4 ms·
It was never allowed. Microsoft just started doing it in their email client and obnoxiously made it default. There was no standards process where anyone spent t
by upofadown 1mo ago
It was never allowed. Microsoft just started doing it in their email client and obnoxiously made it default. There was no standards process where anyone spent time considering the potential downsides with the aim of making HTML email practical and secure.
HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.
- Arnt 1mo agoThere was one, in the IETF. It went like this: "We should have a HTML profile, somewhat restricted, so that the people who want to send bold and italic and a little more can do that, and composers can know what's okay, and javascript isn't" and a little discussion, and then came people shouting "EVERYTHING EXCEPT TEXT/PLAIN IS THE DEVIL'S WORK!" and the whole thing dissolved due to the noise.
- 1718627440 1mo agoMUAs do render italics/bold, headlines, citations, etc. , so for just bold and italic HTML isn't required.
- Arnt 1mo agoNot sure what you're saying — do you have an actual production MUA with text/enriched support, or is it something else? Send me an example of whatever it is, please. Something with boldface but without HTML. arnt@gulbrandsen.priv.no.
- 1718627440 1mo agoJust regular Thunderbird rendering some common elements in plaintext mails. Just like e.g. Markdown is rendered on Github. This is what Markdown comes from after all.
- chuckadams 1mo agoIt was allowed before HTML even existed: MIME was invented for email.
- ranger_danger 1mo ago> It should be rejected/ignored if you are at all concerned about privacy and/or security. This is actively harmful advice that could easily get someone fired.