spam mails using image/gif in multipart/alternative

spam mails using image/gif in multipart/alternative

[Reiner Steib]

Hi,

within the last days, I've seen several spam mails on Gmane with such
a MIME structure[1]:

  <* mixed> Re: unaccommodating
  <1.* alternative>
  <1.1.* alternative>
  <1.1.1 text>
  <1.1.2 html>
  <1.2 gif>
  <2 text>

Gnus displays the image/gif part for me, probably also with the
default settings.

I've committed an addition to the doc string (feel free to improve).
Maybe we should even add "image/.*" in the default?

,----[ <f1> v mm-discouraged-alternatives RET ]
| mm-discouraged-alternatives is a variable defined in `mm-decode.el'.
| Its value is nil
| 
| Documentation:
| List of MIME types that are discouraged when viewing multipart/alternative.
| Viewing agents are supposed to view the last possible part of a message,
| as that is supposed to be the richest.  However, users may prefer other
| types instead, and this list says what types are most unwanted.  If,
| for instance, text/html parts are very unwanted, and text/richtext are
| somewhat unwanted, then the value of this variable should be set
| to:
| 
|  ("text/html" "text/richtext")
| 
| Adding "image/.*" might also be useful.  Spammers use it as the
| prefered part of multipart/alternative messages.
| 
| You can customize this variable.
| 
| [back]
`----

I also fixed the custom type: Matching is done with `string-match' in
`mm-preferred-alternative-precedence' so it should be regexp instead
of string.

Bye, Reiner.

[1] <000001c5fc32$17c2e4a0$486ea8c0__328.46739418364$1134072149$gmane$org@corridor>
    <000001c5f776$d20769f0$d424a8c0@surprising>)
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/

Re: spam mails using image/gif in multipart/alternative

[Katsumi Yamaoka]

>>>>> In <v94q5j5m1q.fsf@marauder.physik.uni-ulm.de> Reiner Steib wrote:

> Maybe we should even add "image/.*" in the default?

It would be nice.  Actually, I've been doing so all the time and
recommended it to folks several times.

> ,----[ <f1> v mm-discouraged-alternatives RET ]
>| mm-discouraged-alternatives is a variable defined in `mm-decode.el'.
>| Its value is nil

[...]

>| Adding "image/.*" might also be useful.  Spammers use it as the
>| prefered part of multipart/alternative messages.

My setting is:

(setq gnus-buttonized-mime-types
      '("multipart/alternative" "multipart/signed")
      mm-discouraged-alternatives
      '("image/.+"))

Re: spam mails using image/gif in multipart/alternative

[Reiner Steib]

On Thu, Dec 08 2005, Katsumi Yamaoka wrote:

>>>>>> In <v94q5j5m1q.fsf@marauder.physik.uni-ulm.de> Reiner Steib wrote:
>
>> Maybe we should even add "image/.*" in the default?
>
> It would be nice.  Actually, I've been doing so all the time and
> recommended it to folks several times.

I've used the following up to now:

(setq
 mm-discouraged-alternatives
 '("text/html" "text/richtext" "text/enriched" "multipart/related")
 mm-automatic-display (remove "text/html" mm-automatic-display)
 gnus-buttonized-mime-types '(".*/signed"))

I newer saw legitimate preferred image/.* parts in
multipart/alternative, but I hesitate to make such change based on my
usage only.  If everyone agrees with this, we could change the
default.  (Only in the trunk or in v5-10 too?  Is it a bug that Gnus
displays image/* spam?)  Opinions?

> My setting is:
>
> (setq gnus-buttonized-mime-types
>       '("multipart/alternative" "multipart/signed")
>       mm-discouraged-alternatives
>       '("image/.+"))

Interesting idea!  It allows to pick the alternative (text, html, gif)
an displays the plain/text at first:

,----
| 1.  (*) multipart/alternative  ( ) image/gif           
| 
| 2.  (*) text/plain          ( ) text/html           
`----

Could you please add this suggestion as an example to the manual?
(Maybe we write "/.*" instead of "/.+" as in other places; the
difference might confuse newbies.  Or we could change everything to
"/.+" which is slightly more exact.)

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/

Re: spam mails using image/gif in multipart/alternative

[Katsumi Yamaoka]

>>>>> In <v9zmnave9s.fsf@marauder.physik.uni-ulm.de> Reiner Steib wrote:

> I've used the following up to now:

> (setq
>  mm-discouraged-alternatives
>  '("text/html" "text/richtext" "text/enriched" "multipart/related")
>  mm-automatic-display (remove "text/html" mm-automatic-display)
>  gnus-buttonized-mime-types '(".*/signed"))

> I newer saw legitimate preferred image/.* parts in
> multipart/alternative, but I hesitate to make such change based on my
> usage only.  If everyone agrees with this, we could change the
> default.  (Only in the trunk or in v5-10 too?  Is it a bug that Gnus
> displays image/* spam?)  Opinions?

I don't know how a multipart/alternative mail of which the second
part is an image is useful (they are often pictures of pills ;-).
There might be mailers which display both of two parts.  (Gnus
may have to do so if content types of two parts are different,
e.g., one is text/*, the other is image/*.)

At any rate, I think making it default to (image/.*) is commonly
useful because most of such mails are spam and it is not worth
seeing such images.

