Hacker News Reader

Comment by fowl2 | Hacker News Reader

Once you get into emails/data you're blurring the line seriously...

(I mean, that means you've got a HTML renderer, so you've gotta push updates every 12 weeks or so)

Not necessarily. You don't need an HTML renderer for emailing, and even if you did, the difference between HTML rendering for emails vs. a full 3rd party, concurrently running application system is pretty big.

Nokia ported the KHTML rendering engine back in 2004-2005 to their feature phone OS. :) A baby WebKit is in some of those feature phone if you want to call it that.

The subset of HTML that is actually supported by most email clients is very small (and inconsistent). If you look at the well-formatted emails from AirBnB and Uber, you'll see tables and inline CSS, along with conditionals for the Outlook email client.[1]

[1] http://blog.mailgun.com/transactional-html-email-templates/

My 2004 Nokia feature phone had a mobile web browser, with some degree of HTML rendering capability, and no way to update the phone OTA. HTML or data support seem like a weird place to draw the line.

A web browser and no software updates sounds like a great way to get your phone hacked to me.

Not as good of a way as it would be with a modern phone. You'd basically have to find a bug in the HTML or image parsing/rendering. As I remember it, that device didn't support cookies, javascript, plugins, etc. And honestly, hacking into mobile devices over an internet connection wasn't really part of the zeitgeist at the time. That mostly came later, when people stored more than some SMS, MIDI ringtones, and some phone numbers.

> You'd basically have to find a bug in the HTML or image parsing/rendering.

Like this one?

https://www.rapid7.com/db/vulnerabilities/mfsa2010-41-remote...

Opera Mini or a pure-JavaME browser would be safe, but just having an image decoder is too much to expose to whole internet.

Sure, if it was found for whichever library code was used on that device, and if you also found a way to use it to get the OS to expose data that it usually wouldn't.

I'm not saying that someone couldn't work out a way to exploit that phone, I'm saying that it's not going to happen because there's no point (and also wouldn't have been one while I was still using it).

As a practical concern, I'm more worried about my phone now (an up-to-date Android) than I am about any feature phone, including recently-released ones.

The browsers were so bad on those devices no one used them.

If you have a specific use case, say, reading hacker news comments, then minimal feature phone browsers tend to be sufficient more often than not. The gap between "something that is important to me" and "everything that is important to me" can be huge.

I mostly used it to download ringtones and backgrounds to the phone. It was pretty terrible for any actual web browsing (not to mention the low speeds of the data connection, anyhow).

> that means you've got a HTML renderer, so you've gotta push updates every 12 weeks or so

Tell that to Android

Android System WebView is updated as an app: https://play.google.com/store/apps/details?id=com.google.and...

Makes sense, since the system doesn't get updates

Reply on news.ycombinator.com