Nic, 2023-11-06 08:48:

> On 11/5/23 1:19 PM, Arno Welzel wrote:
>> Ed Cryer, 2023-11-04 14:30:
>>
>>> With the old Outlook Express you could add one with just an insert.
>>> Why not in Thunderbird?
>> Because it is a stupid idea in the first place. Why should an e-mail ne
>> allowed to start "background music"?
>>
>> Most likely this is also a security problem since it may require
>> JavaScript and you really don't want to allow JavaScript in e-mails you
>> get from other people.
>>
> Think sending a birthday card with happy birthday playing in the background

This does not change the possible security risk.

--
Arno Welzel
https://arnowelzel.de

On 11/6/23 11:10, Ed Cryer wrote:
> Oh and BTW, most people will have HTML switched off on their email
> program, with the option to click it on.
>
> Ed

I'm not certain this is true anymore. The largest email providers are
Gmail and Microsoft, and both of them display HTML by default. Many
folks don't even know you can turn it off.

On 2023-11-08 16:07, rdh wrote:
> On 11/6/23 11:10, Ed Cryer wrote:
>> Oh and BTW, most people will have HTML switched off on their email
>> program, with the option to click it on.
>>
>> Ed
>
> I'm not certain this is true anymore. The largest email providers are
> Gmail and Microsoft, and both of them display HTML by default. Many
> folks don't even know you can turn it off.

Absolutely.

AFAIR the default since ever in Thunderbird is to display html by
default, and that's what I have. I've never turned it off, intentionally.

--
Cheers,
Carlos E.R.

On Wed, 8 Nov 2023 09:07:04 -0600, rdh <rdh@tilde.institute> wrote:

>On 11/6/23 11:10, Ed Cryer wrote:
>> Oh and BTW, most people will have HTML switched off on their email
>> program, with the option to click it on.
>>
>> Ed
>
>I'm not certain this is true anymore.

I strongly agree with you, In fact, in my experience, few people have
it turned off.

>The largest email providers are
>Gmail and Microsoft, and both of them display HTML by default. Many
>folks don't even know you can turn it off.

Probably most folks don't even know you can turn it off.

On 2023-11-08 17:20, Ken Blake wrote:
> On Wed, 8 Nov 2023 09:07:04 -0600, rdh <rdh@tilde.institute> wrote:
>
>> On 11/6/23 11:10, Ed Cryer wrote:
>>> Oh and BTW, most people will have HTML switched off on their email
>>> program, with the option to click it on.
>>>
>>> Ed
>>
>> I'm not certain this is true anymore.
>
> I strongly agree with you, In fact, in my experience, few people have
> it turned off.
>
>
>> The largest email providers are
>> Gmail and Microsoft, and both of them display HTML by default. Many
>> folks don't even know you can turn it off.
>
>
> Probably most folks don't even know you can turn it off.

Nor a reason why they should.

I use html myself, it allows me to format text nicely and easily.

*name a section*

have paragraph

1 have numbered or bulleted paragraphs
2 like this

Insert long lines with fixed font, like code, compact, non wrapping.

Insert tables

Nothing dangerous in those, just simple text formatting. Yes html can be
abused for bad things, but surely software should be able to deal with
those, and there is no other standard in email for formatted text.

Yes, the above can be done in plain text too, you can say. Well... it
needs effort or a sophisticated plain text editor which I don't really
have nor want to use. In html, I can delete or add words, and the
paragraphs will readjust automatically.

And anyway, Thunderbird will generate a plain text part automatically
included in the email fro those that prefer it.

Oh, it also allows to insert photos in context, not simply attached to
the end.

This is the XXI century, I see no reason to restrict myself to plain
text. I do if the other side demands it, and that's just a small number
of people.

--
Cheers,
Carlos E.R.

Am 08.11.23 um 16:22 schrieb Carlos E. R.:
> On 2023-11-08 16:07, rdh wrote:
>> On 11/6/23 11:10, Ed Cryer wrote:
>>> Oh and BTW, most people will have HTML switched off on their email
>>> program, with the option to click it on.
>>>
>>> Ed
>>
>> I'm not certain this is true anymore. The largest email providers are
>> Gmail and Microsoft, and both of them display HTML by default. Many
>> folks don't even know you can turn it off.
>
> Absolutely.
>
> AFAIR the default since ever in Thunderbird is to display html by
> default, and that's what I have. I've never turned it off, intentionally.

Same here. Modern newsletters are otherwise indigestible. TB in this
respect is not particularly vulnerable. Combined with a Linux or macOS
the residual security risk is negligible.