>> My setting is:
>>
>> (setq gnus-buttonized-mime-types
>>       '("multipart/alternative" "multipart/signed")
>>       mm-discouraged-alternatives
>>       '("image/.+"))

> Interesting idea!  It allows to pick the alternative (text, html, gif)
> an displays the plain/text at first:

> ,----
>| 1.  (*) multipart/alternative  ( ) image/gif
>|
>| 2.  (*) text/plain          ( ) text/html
> `----

> Could you please add this suggestion as an example to the manual?

I'll do it next week.

> (Maybe we write "/.*" instead of "/.+" as in other places; the
> difference might confuse newbies.  Or we could change everything to
> "/.+" which is slightly more exact.)

I'll also use `.*' since the differences aren't significant.

Re: spam mails using image/gif in multipart/alternative

[Katsumi Yamaoka]

>>>>> In <b4mhd9io3mh.fsf@jpl.org> Katsumi Yamaoka wrote:

>>> My setting is:
>>>
>>> (setq gnus-buttonized-mime-types
>>>       '("multipart/alternative" "multipart/signed")
>>>       mm-discouraged-alternatives
>>>       '("image/.+"))

>> Interesting idea!  It allows to pick the alternative (text, html, gif)
>> an displays the plain/text at first:

>> ,----
>>| 1.  (*) multipart/alternative  ( ) image/gif
>>|
>>| 2.  (*) text/plain          ( ) text/html
>> `----

>> Could you please add this suggestion as an example to the manual?

> I'll do it next week.

I'd already done.  However, I probably have misunderstood it.

`gnus-buttonized-mime-types'
[...]
     You could also add `"multipart/alternative"' to this list to
     display radio buttons that allow you to choose one of two media
     types those mails include.  See also `mm-discouraged-alternatives'
     (*note Display Customization: (emacs-mime)Display Customization.).

Even if "multipart/alternative" is not added to this variable,
radio buttons are displayed by default.  I'll fix those
descriptions next week.  Sorry.

Re: spam mails using image/gif in multipart/alternative

[Katsumi Yamaoka]

>>>>> In <b4mwti5dybz.fsf@jpl.org> Katsumi Yamaoka wrote:

> However, I probably have misunderstood it.

> `gnus-buttonized-mime-types'
> [...]
>      You could also add `"multipart/alternative"' to this list to
>      display radio buttons that allow you to choose one of two media
>      types those mails include.  See also `mm-discouraged-alternatives'
>      (*note Display Customization: (emacs-mime)Display Customization.).

> Even if "multipart/alternative" is not added to this variable,
> radio buttons are displayed by default.

I was completely confused, but those descriptions are correct. ;-p
I've added the example of a setting for gnus-buttonized-mime-types
and mm-discouraged-alternatives in emacs-mime.texi.

multipart/alternative in gnus-buttonized-mime-types (was: spam mails using image/gif in multipart/alternative)

[Reiner Steib]

On Thu, Dec 08 2005, Katsumi Yamaoka wrote:

> My setting is:
>
> (setq gnus-buttonized-mime-types
>       '("multipart/alternative" "multipart/signed")
>       mm-discouraged-alternatives
>       '("image/.+"))

An inconvenience with this is that...

| 1.  (*) text/plain          ( ) text/html           

... also appears in the cited text when using `F' or `R'.

Bye, Reiner.
-- 
       ,,,
      (o o)
---ooO-(_)-Ooo---  |  PGP key available  |  http://rsteib.home.pages.de/

Re: multipart/alternative in gnus-buttonized-mime-types

[Katsumi Yamaoka]

>>>>> In <v9fyouz8jl.fsf_-_@marauder.physik.uni-ulm.de> Reiner Steib wrote:

> On Thu, Dec 08 2005, Katsumi Yamaoka wrote:

>> My setting is:
>>
>> (setq gnus-buttonized-mime-types
>>       '("multipart/alternative" "multipart/signed")
>>       mm-discouraged-alternatives
>>       '("image/.+"))

> An inconvenience with this is that...

>| 1.  (*) text/plain          ( ) text/html           

> ... also appears in the cited text when using `F' or `R'.

Yes, it's a trouble also for me.  Though it's easy to delete
them manually, it is likely to forget to do so.  I'll try to
delete them in the gnus-article-copy buffer, but buttons except
for automatically inlined parts might not have to be deleted.

In addition to this, I want to reply to the text/plain parts
even though I prefer to display the text/html parts.  It might
be hard to realize it, though.

P.S.
Mails sent to @jpl.org tends to stagnate now, but I can read all
the mailing lists gatewayed to Gmane.

Re: multipart/alternative in gnus-buttonized-mime-types

[Katsumi Yamaoka]

>>>>> In <b4mek4erm42.fsf@jpl.org> Katsumi Yamaoka wrote:

>>>>>> In <v9fyouz8jl.fsf_-_@marauder.physik.uni-ulm.de> Reiner Steib wrote:

>>| 1.  (*) text/plain          ( ) text/html           

>> ... also appears in the cited text when using `F' or `R'.

> Yes, it's a trouble also for me.  Though it's easy to delete
> them manually, it is likely to forget to do so.  I'll try to
> delete them in the gnus-article-copy buffer,

Installed in the trunk.

> but buttons except for automatically inlined parts might not
> have to be deleted.

It was needless anxiety.  Gnus had already tagged buttons which
are assumed to be useless as `annotation's, and removed.

> In addition to this, I want to reply to the text/plain parts
> even though I prefer to display the text/html parts.  It might
> be hard to realize it, though.

I might do that when I have time to spare.