Evolution Mail Users Easily Trackable
grepular.com
grepular.com
Are there any best in class HTML preprocessors that do this well? There are many use cases for displaying email content in e.g. CRM widgets where the underlying networking can’t be controlled. An iframe with a good CSP goes a long way, but as OP notes you want defense in depth!
[0] Edit > Preferences > Mail Preferences > HTML Messages > HTML Mode = Show plain text if present
How? Even if they write in HTML only there is nothing which could prevents a email client from just not rendering them which would mean plaintext.
And you'll probably get a lot of empty emails you can't read that way, unless you configure the plaintext plugin to dump the HTML into the reader view.
Not at all. You will see the HTML code but not render which is easily readable since HTML is very simple.
Edit: one marketing site describes a new category of Apple Opens (vs. Human Opens), so sounds like the feature’s effective
Calling it out is the best one can do without getting trapped in a cycle of low-effort premises and high-effort responses.
Although, as usual in HN, the premises come from different accounts, so both are valid. And it probably reveals valid addresses when the image URL is unique for each email.
I'm really not (honestly!) trying to invalidate anyone's point or win any argument - my post is more of a question-in-disguise: the GP post I was replying to concerns message-read tracking; whereas my post invokes the entirely separate matter of external actors being able to determine the validity or existence of a gmail address.
I'm not moving the goalposts; you guys are talking about the NFL game's goalposts; I'm talking about the FIFA world cup game goalposts.
Analogously, the issue would be out of bounds then, as the issues are distinct, and so a failure mode that discloses the existence of an email account is not a failure you can lay at the feet of any particular provider of email accounts, but is partly an implementation detail of how different email providers respond to emails to nonexistent addresses. That particular failure (disclosure of the existence of an email address) and any potential solution is considered out of the scope of the problem in the thread (disclosure of the opening of an HTML email due to loading tracking pixels).
This was a big announcement with Apple Mail Privacy Protection, included in iOS 15 (Sept. 2021). Sent marketers into a small panic.
If Gmail did so as well, should’ve been bigger news and figure they’d remind us we could disable the load remote content option.
One of the earliest (2013) mentions I could find: https://gmail.googleblog.com/2013/12/images-now-showing.html
Found in this old article about the initial launch: https://words.filippo.io/how-the-new-gmail-image-proxy-works...
Since 2013, marketers haven’t known WHERE their readers are simply from users opening an email in Gmail.
But today, marketers don’t know IF their readers even open an email if users use Apple Mail.
Partial quote from the second article: “The issue is that the single most useful piece of information a sender gets from you[/the proxy] loading the image is that/when you read the email. And this is not mitigated at all by this system [b/c] when you open an email the server will see a request. Mix that with the ubiquitous uniquely-named images … and you get read notifications.”
(I want _neither_ to leak my IP _nor_ to have “Read Receipts” enabled when I get spam or whatever.)
But you can read gmail in thunderbird or any other email client, and in that case gmail still doesn't know anything more than that your client performed a sync, which it might be doing periodically at all times and so isn't meaningful.
This is one of the big reasons why email has pretty much died for casual use. Even in work environments almost everyone uses chat clients these days.
Not only does my mail usage not generate any outbound network traffic, nor follow any links, but I can also inspect and edit URLs without following them.
I’ve practically given up on clicking any sort of links from marketing emails as they are full of multiple redirect trackers. Which, is a shame, as these are obviously from companies I care to keep up with and support.
Email will always have its place, but I agree the default email experience we all know shouldn’t default to essentially a viewport.
But yeah, it's pretty horrendous by default.
I'm not sure how this is better though. With chat clients you are completely locked into their ecosystem. Email at least is an open protocol and interoperable.
Maybe in your bubble, but globally this is just false.
I don't see how this follows. Yes, HTML email fucking sucks. But most people are using Gmail, Outlook, Apple Mail, etc, all of which do a pretty good job at handling HTML emails - especially between each other. How do you go from "html emails are bad" to "html emails led to IM replacing email"?
