Announcements and discussions for Gnus, the GNU Emacs Usenet newsreader
 help / color / mirror / Atom feed
* rendering HTML: how to disable
@ 2014-11-29  8:57 Bernardo
  0 siblings, 0 replies; 28+ messages in thread
From: Bernardo @ 2014-11-29  8:57 UTC (permalink / raw)
  To: info-gnus-english


Hi,

(climbing a steep learning curve as a Gnus newbie ...)

i noticed that some slimy email senders (e.g LinkedIn etc) in their
(HTML formatted) email include URLs which i suspect are used to track
users when opening them;

is there a way to suppress loading/rendering those URLs in Gnus by
default and just show the link address?

looked in the manual under "Article Washing" but soon got lost;
mm-text-html-renderer looked like a lead but i'm not convinced this is
what i want;




^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2015-04-04  0:51               ` Bernardo
@ 2015-04-04 12:25                 ` Adam Sjøgren
  0 siblings, 0 replies; 28+ messages in thread
From: Adam Sjøgren @ 2015-04-04 12:25 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

> luckily (?) i kept an old LinkedIn email and it doesn't establish
> network connections when read, unlike the other one mentioned earlier;
> (checked with Wireshark too, there were no DNS address resolution calls
> either)
>
> however its header says the content is "multipart" rather than
> "text/html" and my guess is the renderer handles it better

Yes, this is what I suspected - with the multipart your configuration of
discouraged alternatives makes Gnus not choose the html-part, but when
there only _is_ text/html, it is displayed (rather than displaying
nothing). That is what "discouraged" is supposed to mean, as far as I
understand it.

That does not explain, however, why you get pictures when it seems like
you the default configuration, which should not fetch them. (Which I
can't reproduce, but maybe I'm doing something different).

> PS
>  didn't know about 'ngrep', looks interesting, will check that too,
>  thanks

I find it much easier to use than tcpdump, wireshark etc. :-)


  Best regards,

    Adam

-- 
 "It troo! Dat darn Kahlfin stole ma spacechip!"              Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2015-04-03 12:09             ` Adam Sjøgren
@ 2015-04-04  0:51               ` Bernardo
  2015-04-04 12:25                 ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Bernardo @ 2015-04-04  0:51 UTC (permalink / raw)
  To: info-gnus-english



> Adam writes:
>
>>> guess i'll need to spend a bit more time trying to figure out how to
>>> tackle this
>
>> It does sound odd, the defaults are supposed to be "safe".
>
> I just opened a bunch of LinkedIn HTML emails while running "ngrep -W
> byline port 80", and the only http requests sent was for gravatar.com
> (which I have explicitly enabled by setting gnus-treat-from-gravatar);
> I can't reproduce the problem.
>

luckily (?) i kept an old LinkedIn email and it doesn't establish
network connections when read, unlike the other one mentioned earlier;
(checked with Wireshark too, there were no DNS address resolution calls
either)

however its header says the content is "multipart" rather than
"text/html" and my guess is the renderer handles it better

Content-Type: multipart/alternative;  boundary="----=_Part_3599110_1802681978.1416230194432"

yes, i might have a closer look at this, but not now (Easter, meeting
people etc)


Rgds, Bernardo


PS
 didn't know about 'ngrep', looks interesting, will check that too,
 thanks




^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
       [not found]     ` <mailman.3220.1428049535.31049.info-gnus-english@gnu.org>
@ 2015-04-03 18:27       ` Emanuel Berg
  0 siblings, 0 replies; 28+ messages in thread
From: Emanuel Berg @ 2015-04-03 18:27 UTC (permalink / raw)
  To: info-gnus-english

Bernardo <bernardo.bacic@pobox.com> writes:

> Guess just setting 'mm-discouraged-alternatives' is
> required but not sufficient for preventing such
> behaviour. Any other ways from within Gnus this
> could be prevented?