--
Gutta cavat lapidem (Ovid)

On 11/8/2023 2:13 PM, Carlos E. R. wrote:

> Yes html can be abused for bad things, but surely software should be able to deal with those,

That's an attack surface.

Typically HTML is used by corporations, not because they like
brown text on a purple background, but, because they install
HTML tracking materials (1x1 pixel images). Virtually all the
HTML in my Inbox, is tracking shit. None of it is "for appearance".

Sure, the ordinary end users put simply-formatted text and
inline images, as if it was DTP.

It's the "armed" HTML messages that you don't want.

Same goes for Javascript in PDF files. You can turn that off in
your PDF reader, and the reader will prompt you if there is
Javascript present. You can then "vet" whether Javascript
is necessary for the job or not, whether you're expecting to
see it in the doc you've fed the tool. For example, a travel
bureau, may put a movie inside the PDF promotional material,
and that may have a Javascript wrapper.

In the old days, on Windows, you might have to worry about
ActiveX as an attack surface. You'll notice support for ActiveX
has died with a "thump", by Microsoft trashing Internet Explorer
if you run a copy of it. (If Internet Explorer uses a default URL
at startup, the Microsoft site has put stuff in there, to cause
your copy of Internet Explorer to be rendered non-functional.)

*******

You could have attack surfaces thwarted via an AV. If you try
to double click on an attachment in an email, an AV may put up
a prompt stating this would not be a good idea. While they can
do a signature analysis, there may not be sufficient heuristic
protection for newly formulated attacks. Some AVs have no
heuristic capabilities at all.

Mozilla has added some code, which may be checking for stack-smashing,
which would be an example of heuristic detection. They're not
particularly worried about which platform they're on, they just
don't want an obvious exploit to go forward. You could think
of it as an "out of bounds" check. Even the hardware has an
out-of-bounds check, in that code segments can be marked read-only
once the loader has loaded them, which is a way of enforcing
a rule about "no self-modifying code".

Paul

On 2023-11-09 09:56, Paul wrote:
> On 11/8/2023 2:13 PM, Carlos E. R. wrote:
>
>> Yes html can be abused for bad things, but surely software should be able to deal with those,
>
> That's an attack surface.
>
> Typically HTML is used by corporations, not because they like
> brown text on a purple background, but, because they install
> HTML tracking materials (1x1 pixel images). Virtually all the
> HTML in my Inbox, is tracking shit. None of it is "for appearance".

To load those images, which are remotely, I have to click on Thunderbird
to load them, and it asks on each message.

If the letter comes from a company that already has my address because I
agreed to it, there is no harm in they tracking when I open the message.
IF I am interested, I don't load remote material on all.

> Sure, the ordinary end users put simply-formatted text and
> inline images, as if it was DTP.
>
> It's the "armed" HTML messages that you don't want.
>
> Same goes for Javascript in PDF files. You can turn that off in
> your PDF reader, and the reader will prompt you if there is
> Javascript present. You can then "vet" whether Javascript
> is necessary for the job or not, whether you're expecting to
> see it in the doc you've fed the tool. For example, a travel
> bureau, may put a movie inside the PDF promotional material,
> and that may have a Javascript wrapper.

I have no PDF reader with Javascript capabilities. I would like to have
at least one, but there aren't any on Linux AFAIK.

>
> In the old days, on Windows, you might have to worry about
> ActiveX as an attack surface. You'll notice support for ActiveX
> has died with a "thump", by Microsoft trashing Internet Explorer
> if you run a copy of it. (If Internet Explorer uses a default URL
> at startup, the Microsoft site has put stuff in there, to cause
> your copy of Internet Explorer to be rendered non-functional.)
>
> *******
>
> You could have attack surfaces thwarted via an AV. If you try
> to double click on an attachment in an email, an AV may put up
> a prompt stating this would not be a good idea. While they can
> do a signature analysis, there may not be sufficient heuristic
> protection for newly formulated attacks. Some AVs have no
> heuristic capabilities at all.
>
> Mozilla has added some code, which may be checking for stack-smashing,
> which would be an example of heuristic detection. They're not
> particularly worried about which platform they're on, they just
> don't want an obvious exploit to go forward. You could think
> of it as an "out of bounds" check. Even the hardware has an
> out-of-bounds check, in that code segments can be marked read-only
> once the loader has loaded them, which is a way of enforcing
> a rule about "no self-modifying code".
>
> Paul

--
Cheers,
Carlos E.R.