privacy problem: text/html parts pull in network resources

2015-01-30 Thread David Edmondson
On Thu, Jan 29 2015, Daniel Kahn Gillmor wrote: > On Wed 2015-01-28 18:57:25 -0500, Jinwoo Lee wrote: >> Do you mind if I add a boolean defcustom, which determines whether to >> block remote images? Its default value will be T (block), but people >> who want to see remote images can customize it.

Re: privacy problem: text/html parts pull in network resources

2015-01-30 Thread David Edmondson
On Thu, Jan 29 2015, Daniel Kahn Gillmor wrote: On Wed 2015-01-28 18:57:25 -0500, Jinwoo Lee wrote: Do you mind if I add a boolean defcustom, which determines whether to block remote images? Its default value will be T (block), but people who want to see remote images can customize it. I

privacy problem: text/html parts pull in network resources

2015-01-29 Thread Daniel Kahn Gillmor
On Wed 2015-01-28 18:57:25 -0500, Jinwoo Lee wrote: > Do you mind if I add a boolean defcustom, which determines whether to > block remote images? Its default value will be T (block), but people > who want to see remote images can customize it. I have no objection to this kind of knob in an

privacy problem: text/html parts pull in network resources

2015-01-29 Thread Jinwoo Lee
On Thu, Jan 29, 2015 at 10:03 AM, Daniel Kahn Gillmor wrote: > On Wed 2015-01-28 18:57:25 -0500, Jinwoo Lee wrote: >> Do you mind if I add a boolean defcustom, which determines whether to >> block remote images? Its default value will be T (block), but people >> who want to see remote images can

Re: privacy problem: text/html parts pull in network resources

2015-01-29 Thread Daniel Kahn Gillmor
On Wed 2015-01-28 18:57:25 -0500, Jinwoo Lee wrote: Do you mind if I add a boolean defcustom, which determines whether to block remote images? Its default value will be T (block), but people who want to see remote images can customize it. I have no objection to this kind of knob in an already

Re: privacy problem: text/html parts pull in network resources

2015-01-29 Thread Jinwoo Lee
On Thu, Jan 29, 2015 at 10:03 AM, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On Wed 2015-01-28 18:57:25 -0500, Jinwoo Lee wrote: Do you mind if I add a boolean defcustom, which determines whether to block remote images? Its default value will be T (block), but people who want to see

privacy problem: text/html parts pull in network resources

2015-01-28 Thread Jinwoo Lee
On Tue, Jan 27, 2015 at 08:44 PM, Jinwoo Lee wrote: > On Tue, Jan 27, 2015 at 07:47 PM, Daniel Kahn Gillmor fifthhorseman.net> wrote: >> On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: >>> Daniel Kahn Gillmor writes: >>> If i send a message with a text/html part (either it's only

Re: privacy problem: text/html parts pull in network resources

2015-01-28 Thread Jinwoo Lee
On Tue, Jan 27, 2015 at 08:44 PM, Jinwoo Lee jinwo...@gmail.com wrote: On Tue, Jan 27, 2015 at 07:47 PM, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: Daniel Kahn Gillmor d...@fifthhorseman.net writes: If i send a message with a

privacy problem: text/html parts pull in network resources

2015-01-27 Thread Daniel Kahn Gillmor
On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: > Daniel Kahn Gillmor writes: > >> If i send a message with a text/html part (either it's only text/html, >> or all parts are rendered, or it's multipart/alternative with only a >> text/html subpart) and that HTML has >

privacy problem: text/html parts pull in network resources

2015-01-27 Thread Jinwoo Lee
On Tue, Jan 27, 2015 at 07:47 PM, Daniel Kahn Gillmor wrote: > On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: >> Daniel Kahn Gillmor writes: >> >>> If i send a message with a text/html part (either it's only text/html, >>> or all parts are rendered, or it's multipart/alternative with

Re: privacy problem: text/html parts pull in network resources

2015-01-27 Thread Jinwoo Lee
On Tue, Jan 27, 2015 at 07:47 PM, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: Daniel Kahn Gillmor d...@fifthhorseman.net writes: If i send a message with a text/html part (either it's only text/html, or all parts are rendered, or

Re: privacy problem: text/html parts pull in network resources

2015-01-27 Thread Daniel Kahn Gillmor
On Sun 2015-01-25 12:51:43 -0500, David Bremner wrote: Daniel Kahn Gillmor d...@fifthhorseman.net writes: If i send a message with a text/html part (either it's only text/html, or all parts are rendered, or it's multipart/alternative with only a text/html subpart) and that HTML has img

privacy problem: text/html parts pull in network resources

2015-01-25 Thread David Bremner
Daniel Kahn Gillmor writes: > If i send a message with a text/html part (either it's only text/html, > or all parts are rendered, or it's multipart/alternative with only a > text/html subpart) and that HTML has src="http://example.org/test.png"/> in it, then notmuch will make a > network