This is all I ever needed:

    (setq mm-discouraged-alternatives '("text/html" "text/richtext"))

-- 
underground experts united
http://user.it.uu.se/~embe8573

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2015-04-03 12:05           ` Adam Sjøgren
@ 2015-04-03 12:09             ` Adam Sjøgren
  2015-04-04  0:51               ` Bernardo
  0 siblings, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2015-04-03 12:09 UTC (permalink / raw)
  To: info-gnus-english

Adam writes:

>> guess i'll need to spend a bit more time trying to figure out how to
>> tackle this

> It does sound odd, the defaults are supposed to be "safe".

I just opened a bunch of LinkedIn HTML emails while running "ngrep -W
byline port 80", and the only http requests sent was for gravatar.com
(which I have explicitly enabled by setting gnus-treat-from-gravatar);
I can't reproduce the problem.


  Best regards,

    Adam

-- 
 "In his words, Emacs is elegant, UNIX arcane."               Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2015-04-03 11:50         ` Bernardo
@ 2015-04-03 12:05           ` Adam Sjøgren
  2015-04-03 12:09             ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2015-04-03 12:05 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

> looks like both settings are pretty standard:
>
> gnus-blocked-images is a variable defined in `gnus-art.el'.
> Its value is gnus-block-private-groups

> mm-text-html-renderer is a variable defined in `mm-decode.el'.
> Its value is shr

Ok, then Gnus shouldn't fetch the images, as far as I can see.

> a quick look at gnus-block-private-groups didn't reveal why it's not
> behaving as expected

You can always run M-x edebug-defun with the cursor at the beginning of
the function, and see if it returns what is expected, stepping through
it when called.

> guess i'll need to spend a bit more time trying to figure out how to
> tackle this

It does sound odd, the defaults are supposed to be "safe".


  Best regards,

    Adam

-- 
 "Frankly, I'd like to have the issue resolved before         Adam Sjøgren
  I expend any more energy on this."                     asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2015-04-03  9:57       ` Adam Sjøgren
@ 2015-04-03 11:50         ` Bernardo
  2015-04-03 12:05           ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Bernardo @ 2015-04-03 11:50 UTC (permalink / raw)
  To: info-gnus-english


>
>> i still have an HTML formatted email which when opened makes
>> connections on the web;
>
> If you are using 'shr' to show HTML (the (new(ish)) default, check the
> variable mm-text-html-renderer), this variable should govern in which
> groups images are fetched automatically:
>
> ,----[ C-h v gnus-blocked-images RET ]
> | gnus-blocked-images is a variable defined in `gnus-art.el'.
> | Its value is gnus-block-private-groups
> | 
> | Documentation:
> | Images that have URLs matching this regexp will be blocked.
> | This can also be a function to be evaluated.  If so, it will be
> | called with the group name as the parameter, and should return a
> | regexp.
> | 
> | You can customize this variable.
> | 
> | This variable was introduced, or its default value was changed, in
> | version 24.1 of Emacs.
> `----
>
> The default 'gnus-block-private-groups is to not fetch images in
> "private groups" (i.e. only in "regular" newsgroups).
>
> So maybe you are using something else - like w3m? In that case you might
> want check what mm-w3m-safe-url-regexp is set to.
>
> [...]
>
>> mm-discouraged-alternatives is a variable defined in `mm-decode.el'.
>> Its value is ("text/html" "text/richtext" "image/.*")
>> Original value was nil
>
> I guess this doesn't help much if the only type the email contains is
> "text/html" - 'discouraged' means "not preferred", rather than "not
> chosen for display at all", I think.
>

looks like both settings are pretty standard:

gnus-blocked-images is a variable defined in `gnus-art.el'.
Its value is gnus-block-private-groups

mm-text-html-renderer is a variable defined in `mm-decode.el'.
Its value is shr

from memory, i think Thunderbird can "wash" HTML emails and prevent such
leaking of user's reading habits but i stopped using for other reasons

a quick look at gnus-block-private-groups didn't reveal why it's not
behaving as expected

guess i'll need to spend a bit more time trying to figure out how to
tackle this


thanks anyway

-- 
Rgds, Bernardo





^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2015-04-03  8:22     ` Bernardo
@ 2015-04-03  9:57       ` Adam Sjøgren
  2015-04-03 11:50         ` Bernardo
  0 siblings, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2015-04-03  9:57 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

> i still have an HTML formatted email which when opened makes
> connections on the web;