…you can still do that on internal email systems; but over the internet any kind of unsolicited short email will probably be dropped by Bayesian filters on the recipient’s side because the information-capacity of a short email is… well, short, making it harder to discern from short spam/attack emails.
Also, email clients are getting heavier and slower: (Classic) Outlook M365/2025/Etc somehow takes a grating 10+ seconds to fully load and warm-up on my brand new machine, while double-clicking an email to open it makes the whole thing awkwardly hang for 2-3 seconds, even when working offline. It’s given me a huge aversion to using email in general, so I’m not going to send a 1-liner via Outlook.
Why would you subject yourself to that torture? Thunderbird is like LibreOffice is to MS Office, meaning you will have to adapt, but it is still lean for being a contemporary email client.
MS can take my VBA macros from my cold, dead, fingers: the JS-based replacement in New Outlook is incredibly neutered, such as local filesystem access or managing message attachments.
For me, it was simply the lack of adoption of messaging options that made email the default tool. Once cell phones came along and people got accustomed to instant quick messaging that was generally ubiquitous, email was out, whether you were using pine, outlook, or something in between.
I do this all the time. I don't think I've ever had a dropped email, because I always get a response.
> Also, email clients are getting heavier and slower: (Classic) Outlook M365/2025/Etc somehow takes a grating 10+ seconds to fully load and warm-up on my brand new machine, while double-clicking an email to open it makes the whole thing awkwardly hang for 2-3 seconds, even when working offline. It’s given me a huge aversion to using email in general, so I’m not going to send a 1-liner via Outlook.
Does your average human really care though?
Also, mobile email clients (Gmail, Apple Mail) load roughly as fast (or faster) than popular IM apps (Whatsapp, Slack, Discord). Discord in particular is a huge resource hog, with very noticeable load times, and semi-advertisement popups that you have to click through. I have not seen any evidence that this diminishes Discord's popularity.
I feel like the major problem with almost everything that has a feed these days is the feed. Real state is a finite resource victim of the tragedy of commons: to be visible, you must post, but if others post, you are less visible, so to be even more visible, you post more, which prompts others to post even more, and anyone who doesn't play this game loses.
This happens with all feeds: chronological feeds on Tumblr, e-mail, RSS, etc.
One project I've seen that has tried a novel approach to this was https://fraidyc.at/ Essentially instead of putting all posts in a line, it's an RSS client that just tells you who has posted recently but not what they have posted.
There is a use case of using HTML for transactional emails:
- enhance company branding with design - embed call to action items via hrefs
HTML is going to be inseparable part of e-mail for as long as e-mail lives, and yeah, it seems more likely than e-mail will die as a whole rather than get any simpler technically.
At this point we can only get better at filtering the HTML.
I suppose, but AFAIK no one is really doing that. So in that sense it's a "if a tree falls in the forest, but no one is around to hear it"-type issue.
And the response seems reasonable by the way; they set the correct flag. WebkitGTK has a bug and it doesn't work. It's not great, but you can't expect people to fix everything, especially for fairly minor issues like this.
(Seems reasonable to link to the bug report or something, but this is not my domain.)
1. It's not a minor issue that a privacy feature doesn't work.
2. OP clearly stated ( https://gitlab.gnome.org/GNOME/evolution/-/issues/3095#note_... ) that they know the fixes are not trivial, so at the very least they want the application and website to make it clear that the privacy feature doesn't work, so that users are not misled.
1: https://webkitgtk.org/reference/webkit2gtk/stable/property.S...
Handwaving this away because "nobody will do this" is in the same family of issues as "I have nothing to hide" or "what can they really do with my data?"
> you can't expect people to fix everything, especially for fairly minor issues like this.
The feature is called "Load Remote Content". Turning that off should have predictable consequences. The fact that it doesn't do what people would rightly assume it should do is not a "fairly minor issue".
People who blindly accept problems, who accept a lack of concern about privacy, both as a right and as a preference, who handwave away poor behavior aren't helping anyone. Tech companies rarely DTRT on their own, so people need to hold their feet to the fire. Those companies don't need apologists.