<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 15-08-12 2:53 , Andrew Sutherland
wrote:<br>
</div>
<blockquote cite="mid:502B4773.7000605@asutherland.org" type="cite">(I
am posting to tb-planning as a proxy for the mozilla mailing list
relating to the e-mail problem domain)
<br>
<br>
The arguments against sanitizing the web bugs are (possible
interpretations of) user choice and game theory concerns that
sanitizing based on explicit sizing (width=1 height=1) could lead
to an arms war. I don't view the arms war as particularly
concerning as e-mails can't run JS, transitions/animations are
also sanitized, the sanitizer has access to a layout engine
enabling it to determine visibility, and it is generally believed
that most e-mail clients have poor HTML support.
<br>
</blockquote>
Another argument against is that B2G's email client wouldn't show up
as highly in the rankings like <a
href="http://www.campaignmonitor.com/resources/will-it-work/email-clients/">this
one</a>, which seem to mostly be based on image loads. (It's a
minor point, and totally does not make it worth sacrificing user
privacy, but I think it's worth mentioning.)<br>
<br>
It would be nice to have better HTML support in email, but since
email is push rather than pull, the security trade-offs should
probably lean more towards safety than functionality.<br>
<br>
I'm in favour of the idea.<br>
<br>
Later,<br>
Blake.<br>
<pre class="moz-signature" cols="72">--
Blake Winton Thunderbird User Experience Lead
<a class="moz-txt-link-abbreviated" href="mailto:bwinton@mozilla.com">bwinton@mozilla.com</a></pre>
</body>
</html>