<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/16/2016 12:28 PM, Jim
<a class="moz-txt-link-rfc2396E" href="mailto:squibblyflabbetydoo@gmail.com"><squibblyflabbetydoo@gmail.com></a> wrote:<br>
</div>
<blockquote
cite="mid:CAF6z7ptc0kSHHO5DmKOGGparCnADzXUUEfmjK3Zes6tfdsyWqA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On Fri, Dec 16, 2016 at 10:47 AM,
Disaster Master <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:disasterlistmanager@gmail.com"
target="_blank">disasterlistmanager@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><span class=""></span>If
the 'browser' 'feature' in TB is removed, and only basic
HTML email rendering is allowed (lock it down I say),
what, exactly, are these mysterious risks?<br>
</div>
</blockquote>
</div>
<br>
</div>
<div class="gmail_extra">Generally, use-after-free allowing an
attacker to execute arbitrary code. This happens more often
with JS, but every part of Gecko is potentially vulnerable,
and unlike websites, email gets *pushed* to you, making it
more likely that even safe email habits can result in a
breach. (To be fair, there's a similar problem with ad
networks on the web, since they're the primary vector for
malware when browsing.)<br>
</div>
</div>
</blockquote>
<br>
Well, like I said, I was thinking (hoping?) there would be some way
to mitigate these vectors by simply only allowing only a minimal
subset of the HTML rendering capabilities to peek through. Enough to
render an HTML reasonably well (simple bullet lists, tables, font
settings, etc), but block useless and/or potentially harmful things
(like JS - who needs that in an email, really?).<br>
<br>
Maybe something like NoScript for TB, but built in, with no way to
disable it, but a well managed whitelist for things that are known
to not be vulnerable/harmful.<br>
<br>
I was thinking it should be possible to render simply bullet lists,
font settings, etc, in a reasonably secure fashion, shouldn't it?<br>
<br>
I know, more of my blissful ignorance showing here probably...<br>
<br>
<blockquote
cite="mid:CAF6z7ptc0kSHHO5DmKOGGparCnADzXUUEfmjK3Zes6tfdsyWqA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div class="gmail_extra">About the only saving grace for Postbox
(and Thunderbird, really) is that there aren't that many users
compared to web browsers, so broad attacks don't make as much
sense.<br>
</div>
</div>
</blockquote>
<br>
It helps, but I've never been a fan of security through obscurity.<br>
</body>
</html>