Anthony J. Bentley wrote:
> Michael Richardson writes:
>> And given EFAIL, it seems that we were wise.
> nmh wise? I dunno. Part of EFAIL was that the mail client downloaded
> bits from the Internet and interleaved them seamlessly into the
> message.
No,
Ralph wrote:
> This seems to work here.
>
> nmh-access-url: printf '\e[31;1mexternal-body: %q\n'
Perfect, thanks!
David
--
nmh-workers
https://lists.nongnu.org/mailman/listinfo/nmh-workers
I'm definitely in favor of, by default, disabling anything that
causes automatic external data fetches to sites I might be
unaware of!
Bob
On Sun, 27 May 2018 10:15:29 -0400 Ken Hornstein sez:
> >> I don't know. History, probably.
> >> We used
>> I don't know. History, probably.
>> We used to assume everyone played nice.
>
>nmh-access-{ftp,url} were added less than 4 years ago. Ken, should we
>revisit? I don't have strong feelings, the only messages I've received
>that use it are from you and Ralph.
So, I read Anthony's email, and
Hi David,
> Alright, the user could call a script to sanitize the URL.
> Or not display it, such as by prepending with /bin/true.
This seems to work here.
nmh-access-url: printf '\e[31;1mexternal-body: %q\n'
--
Cheers, Ralph.
https://plus.google.com/+RalphCorderoy
--
nmh-workers
Ralph wrote:
> Content-Type: message/external-body; access-type="url";
> url="http://^[[39;1mexample^[[0m.org/^[[8;24;40t;
Alright, the user could call a script to sanitize the URL.
Or not display it, such as by prepending with /bin/true.
David
--
nmh-workers
Hi David,
> nmh-access-url: echo ^[[31\;1mSuppressed loading of
Thanks.
--
Cheers, Ralph.
https://plus.google.com/+RalphCorderoy
--
nmh-workers
https://lists.nongnu.org/mailman/listinfo/nmh-workers
Hi Anthony,
> - It leaks the IP address of my mail client simply by reading an
> email.
IIRC that was the motivation for me trying it; how many distinct IP
addresses hit the URL. Related to your point, I could know the
recipient viewed the email three times a couple of days ago, once from
Ken Hornstein writes:
> Respectfully ... the vulnerability with EFAIL was NOT that people downloaded
> stuff via HTTP.
I suppose I shouldn't say that *was* the vulnerability; but if mail
clients didn't fetch URLs embedded in the mail by default, EFAIL would
not have been possible.
> To the
>Michael Richardson writes:
>> And given EFAIL, it seems that we were wise.
>
>nmh wise? I dunno. Part of EFAIL was that the mail client downloaded
>bits from the Internet and interleaved them seamlessly into the message.
>That seems like an inherently dangerous thing to do... and nmh does it
Ralph wrote:
> Hi Anthony,
> > How do I disable this behavior
>
> Possibly by nobbling nmh-access-url in an mhn.defaults, e.g. /etc/nmh,
Or, add these to your profile:
nmh-access-ftp: echo ^[[31\;1mSuppressed loading of
nmh-access-url: echo ^[[31\;1mSuppressed loading of
The ANSI control
Hi Anthony,
> Part of EFAIL was that the mail client downloaded bits from the
> Internet and interleaved them seamlessly into the message.
IIRC it was that different adjacent parts were catenated if both
text/html before being sent to something to interpret the HTML. This
meant the join could
Michael Richardson writes:
> And given EFAIL, it seems that we were wise.
nmh wise? I dunno. Part of EFAIL was that the mail client downloaded
bits from the Internet and interleaved them seamlessly into the message.
That seems like an inherently dangerous thing to do... and nmh does it
with one
Hi,
Michael Richards, message ID <2726.1527268876@localhost>:
~
> And given EFAIL, it seems that we were wise.
Or not? I've been surprised by the odd bit of decoding nmh has done for
MIME parts, giving a text summary of the content. I
On Fri, 25 May 2018 20:39:26 -0400 Ken Hornstein sez:
> >Count me as another one of those few people who actually uses the
> >text/plain content. :-) For the most part, I don't read emails that are
> >HTML only unless I absolutely have to and if there's a text/plain
Ken wrote:
> I don't know why they
> even bother to generate such a lousy text/plain part, but this is the
> world we live in.
One airline based in America sends empty (just the newline)
text/plain parts in their purchase confirmation messages:
$ mhlist -noheader
65
Hi Jón,
> Ken writes:
> > I've seen a distressing number of times when the text/plain version
> > of a multipart/alternative message is not useful.
Yesterday's fun was working out why a `reset your password' URL didn't
work. Fill in the web page, submit, `Please correct the highlighted
errors',
Hi Tom,
> > sed 's/$/\n/' "$@" |
>
> Another idiom is: sed -eG.