If you are using 'shr' to show HTML (the (new(ish)) default, check the
variable mm-text-html-renderer), this variable should govern in which
groups images are fetched automatically:

,----[ C-h v gnus-blocked-images RET ]
| gnus-blocked-images is a variable defined in `gnus-art.el'.
| Its value is gnus-block-private-groups
| 
| Documentation:
| Images that have URLs matching this regexp will be blocked.
| This can also be a function to be evaluated.  If so, it will be
| called with the group name as the parameter, and should return a
| regexp.
| 
| You can customize this variable.
| 
| This variable was introduced, or its default value was changed, in
| version 24.1 of Emacs.
`----

The default 'gnus-block-private-groups is to not fetch images in
"private groups" (i.e. only in "regular" newsgroups).

So maybe you are using something else - like w3m? In that case you might
want check what mm-w3m-safe-url-regexp is set to.

[...]

> mm-discouraged-alternatives is a variable defined in `mm-decode.el'.
> Its value is ("text/html" "text/richtext" "image/.*")
> Original value was nil

I guess this doesn't help much if the only type the email contains is
"text/html" - 'discouraged' means "not preferred", rather than "not
chosen for display at all", I think.


  Best regards,

    Adam

-- 
 "Facebook cannot control emotions of users. Facebook         Adam Sjøgren
  will not control emotions of users." - Facebook's COO  asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-29 20:50   ` Bernardo
  2014-11-29 21:12     ` Adam Sjøgren
       [not found]     ` <mailman.14972.1417295555.1147.info-gnus-english@gnu.org>
@ 2015-04-03  8:22     ` Bernardo
  2015-04-03  9:57       ` Adam Sjøgren
       [not found]     ` <mailman.3220.1428049535.31049.info-gnus-english@gnu.org>
  3 siblings, 1 reply; 28+ messages in thread
From: Bernardo @ 2015-04-03  8:22 UTC (permalink / raw)
  To: info-gnus-english


An old problem revisited

>>> LinkedIn etc) in their (HTML formatted) email
>>> include URLs which i suspect are used to track users
>>> when opening them
>>
>> Try this:
>>
>>     (setq mm-discouraged-alternatives '("text/html" "text/richtext"))
>
> ah, much better, thanks
>
>>
>> Otherwise doesn't it work just by not following the
>> URLs?
>
> AFAICT the page pointed by URL is loaded as soon as soon as the message
> is opened, to the rejoicing of spammers


i still have an HTML formatted email which when opened makes connections
on the web; the email headers, among other things show this:

Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable

as it happens, i'm permanently running a home brewed (quick 'n' dirty)
script which monitors TCP connections, this is what it shows when
the offending email is viewed:

18:32:52  SYN                 68.232.35.48:80   4434478
18:32:53  ESTABL              68.232.35.48:80
18:32:53  ESTABL            59.100.127.135:80
18:32:53  ------              68.232.35.48:80
18:32:55  SYN                 68.232.35.48:80   4434483
18:32:55  ESTABL              68.232.35.48:80
18:32:56  ------              68.232.35.48:80
18:33:01  ESTABL            59.100.127.135:80


the Gnus variable mm-discouraged-alternatives value is:

mm-discouraged-alternatives is a variable defined in `mm-decode.el'.
Its value is ("text/html" "text/richtext" "image/.*")
Original value was nil

If i open another email message and go back to the offending one, the
TCP connections are established again.

But that's not all, i've this time, for a good measure, fired up
Wireshark and on opening the message it showed a two dozen DNS queries
(which go over UDP) for the domains that had "marketing" and "images" in
their name.

Guess just setting 'mm-discouraged-alternatives' is required but not
sufficient for preventing such behaviour. Any other ways from within
Gnus this could be prevented?

