Subject: RE: [Asrg] HTML-burdened E-mail

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 23 Jun 2003 07:54:44 -0700

As one of the people who worked on HTML when <IMG> went in (unilaterally and
without any real chance for comment), I have always considered this feature
to be a bug.

Unauthenticated executable content of any kind has no place in email. There
is no cause to send unsolicited and unauthenticated Java, Active-X or
Javascript. The <IMG> tag referencing an external object is causing a
programmed action I think it should be blocked by default as well.

HTML worked and works just fine without external references or executable
content. 

The IETF could try to issue an edict to stop HTML email but the market
simply won't listen. Issuing an RFC does not change the world. 

Warning MUA authors off executable content in unauthenticated email might
work. The principle is already accepted in general...

		Phill

> -----Original Message-----
> From: Dr. Jeffrey Race [mailto:[email-masked]]
> Sent: Friday, June 20, 2003 11:57 AM
> To: [email-masked]
> Subject: Re: [Asrg] HTML-burdened E-mail
> 
> 
> On Fri, 20 Jun 2003 11:29:18 -0400, Yakov Shafranovich wrote:
> 
> >>    1)  Their spam will be less effective;
> >
> >How?
> 
> Much/most html spam includes webbugs to verify identity of the
> mark and so validate the address
> 
> Jeffrey Race
> 
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Mon, 23 Jun 2003 12:28:49 -0700

> HTML worked and works just fine without external references or executable

+1, I agree strongly.

BTW it's even more complex now, since many legit mail-sending operations
consider "web bugs" (1x1 pixel external IMGs with an identifying tag)
to be good practice in measuring mail views. :(

--j.