaches like this are used, the question becomes whether the
> "audio element" is there or not (when the HTML is "played"). .
>
> Presumably you could send an Outlook Express message to yourself
> with this kind of thing in place, and then examine the raw
> message and look at the HTML code.

....

--
Cheers,
Carlos E.R.

Carlos E. R. <robin_listas@es.invalid> wrote:
>On 2023-11-05 06:01, Paul wrote:
>> On 11/4/2023 3:22 PM, Ed Cryer wrote:
>>> Paul wrote:
>>>> On 11/4/2023 9:30 AM, Ed Cryer wrote:
>
>
>>
>> In an email environment, it's a question of whether you want
>> an attack surface (HTML/JS) enabled on your email client or not.
>>
>> Accepting and playing HTML emails immediately, might give no
>> opportunity to vet whether an email is legit or not. From
>> a legit source, and not some sort of clever phish.
>>
>> If it were not for Black Hats, we could have nice things.
>>
>> A regular on USENET, had his computer room sacked by a phishing
>> email (ransomware on all machines on LAN). The threat is real.
>> He made the classic mistake, of clicking on an attachment.
>> He was never the same after that (he was a small businessman
>> at threads ends).
>
>"clicking on an attachment"... Windows, I guess? What type of
>attachment, a diguised .exe, or some type of document with scripting? Or
>something else?
>
>I'm curious :-)

I use alpine from a shell account on a remote machine running Debian.
It's a multiple-step process to get that attachment somewhere I could
run it natively. Marking the message to be deleted is just the press of
the "d" key.

I'm not immune to acting against interest but just clicking on the
attachment isn't likely to trap me. What has happened at times is that
I've gotten an email message purporting to be from a vendor, and it's
literally a vendor I use. It's happened a few times within days of
having had a long discussion with the vendor.

Totally freaks me out.

Carlos E. R. wrote:
> On 2023-11-05 19:17, Arno Welzel wrote:
>> Ed Cryer, 2023-11-04 20:22:
>>
>> [...]
>>> Many websites play background music. Quite apart from Youtube where I
>>> can get a full Brahms-like symphony orchestra blasting in my ears.
>>> Are they dangerous? Are they beyond the scope of my AV?
>>
>> "Many"? I don't know any website at all which does this. Do you have
>> some example URLs?
>
> I have seen some, and I find it offensive.
>
> Specially if I have a hundred tabs open and I don't know which one is
> playing music at full blast.
>

Cool, man!
I'm going to find time to open a hundred Youtube classical music streams
all together.
I'll have Mozart, Beethoven, Tchaikovsky, Borodin, Brahms and Bach all
in one mighty cacophony; record it; and set it as a quiz for my friends
to pinpoint the individual pieces.

Ed

Carlos E. R., 2023-11-05 20:12:

> On 2023-11-05 19:17, Arno Welzel wrote:
>> Ed Cryer, 2023-11-04 20:22:
>>
>> [...]
>>> Many websites play background music. Quite apart from Youtube where I
>>> can get a full Brahms-like symphony orchestra blasting in my ears.
>>> Are they dangerous? Are they beyond the scope of my AV?
>>
>> "Many"? I don't know any website at all which does this. Do you have
>> some example URLs?
>
> I have seen some, and I find it offensive.
>
> Specially if I have a hundred tabs open and I don't know which one is
> playing music at full blast.

Most browsers nowadays show a loudspeaker icon on the tab to indicate
which tab is responsible for audio output.

--
Arno Welzel
https://arnowelzel.de

On 2023-11-05 20:19, Adam H. Kerman wrote:
> Carlos E. R. <robin_listas@es.invalid> wrote:
>> On 2023-11-05 06:01, Paul wrote:
>>> On 11/4/2023 3:22 PM, Ed Cryer wrote:
>>>> Paul wrote:
>>>>> On 11/4/2023 9:30 AM, Ed Cryer wrote:
>>

....

>>> A regular on USENET, had his computer room sacked by a phishing
>>> email (ransomware on all machines on LAN). The threat is real.
>>> He made the classic mistake, of clicking on an attachment.
>>> He was never the same after that (he was a small businessman
>>> at threads ends).
>>
>> "clicking on an attachment"... Windows, I guess? What type of
>> attachment, a diguised .exe, or some type of document with scripting? Or
>> something else?
>>
>> I'm curious :-)
>
> I use alpine from a shell account on a remote machine running Debian.
> It's a multiple-step process to get that attachment somewhere I could
> run it natively. Marking the message to be deleted is just the press of
> the "d" key.
>
> I'm not immune to acting against interest but just clicking on the
> attachment isn't likely to trap me. What has happened at times is that
> I've gotten an email message purporting to be from a vendor, and it's
> literally a vendor I use. It's happened a few times within days of
> having had a long discussion with the vendor.
>
> Totally freaks me out.