"GNU Emacs 25.0.50.1 (i686-pc-linux-gnu, GTK+ Version 3.4.2) of
2015-03-08 on deb"

"Gnus v5.13"

-- 
Rgds, Bernardo





^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-12-02 10:38               ` Bernardo
@ 2014-12-02 10:43                 ` Adam Sjøgren
  0 siblings, 0 replies; 28+ messages in thread
From: Adam Sjøgren @ 2014-12-02 10:43 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

> turns out that was my misunderstanding of how things work; just reopened
> that message again and inspected the article in raw format which shows
> it's a multipart message (txt/html); when the html part was rendered the
> 1st time around i (wrongly) assumed the whole page was fetched from the
> location pointed to by the URL (the URL was only visible in the
> "filtered" mode);

Ahh, ok. Good to hear that Gnus is behaving as expected; well.

Thanks for clearing it up!


  Best regards,

    Adam

-- 
 "Kaizers i kjelleren.                                        Adam Sjøgren
  Mørkt, kantete - ikkeno´ for radio."                   asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-12-01 21:53             ` Adam Sjøgren
@ 2014-12-02 10:38               ` Bernardo
  2014-12-02 10:43                 ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Bernardo @ 2014-12-02 10:38 UTC (permalink / raw)
  To: info-gnus-english


>> at this stage i'm not seeing any images and am happy with the suggested
>> solution (i.e. mm-discouraged-alternatives setting)
>
> I'm still curious about what you think Gnus is downloading behind your
> back when you view an HTML email in the default configuration.

turns out that was my misunderstanding of how things work; just reopened
that message again and inspected the article in raw format which shows
it's a multipart message (txt/html); when the html part was rendered the
1st time around i (wrongly) assumed the whole page was fetched from the
location pointed to by the URL (the URL was only visible in the
"filtered" mode);

on closer inspection the HTML part does contain pointers to the dreaded
1 pixel images and i'll be re-reading your finding about (whatever they
are called) variables controlling image loading

my apologies for the confusion 





^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-12-01 21:40           ` Bernardo
@ 2014-12-01 21:53             ` Adam Sjøgren
  2014-12-02 10:38               ` Bernardo
  0 siblings, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2014-12-01 21:53 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

> it's not going to happen; i never claimed images were loaded; in fact
> images were never mentioned on my side, that's something you've
> introduced into discussion and ran with it;

Luckily I scrounged up some spare time and found the variables and
functions for the image-part, as you've seen.

So, I apologize for the derailment. Let's get back on track - what is it
that you think Gnus spontaneously requests if you view an HTML email?

> at this stage i'm not seeing any images and am happy with the suggested
> solution (i.e. mm-discouraged-alternatives setting)

I'm still curious about what you think Gnus is downloading behind your
back when you view an HTML email in the default configuration.

I have two reasons for my curiosity:

 a) I don't think your suspicion is correct,
 b) If it is, I want to fix it (or make somebody else do so)

So it would be great if you could elaborate a little.


  Thanks!

    Adam

-- 
 "Examination and mastering of a new highly                   Adam Sjøgren
  intellectual equipment was a hard labour."             asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-30 12:07         ` Adam Sjøgren
@ 2014-12-01 21:40           ` Bernardo
  2014-12-01 21:53             ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Bernardo @ 2014-12-01 21:40 UTC (permalink / raw)
  To: info-gnus-english


>> mostly guessing, but the unfiltered and rendered page contains much more
>> information while the "sanitised" one contains just a *really* long URL
>> (which, another guess, probably contains the recepient's ID embedded) with
>> no other details visible;
>
>> you raise an interesting point, and in my mythical spare time it would
>> be intriguing to fire up Wireshark to see what actually gets loaded when
>> opening such a message; from past experience when looking what gets
>> loaded when an innocuous looking web news page is opened with a browser,
>> the picture is not pretty ...
>
> I just tested on my machine, and no images are fetched until I go M-x
> gnus-article-show-images here.
>
> So I think you should scrounge up some mythical spare time and back up
> your bug report with some data.

it's not going to happen; i never claimed images were loaded; in fact
images were never mentioned on my side, that's something you've
introduced into discussion and ran with it;
at this stage i'm not seeing any images and am happy with the suggested
solution (i.e. mm-discouraged-alternatives setting)





^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
       [not found]           ` <mailman.14993.1417349281.1147.info-gnus-english@gnu.org>
@ 2014-11-30 15:49             ` Mike Kupfer
  0 siblings, 0 replies; 28+ messages in thread
From: Mike Kupfer @ 2014-11-30 15:49 UTC (permalink / raw)
  To: info-gnus-english

asjo@koldfront.dk (Adam Sjøgren) writes:

> Adam writes:
>
>> Mike writes:
>
>>> Hi Adam, shr apparently fetches images by default.
>
>> Not in Gnus on my machine.
>
> ... for email.

