Re: Balsa and Efail

Albrecht Dreß <[email protected]>
Newsgroups gmane.comp.gnome.apps.balsa
Message-ID <[email protected]>
Am 15.05.18 19:17 schrieb(en) Albrecht Dreß:
> I am not sure if the HTML widgets used in Balsa are configured to reject all backchannels.  At least, libwebkit2gtk asks for loading external images (which you should *never* do!), but the paper lists (in appendix D) a multitude of possibilities.  I will check them for libwebkit2gtk (which will take some time), it would be great if someone could have a look at the other widgets.

Unfortunately, the libwebkit2gtk usage in Balsa is *completely* broken: it seems to load almost everything which is referenced in the html, apart from /some/ images (unless the user clicks the button to load them, too).  As the lib looks like a complex beast, fixing this bug will probably take some time, and I need to craft test messages as to verify that all backchannels are really blocked.

*So, for the time being, I highly recommend to disable html completely!*

In the long run, I think we should implement a different policy for dealing with html-only messages.  If the user checked the “prefer text over html” option, IMHO we should display the html source by default, and only switch to the html view if the user explicitly requests it (this is what kmail does).

Opinions?

Sorry for the bad news,
Albrecht.

_______________________________________________
balsa-list mailing list
[email protected]
https://mail.gnome.org/mailman/listinfo/balsa-list
signature.asc (application/pgp-signature, 473 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAABCAAGBQJa/bioAAoJEEypbw5n59n4+okH/i+Vr+YyVxgFIHMXaz9A8Ps1
dIbrBhhN7cPjBFSbN2j+DToklDiQHY2uepFEZiA6QsG1Q2J1/Qzg8/i+wet1CMWb
JflLHVj0z01SZLGGDYfcWVnWn2nqJ6A8zap3AmdRGyYN8p3JhhlWnCKkQONc0WZR
el3GX4zdmZDe4LQac6JLbkPwr3mAwBK6R8D1jU84fUOrjpB6m5F6Xx1hOejMpHRD
qgve7fu+mu17Lywdx/ojX5JF1VtBSWoe3lpAbsfZ6T4BEhSfrt2tzMZZHEbSPXgJ
lbnH07xrcn+nWrtzC6K1pzoSYAnTeo+ZeX1L22yizRBTlKwZD3ZFawuXHPpO/C8=
=tHGl
-----END PGP SIGNATURE-----
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.