Oh yes, that's better.
> > fmt -su |
>
> Interesting switches for fmt.
Well, I thought you could play around with what you prefer.
It's GNU fmt, which has annoying behaviour. Bring back _Software Tools_!
$ yes foo |
Ken Hornstein writes:
> My larger point is that, sadly, I've seen a distressing number of times
> when the text/plain version of a multipart/alternative message is not
> useful. I really wish people who have a shitty text/plain part would
> simply NOT bother and just generate
>Count me as another one of those few people who actually uses the
>text/plain content. :-) For the most part, I don't read emails that are
>HTML only unless I absolutely have to and if there's a text/plain I
>manage with that unless it's terrible.
My original draft of that email
Hi Ralph:
I appreciate your examples below, my comments about them are to show, I'm more
or less
following them. I'll probably use ideas from them in future bash functions.
On Thu 5/24/18 14:56 +0100 Ralph Corderoy wrote:
> > For the yahoo email client, no word wrapping is added to the
Andy Bradford wrote:
>> So, I don't think this is necessarily a nmh problem, like I said. From
>> a practical standpoint, you're probably one of the few people who
>> actually USES the text/plain content instead of the text/html content.
> Count me
Hi Andy,
> > you're probably one of the few people who actually USES the
> > text/plain
>
> Count me as another one of those few people
#MeToo. Given mhshow(1)'s -prefer, it's quite easy.
--
Cheers, Ralph.
https://plus.google.com/+RalphCorderoy
--
nmh-workers
Thus said Ken Hornstein on Thu, 24 May 2018 19:28:25 -0400:
> So, I don't think this is necessarily a nmh problem, like I said. From
> a practical standpoint, you're probably one of the few people who
> actually USES the text/plain content instead of the text/html content.
Count me as
>> Oh, good point; I had looked at mhfixmsg but it didn't seem like that
>> would have worked (but maybe it wasn't obvious to me how to make that
>> work).
>
>mhfixmsg has a -replacetextplain switch. But the html-to-text conversion
>is based on whatever the external converter does. Maybe pipe it
Ken wrote:
> Oh, good point; I had looked at mhfixmsg but it didn't seem like that
> would have worked (but maybe it wasn't obvious to me how to make that
> work).
mhfixmsg has a -replacetextplain switch. But the html-to-text conversion
is based on whatever the external converter does. Maybe
>> From a practical standpoint, you're probably one of the few people who
>> actually USES the text/plain content instead of the text/html content.
>
>> So, solutions?
>
>Given your discovery the the text/html looks good, another possibility
>might be to use it via repl's -convertargs switch.
Ken wrote:
> From a practical standpoint, you're probably one of the few people who
> actually USES the text/plain content instead of the text/html content.
> So, solutions?
Given your discovery the the text/html looks good, another possibility
might be to use it via repl's -convertargs switch.
Hi Tom,
> For the yahoo email client, no word wrapping is added to the received
> email, ie. there are no '\n's within the received paragraph (unlike
> gmail). Most importantly, for the yahoo client, each paragraph in the
> body of the original has to end in '\n\n\n' in order for there to be a
>
On Wed 5/23/18 10:24 -0400 Ken Hornstein wrote:
> >I agree it may not be a bug; it may be something in my nmh (or other?)
> >config files. I'm running fedora 27, with sendmail/procmail/rcvstore.
>
> So what EXACTLY is this bug you are reporting? I think that is the
> thing I don't understand.
Ken wrote:
> So what EXACTLY is this bug you are reporting? I think that is the
> thing I don't understand.
+1
Tom, I assume you're not using repl -convertargs. And my guess is that
your issue is on the repl side. I don't thing there have been any
significant changes to rcvstore in the last
>I agree it may not be a bug; it may be something in my nmh (or other?)
>config files. I'm running fedora 27, with sendmail/procmail/rcvstore.
So what EXACTLY is this bug you are reporting? I think that is the
thing I don't understand.
--Ken
--
nmh-workers
On Wed 5/23/18 9:23 -0400 Ken Hornstein wrote:
> >I have saved two example emails from two people I know, received after
> >my nmh 1.71 upgrade, with plain text content that have **no newlines**
> >in between paragraphs. My understanding is these authors are lay
> >people that write paragraphs
Hi Tom,
> I have saved two example emails
Can we see a part of the body from the mail's file for the detail.
If it's sensitive, run it through
tr A-Za-z a <`mhpath .` | tr 0-9 0
SMTP has a line-length limit and some MTAs, e.g. Sendmail, will forcibly
split lines that are too long,
34 matches
Mail list logo