Sorry, my mistake.  I looked more carefully at the email that I was
viewing, and the actual image is packaged with the email.  The URL that
I was seeing is just used as ALT text.

Thanks for digging into this and for listing the control variables.

mike
-- 
Mike Kupfer				m.kupfer@acm.org
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-30 12:07           ` Adam Sjøgren
@ 2014-11-30 12:09             ` Adam Sjøgren
  0 siblings, 0 replies; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-30 12:09 UTC (permalink / raw)
  To: info-gnus-english

Adam writes:

> This is controlled by the variable gnus-blocked-images:

... and if you just want to turn off all images in general, you can
change the variable gnus-inhibit-images:

,----[ C-h v gnus-inhibit-images RET ]
| gnus-inhibit-images is a variable defined in `gnus-art.el'.
| Its value is nil
| 
| Documentation:
| Non-nil means inhibit displaying of images inline in the article body.
| 
| You can customize this variable.
| 
| This variable was introduced, or its default value was changed, in
| version 24.1 of Emacs.
| 
| [back]
`----

-- 
 "Missing Content-type?  What missing Content-type?"          Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-30  6:25       ` Bernardo
@ 2014-11-30 12:07         ` Adam Sjøgren
  2014-12-01 21:40           ` Bernardo
  0 siblings, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-30 12:07 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

>>> AFAICT the page pointed by URL is loaded as soon as soon as the message
>>> is opened, to the rejoicing of spammers

>> How do you tell this?

> mostly guessing, but the unfiltered and rendered page contains much more
> information while the "sanitised" one contains just a *really* long URL
> (which, another guess, probably contains the recepient's ID embedded) with
> no other details visible;

> you raise an interesting point, and in my mythical spare time it would
> be intriguing to fire up Wireshark to see what actually gets loaded when
> opening such a message; from past experience when looking what gets
> loaded when an innocuous looking web news page is opened with a browser,
> the picture is not pretty ...

I just tested on my machine, and no images are fetched until I go M-x
gnus-article-show-images here.

So I think you should scrounge up some mythical spare time and back up
your bug report with some data.

Could you be using an older version of Gnus? Another renderer than the
default (shr)?

There are many possibilities for you being right. So far the only data
says you're not, though :-)


  Best regards,

    Adam

-- 
 "Everybody will be quick to agree that EMACS has a           Adam Sjøgren
  simple to learn user interface, at least to gain       asjo@koldfront.dk
  'novice' status."


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-30 11:48         ` Adam Sjøgren
@ 2014-11-30 12:07           ` Adam Sjøgren
  2014-11-30 12:09             ` Adam Sjøgren
       [not found]           ` <mailman.14993.1417349281.1147.info-gnus-english@gnu.org>
  1 sibling, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-30 12:07 UTC (permalink / raw)
  To: info-gnus-english

Adam writes:

> Mike writes:

>> Hi Adam, shr apparently fetches images by default.

> Not in Gnus on my machine.

... for email.

For news, images are fetched automatically - for instance:
<87wq6crjn4.fsf@topper.koldfront.dk> in gmane.test.

Let's dig a little further...

This is controlled by the variable gnus-blocked-images:

,----[ C-h v gnus-blocked-images RET ]
| gnus-blocked-images is a variable defined in `gnus-art.el'.
| Its value is gnus-block-private-groups
| 
| Documentation:
| Images that have URLs matching this regexp will be blocked.
| This can also be a function to be evaluated.  If so, it will be
| called with the group name as the parameter, and should return a
| regexp.
| 
| You can customize this variable.
| 
| This variable was introduced, or its default value was changed, in
| version 24.1 of Emacs.
`----

The default is to block images defined by gnus-block-private-groups,
which blocks anything but newsgroups:

,----
| (defun gnus-block-private-groups (group)
|   (if (or (gnus-news-group-p group)
| 	  (gnus-member-of-valid 'global group))
|       ;; Block nothing in news groups.
|       nil
|     ;; Block everything anywhere else.
|     "."))
`----


  Best regards,

    Adam

-- 
 "I'm not a monster, well, technically I am"                  Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-30  4:00       ` Mike Kupfer
  2014-11-30 11:31         ` Adam Sjøgren
@ 2014-11-30 11:48         ` Adam Sjøgren
  2014-11-30 12:07           ` Adam Sjøgren
       [not found]           ` <mailman.14993.1417349281.1147.info-gnus-english@gnu.org>
  1 sibling, 2 replies; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-30 11:48 UTC (permalink / raw)
  To: info-gnus-english

Mike writes:

> Hi Adam, shr apparently fetches images by default.

Not in Gnus on my machine.

Here is a screenshot of my test, opening an HTML email with an image in
it:

 * http://koldfront.dk/misc/gnus/open-email.png

I have to explicitly do M-x gnus-article-show-images to fetch the image.
Then it looks like this:

 * http://koldfront.dk/misc/gnus/after-show-images.png

I was monitoring the log of the webserver while testing, so I am quite
sure of this.


  Best regards,

    Adam

-- 
 "Der er dit vidensgrundlag simpelthen for spinkelt."         Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-30  4:00       ` Mike Kupfer
@ 2014-11-30 11:31         ` Adam Sjøgren
  2014-11-30 11:48         ` Adam Sjøgren
  1 sibling, 0 replies; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-30 11:31 UTC (permalink / raw)
  To: info-gnus-english

Mike writes:

> asjo@koldfront.dk (Adam Sjøgren) writes:

>> Bernardo writes:

>>> AFAICT the page pointed by URL is loaded as soon as soon as the message
>>> is opened, to the rejoicing of spammers

>> How do you tell this?

> Hi Adam, shr apparently fetches images by default.

Really? Yikes.

I guess it is only the w3m-code that limits itself to CID:?


  Best regards,

    Adam

-- 
 "I do not find reading diffs in email to be a                Adam Sjøgren
  hardship, but I used to walk uphill both ways to       asjo@koldfront.dk
  school, so I dunno."


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-29 21:12     ` Adam Sjøgren
@ 2014-11-30  6:25       ` Bernardo
  2014-11-30 12:07         ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Bernardo @ 2014-11-30  6:25 UTC (permalink / raw)
  To: info-gnus-english


>
>> AFAICT the page pointed by URL is loaded as soon as soon as the message
>> is opened, to the rejoicing of spammers
>
> How do you tell this?
>

mostly guessing, but the unfiltered and rendered page contains much more
information while the "sanitised" one contains just a *really* long URL
(which, another guess, probably contains the recepient's ID embedded) with
no other details visible;

you raise an interesting point, and in my mythical spare time it would
be intriguing to fire up Wireshark to see what actually gets loaded when
opening such a message; from past experience when looking what gets
loaded when an innocuous looking web news page is opened with a browser,
the picture is not pretty ...




^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
       [not found]     ` <mailman.14972.1417295555.1147.info-gnus-english@gnu.org>
  2014-11-29 23:16       ` Emanuel Berg
@ 2014-11-30  4:00       ` Mike Kupfer
  2014-11-30 11:31         ` Adam Sjøgren
  2014-11-30 11:48         ` Adam Sjøgren
  1 sibling, 2 replies; 28+ messages in thread
From: Mike Kupfer @ 2014-11-30  4:00 UTC (permalink / raw)
  To: info-gnus-english

asjo@koldfront.dk (Adam Sjøgren) writes:

> Bernardo writes:
>
>> AFAICT the page pointed by URL is loaded as soon as soon as the message
>> is opened, to the rejoicing of spammers
>
> How do you tell this?
>
> Usually email-tracking is done via so-called "web-bugs", which is a
> scary way of saying "images" - and those aren't fetched by default, are
> they?