I use both Alpine and Thunderbird.

Occasionally I get spam purporting to be an invoice, please click on the
attachment. They are obviously malware.

Clues:

* The from address "name" doesn't match the actual address.

* They have a different reply-to address, or a different address in
the signature.

* The URLs, if any, don't point to the business they claim to be.

* The attachment that purports to be a document, is a windows executable.

All this is clearly visible in the TB preview of the message. There is
no problem _viewing_ the message in full, just don't click on anything.

(I simply hover with the mouse to see the actual URLs they point to)

I just hit "J" for junk and be done with it, good laugh.

What can be scary are well made social engineering emails, those can be
hard to spot.

So if I hear of a successful attack, I wonder how was it made, so that
we can learn from it.

A big problem for Windows users is confusion of "open" with "run", the
software hiding details, like the real extension of an attachment, or
the real address of people in emails.

A PDF could contain javascript code, so use by default a reader that
doesn't support javascript (so don't use adobe reader). Not a problem in
Linux, no reader supports it. An office document may also contain macros
or scripts. I know that LO by default refuses to run them, dunno about
M$ Office.

Then there have been security holes found even in jpg viewers. I don't
know/remember the details. Those things can pose a real problem, and the
reason to keep software updated.

--
Cheers,
Carlos E.R.

On 2023-11-05 21:25, Arno Welzel wrote:
> Carlos E. R., 2023-11-05 20:12:
>> On 2023-11-05 19:17, Arno Welzel wrote:
>>> Ed Cryer, 2023-11-04 20:22:
>>>
>>> [...]
>>>> Many websites play background music. Quite apart from Youtube where I
>>>> can get a full Brahms-like symphony orchestra blasting in my ears.
>>>> Are they dangerous? Are they beyond the scope of my AV?
>>>
>>> "Many"? I don't know any website at all which does this. Do you have
>>> some example URLs?
>>
>> I have seen some, and I find it offensive.
>>
>> Specially if I have a hundred tabs open and I don't know which one is
>> playing music at full blast.
>
> Most browsers nowadays show a loudspeaker icon on the tab to indicate
> which tab is responsible for audio output.

I have more tabs that are not visible. I also have several windows.

Yes, I eventually find it, but is not something I appreciate from a web
page. As a result, I can hate the company that owns the page, and not
buy whatever they sell.

--
Cheers,
Carlos E.R.

On 11/5/23 1:19 PM, Arno Welzel wrote:
> Ed Cryer, 2023-11-04 14:30:
>
>> With the old Outlook Express you could add one with just an insert.
>> Why not in Thunderbird?
> Because it is a stupid idea in the first place. Why should an e-mail ne
> allowed to start "background music"?
>
> Most likely this is also a security problem since it may require
> JavaScript and you really don't want to allow JavaScript in e-mails you
> get from other people.
>
Think sending a birthday card with happy birthday playing in the background

On 2023-11-06 08:48, Nic wrote:
> On 11/5/23 1:19 PM, Arno Welzel wrote:
>> Ed Cryer, 2023-11-04 14:30:
>>
>>> With the old Outlook Express you could add one with just an insert.
>>> Why not in Thunderbird?
>> Because it is a stupid idea in the first place. Why should an e-mail ne
>> allowed to start "background music"?
>>
>> Most likely this is also a security problem since it may require
>> JavaScript and you really don't want to allow JavaScript in e-mails you
>> get from other people.
>>
> Think sending a birthday card with happy birthday playing in the background

And it plays at full volume in the office when having a surreptitious
break to read personal email, right?

--
Cheers,
Carlos E.R.

On 11/4/23 08:30, Ed Cryer wrote:
> With the old Outlook Express you could add one with just an insert.
> Why not in Thunderbird?
>
> Ed

Because that's an annoying and pointless feature. If you want someone to
listen to background music while reading your email, just put a link at
the top of the message. If you're worried that people won't click the
link to listen to your music... Well that's kind of the point.

rdh wrote:
> On 11/4/23 08:30, Ed Cryer wrote:
>> With the old Outlook Express you could add one with just an insert.
>> Why not in Thunderbird?
>>
>> Ed
>
> Because that's an annoying and pointless feature. If you want someone to
> listen to background music while reading your email, just put a link at
> the top of the message. If you're worried that people won't click the
> link to listen to your music... Well that's kind of the point.

Or better (if you're competent enough) build your own HTML with the
music embedded, and send that.
Easy enough to do for a good programmer.
Oh and BTW, most people will have HTML switched off on their email
program, with the option to click it on.

Ed