4 ms·
The thougts on this article should not be about necessity of big e-mail messages, but rather on the heavy-handed and flat-out broken way Gmail truncates the mes
by pferde 7y ago
The thougts on this article should not be about necessity of big e-mail messages, but rather on the heavy-handed and flat-out broken way Gmail truncates the messages.
I mean, really, cutting right through HTML structure? That's just one webbrowser bug away from a security vulnerability exploitable by a well-crafted e-mail.
- dTal 7y agoSurely it has no effect on security - if a truncated message triggers a bug, then the sender can just... send that message to start with? No GMail truncation required.
- pferde 7y agoNot if the bug happens only when the truncation happens at the "right" place. As far as we know, no other e-mail client truncates e-mails exactly like Gmail.
- dTal 7y agoErm. I don't quite know how else to put this... what stops the malicious sender from sending an email "pre-truncated"? Emails are plain text underneath. Gmail's truncation contributes nothing that couldn't be accomplished on the sender side anyway.
- pferde 7y agoYou are right, it would probably be a long shot. I am basing this on some assumptions, such as that the truncation happens after Gmail's content sanitizing has already happened, not before. But even omitting the security aspect, such rude truncation is something I would have expected on some low-budget webmail app done as a high-school student's IT class project, not on a polished offering of a multi-billion company.
- jorangreef 7y agoNo, you are quite right about the security risk. It creates ambiguity, and ambiguity is just one step away from an exploit.
- heavenlyblue 7y agoI am pretty sure Google doesn't "filter" e-mails, they're almost surely doing a full rewrite through HTML-internal-HTML where internal is a safe representation of that e-mail.