Hi Adam, shr apparently fetches images by default.

regards,
mike
-- 
Mike Kupfer				m.kupfer@acm.org
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-29 23:42           ` Emanuel Berg
@ 2014-11-29 23:46             ` Adam Sjøgren
  0 siblings, 0 replies; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-29 23:46 UTC (permalink / raw)
  To: info-gnus-english

Emanuel writes:

> I don't think it is happening. If it were I would be
> very disappointed with Gnus.

So your point was...?


  Best regards,

    Adam

-- 
 "He also no longer jokes about world domination; it          Adam Sjøgren
  was only funny when it was obviously meant in jest."   asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
       [not found]         ` <mailman.14977.1417303389.1147.info-gnus-english@gnu.org>
@ 2014-11-29 23:42           ` Emanuel Berg
  2014-11-29 23:46             ` Adam Sjøgren
  0 siblings, 1 reply; 28+ messages in thread
From: Emanuel Berg @ 2014-11-29 23:42 UTC (permalink / raw)
  To: info-gnus-english

asjo@koldfront.dk (Adam Sjøgren) writes:

>> I don't think anything should be fetched by
>> default. URLs of course shouldn't be followed
>> implicitly. That would be total chaos: a very
>> exploitable thing indeed. Only thing should happen
>> is displaying the text without executing anything.
>> Attached files should be stored but, again, never
>> executed.
>
> And your evidence for _any_ of this happening...?

I don't think it is happening. If it were I would be
very disappointed with Gnus.

-- 
underground experts united
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-29 23:16       ` Emanuel Berg
@ 2014-11-29 23:22         ` Adam Sjøgren
       [not found]         ` <mailman.14977.1417303389.1147.info-gnus-english@gnu.org>
  1 sibling, 0 replies; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-29 23:22 UTC (permalink / raw)
  To: info-gnus-english

Emanuel writes:

> I don't think anything should be fetched by default.
> URLs of course shouldn't be followed implicitly. That
> would be total chaos: a very exploitable thing indeed.
>
> Only thing should happen is displaying the text
> without executing anything. Attached files should be
> stored but, again, never executed.

And your evidence for _any_ of this happening...?


  Best regards,

    Adam

-- 
 "The world is short of delimiters," says Don.                Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
       [not found]     ` <mailman.14972.1417295555.1147.info-gnus-english@gnu.org>
@ 2014-11-29 23:16       ` Emanuel Berg
  2014-11-29 23:22         ` Adam Sjøgren
       [not found]         ` <mailman.14977.1417303389.1147.info-gnus-english@gnu.org>
  2014-11-30  4:00       ` Mike Kupfer
  1 sibling, 2 replies; 28+ messages in thread
From: Emanuel Berg @ 2014-11-29 23:16 UTC (permalink / raw)
  To: info-gnus-english

asjo@koldfront.dk (Adam Sjøgren) writes:

> Usually email-tracking is done via so-called
> "web-bugs", which is a scary way of saying "images"
> - and those aren't fetched by default, are they? Or
> are you talking about something else?

Finally some confusion. I started to believe I know
everything :)

email-tracking, web-bugs, "images", fetching by
default...?

I don't think anything should be fetched by default.
URLs of course shouldn't be followed implicitly. That
would be total chaos: a very exploitable thing indeed.

Only thing should happen is displaying the text
without executing anything. Attached files should be
stored but, again, never executed.

-- 
underground experts united
_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-29 20:50   ` Bernardo
@ 2014-11-29 21:12     ` Adam Sjøgren
  2014-11-30  6:25       ` Bernardo
       [not found]     ` <mailman.14972.1417295555.1147.info-gnus-english@gnu.org>
                       ` (2 subsequent siblings)
  3 siblings, 1 reply; 28+ messages in thread
From: Adam Sjøgren @ 2014-11-29 21:12 UTC (permalink / raw)
  To: info-gnus-english

Bernardo writes:

> AFAICT the page pointed by URL is loaded as soon as soon as the message
> is opened, to the rejoicing of spammers

How do you tell this?

Usually email-tracking is done via so-called "web-bugs", which is a
scary way of saying "images" - and those aren't fetched by default, are
they? Or are you talking about something else?


