News for hackers. Stuff that matters.

A comment on Thunderbird 78.x is great but has issues for advanced PGP users. Parent comment

Re:Thunderbird 78.x is great but has issues for advanced PGP... by tracker1 on Friday November 27, 2020 @09:45AM (#25229067)
Or... disable any JS runtime in a webview/iframe for the message. I get using an HTML rendering engine, I don't get ever enabling JS.

Worst offense was when Outlook (and Express) used the IE rendering engine with JS in "local" (unrestricted) trust mode. Melissa/ILoveYou etc...

[ Parent | on HN ]
Re:Thunderbird 78.x is great but has issues for advanced PGP... by anoncake on Saturday November 28, 2020 @08:12AM (#25237303)
That's about the bare minimum. Does any modern client not do that? But I think an HTML renderer that doesn't even have support for Javascript, audio and video tags, perhaps parts of CSS, etc. has a smaller attack surface.
[ Parent | on HN ]
Re:Thunderbird 78.x is great but has issues for advanced PGP... by tracker1 on Sunday November 29, 2020 @09:00AM (#25245119)
Automatic playing of audio or video, and no eval support in css would also be a good idea.
[ Parent | on HN ]