4 ms·
Allowing anything other than plain text in email bodies was a terrible mistake.
by desro 2mo ago
Allowing anything other than plain text in email bodies was a terrible mistake.
- upofadown 2mo agoIt was never allowed. Microsoft just started doing it in their email client and obnoxiously made it default. There was no standards process where anyone spent time considering the potential downsides with the aim of making HTML email practical and secure. HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.
- Arnt 2mo agoThere was one, in the IETF. It went like this: "We should have a HTML profile, somewhat restricted, so that the people who want to send bold and italic and a little more can do that, and composers can know what's okay, and javascript isn't" and a little discussion, and then came people shouting "EVERYTHING EXCEPT TEXT/PLAIN IS THE DEVIL'S WORK!" and the whole thing dissolved due to the noise.
- 1718627440 2mo agoMUAs do render italics/bold, headlines, citations, etc. , so for just bold and italic HTML isn't required.
- Arnt 2mo agoNot sure what you're saying — do you have an actual production MUA with text/enriched support, or is it something else? Send me an example of whatever it is, please. Something with boldface but without HTML. arnt@gulbrandsen.priv.no.
- 1718627440 2mo agoJust regular Thunderbird rendering some common elements in plaintext mails. Just like e.g. Markdown is rendered on Github. This is what Markdown comes from after all.
- chuckadams 2mo agoIt was allowed before HTML even existed: MIME was invented for email.
- ranger_danger 2mo ago> It should be rejected/ignored if you are at all concerned about privacy and/or security. This is actively harmful advice that could easily get someone fired.
- iammrpayments 2mo agoEcommerce loves html in email, it would be interesting seeing them reverting to plain text but the backlash would be too great
- m3047 2mo agoFeel free to use https though, it's a self-signed cert. http://athena.m3047.net/pub/fwm/rfc-tree.pdf http://athena.m3047.net/pub/fwm/rfc-tree.pdf