  Best regards,

    Adam

-- 
 "The world is short of delimiters," says Don.                Adam Sjøgren
                                                         asjo@koldfront.dk


_______________________________________________
info-gnus-english mailing list
info-gnus-english@gnu.org
https://lists.gnu.org/mailman/listinfo/info-gnus-english

^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
  2014-11-29 19:45 ` Emanuel Berg
@ 2014-11-29 20:50   ` Bernardo
  2014-11-29 21:12     ` Adam Sjøgren
                       ` (3 more replies)
  0 siblings, 4 replies; 28+ messages in thread
From: Bernardo @ 2014-11-29 20:50 UTC (permalink / raw)
  To: info-gnus-english


>> LinkedIn etc) in their (HTML formatted) email
>> include URLs which i suspect are used to track users
>> when opening them
>
> Try this:
>
>     (setq mm-discouraged-alternatives '("text/html" "text/richtext"))

ah, much better, thanks

>
> Otherwise doesn't it work just by not following the
> URLs?

AFAICT the page pointed by URL is loaded as soon as soon as the message
is opened, to the rejoicing of spammers



^ permalink raw reply	[flat|nested] 28+ messages in thread

* Re: rendering HTML: how to disable
       [not found] <mailman.14933.1417260021.1147.info-gnus-english@gnu.org>
@ 2014-11-29 19:45 ` Emanuel Berg
  2014-11-29 20:50   ` Bernardo
  0 siblings, 1 reply; 28+ messages in thread
From: Emanuel Berg @ 2014-11-29 19:45 UTC (permalink / raw)
  To: info-gnus-english

Bernardo <bernardo.bacic@pobox.com> writes:

> i noticed that some slimy email senders (e.g
> LinkedIn etc) in their (HTML formatted) email
> include URLs which i suspect are used to track users
> when opening them

Try this:

    (setq mm-discouraged-alternatives '("text/html" "text/richtext"))

Otherwise doesn't it work just by not following the
URLs?

-- 
underground experts united

^ permalink raw reply	[flat|nested] 28+ messages in thread

end of thread, other threads:[~2015-04-04 12:25 UTC | newest]

Thread overview: 28+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-11-29  8:57 rendering HTML: how to disable Bernardo
     [not found] <mailman.14933.1417260021.1147.info-gnus-english@gnu.org>
2014-11-29 19:45 ` Emanuel Berg
2014-11-29 20:50   ` Bernardo
2014-11-29 21:12     ` Adam Sjøgren
2014-11-30  6:25       ` Bernardo
2014-11-30 12:07         ` Adam Sjøgren
2014-12-01 21:40           ` Bernardo
2014-12-01 21:53             ` Adam Sjøgren
2014-12-02 10:38               ` Bernardo
2014-12-02 10:43                 ` Adam Sjøgren
     [not found]     ` <mailman.14972.1417295555.1147.info-gnus-english@gnu.org>
2014-11-29 23:16       ` Emanuel Berg
2014-11-29 23:22         ` Adam Sjøgren
     [not found]         ` <mailman.14977.1417303389.1147.info-gnus-english@gnu.org>
2014-11-29 23:42           ` Emanuel Berg
2014-11-29 23:46             ` Adam Sjøgren
2014-11-30  4:00       ` Mike Kupfer
2014-11-30 11:31         ` Adam Sjøgren
2014-11-30 11:48         ` Adam Sjøgren
2014-11-30 12:07           ` Adam Sjøgren
2014-11-30 12:09             ` Adam Sjøgren
     [not found]           ` <mailman.14993.1417349281.1147.info-gnus-english@gnu.org>
2014-11-30 15:49             ` Mike Kupfer
2015-04-03  8:22     ` Bernardo
2015-04-03  9:57       ` Adam Sjøgren
2015-04-03 11:50         ` Bernardo
2015-04-03 12:05           ` Adam Sjøgren
2015-04-03 12:09             ` Adam Sjøgren
2015-04-04  0:51               ` Bernardo
2015-04-04 12:25                 ` Adam Sjøgren
     [not found]     ` <mailman.3220.1428049535.31049.info-gnus-english@gnu.org>
2015-04-03 18:27       ` Emanuel Berg

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).