Hacker News Reader

Comment by egberts1 | Hacker News Reader

JavaScript, embedded, in email is, pejoratively, a bad idea by putting too much power into a transmitted email.

Too many security holes, discovered and undiscovered with JavaScript, not to mention JMTP.

Better yet,

Hashing the local part of the email address and retrofitting mail clients to do the mapping and rejection is the best way to delete unwanted and unsolicited emails.

Couple that with new decentralized lookup of sender’s PKI (as well as DKIM).

That should add years/decades to SMTP viability and usability.

View on HN

I was under the impression JMAP was just a sync protocol and had nothing to do with js in email. Is that incorrect?

JMAP is not JavaScript embedded in email. Are you thinking of something else?

But it does nothing to prevent JS in its payload.

the client should be responsible for not executing embedded JS in a message

sure, but that's not a feature a protocol should have. Because the protocol itself does not interact with it in any way. It's clients that process that javascript and execute it. The protocol is about moving 'emails' from one place to another. If you don't want javascript in your email and run your own email stack you can certainly filter out javascript blobs if you want. Or you can chose clients that disable or simply don't even know what javascript is.

While it is a bit late to close the door on JS usage within SMTP protocol, choices of client SMTP becomes paramount given its legacy stage of SMTP protocol.

again, the protocol should be dumb, its a way to move bytes. If there is js encoded in those bytes the rotocol will not and should not know or care. It's up to a client do decide what it wants to do with the bytes it receives.

I can also put JavaScript in a DNS TXT record; the protocol does nothing to stop that!

There is no "JavaScript" in JMAP in the sense that it's supported by the protocol, and the specification explicitly warns against email clients interpreting JavaScript.

Now you are getting the idea of how to design a new network protocol in contrast to adding the supporting numbers of parsers and validators.

Potential and actual vulnerabilities explodes, like the chronic problems of Microsoft Macros.

> JavaScript, embedded, in email is, pejoratively, a bad idea by putting too much power into a transmitted email

The exploits writers would like to politely disagree. /s

You cannot read this email until you disable your adblocker.

Reply on news.ycombinator.com