Re: privacy problem: text/html parts pull in network resources

2015-01-25 Thread David Bremner
Daniel Kahn Gillmor d...@fifthhorseman.net writes: If i send a message with a text/html part (either it's only text/html, or all parts are rendered, or it's multipart/alternative with only a text/html subpart) and that HTML has img src=http://example.org/test.png/ in it, then notmuch will

privacy problem: text/html parts pull in network resources

2015-01-22 Thread Tomi Ollila
On Wed, Jan 21 2015, Daniel Kahn Gillmor wrote: > If i send a message with a text/html part (either it's only text/html, > or all parts are rendered, or it's multipart/alternative with only a > text/html subpart) and that HTML has src="http://example.org/test.png"/> in it, then notmuch will

privacy problem: text/html parts pull in network resources

2015-01-21 Thread David Bremner
Austin Clements writes: > I have a fix for this on shr buried deep in an old patch series that I > never got back to: id:1398105468-14317-12-git-send-email-amdragon at mit.edu > > For shr, the key is to set shr-blocked-images to ".". However, IIRC, > in the current notmuch message rendering

privacy problem: text/html parts pull in network resources

2015-01-21 Thread Austin Clements
Quoth Daniel Kahn Gillmor on Jan 21 at 4:36 pm: > On Wed 2015-01-21 16:14:07 -0500, Austin Clements wrote: > > I have a fix for this on shr buried deep in an old patch series that I > > never got back to: id:1398105468-14317-12-git-send-email-amdragon at mit.edu > > > > For shr, the key is to set

privacy problem: text/html parts pull in network resources

2015-01-21 Thread Daniel Kahn Gillmor
On Wed 2015-01-21 16:14:07 -0500, Austin Clements wrote: > I have a fix for this on shr buried deep in an old patch series that I > never got back to: id:1398105468-14317-12-git-send-email-amdragon at mit.edu > > For shr, the key is to set shr-blocked-images to ".". I've just done this, but it

privacy problem: text/html parts pull in network resources

2015-01-21 Thread Austin Clements
I have a fix for this on shr buried deep in an old patch series that I never got back to: id:1398105468-14317-12-git-send-email-amdragon at mit.edu For shr, the key is to set shr-blocked-images to ".". However, IIRC, in the current notmuch message rendering pipeline, mm overrides this variable

privacy problem: text/html parts pull in network resources

2015-01-21 Thread Daniel Kahn Gillmor
If i send a message with a text/html part (either it's only text/html, or all parts are rendered, or it's multipart/alternative with only a text/html subpart) and that HTML has http://example.org/test.png"/> in it, then notmuch will make a network request for that image. This is a privacy

Re: privacy problem: text/html parts pull in network resources

2015-01-21 Thread Austin Clements
I have a fix for this on shr buried deep in an old patch series that I never got back to: id:1398105468-14317-12-git-send-email-amdra...@mit.edu For shr, the key is to set shr-blocked-images to .. However, IIRC, in the current notmuch message rendering pipeline, mm overrides this variable with

Re: privacy problem: text/html parts pull in network resources

2015-01-21 Thread Daniel Kahn Gillmor
On Wed 2015-01-21 16:14:07 -0500, Austin Clements wrote: I have a fix for this on shr buried deep in an old patch series that I never got back to: id:1398105468-14317-12-git-send-email-amdra...@mit.edu For shr, the key is to set shr-blocked-images to .. I've just done this, but it doesn't

Re: privacy problem: text/html parts pull in network resources

2015-01-21 Thread David Bremner
Austin Clements acleme...@csail.mit.edu writes: I have a fix for this on shr buried deep in an old patch series that I never got back to: id:1398105468-14317-12-git-send-email-amdra...@mit.edu For shr, the key is to set shr-blocked-images to .. However, IIRC, in the current notmuch message

Re: privacy problem: text/html parts pull in network resources

2015-01-21 Thread Austin Clements
Quoth Daniel Kahn Gillmor on Jan 21 at 4:36 pm: On Wed 2015-01-21 16:14:07 -0500, Austin Clements wrote: I have a fix for this on shr buried deep in an old patch series that I never got back to: id:1398105468-14317-12-git-send-email-amdra...@mit.edu For shr, the key is to set

Re: privacy problem: text/html parts pull in network resources

2015-01-21 Thread Tomi Ollila
On Wed, Jan 21 2015, Daniel Kahn Gillmor d...@fifthhorseman.net wrote: If i send a message with a text/html part (either it's only text/html, or all parts are rendered, or it's multipart/alternative with only a text/html subpart) and that HTML has img src=http://example.org/test.png/ in it,