Hacker News Reader

Comment by desro | Hacker News Reader

Allowing anything other than plain text in email bodies was a terrible mistake.

It was never allowed. Microsoft just started doing it in their email client and obnoxiously made it default. There was no standards process where anyone spent time considering the potential downsides with the aim of making HTML email practical and secure.

HTML email is just something that people semi-randomly do. It should be rejected/ignored if you are at all concerned about privacy and/or security.

There was one, in the IETF. It went like this: "We should have a HTML profile, somewhat restricted, so that the people who want to send bold and italic and a little more can do that, and composers can know what's okay, and javascript isn't" and a little discussion, and then came people shouting "EVERYTHING EXCEPT TEXT/PLAIN IS THE DEVIL'S WORK!" and the whole thing dissolved due to the noise.

MUAs do render italics/bold, headlines, citations, etc. , so for just bold and italic HTML isn't required.

Not sure what you're saying — do you have an actual production MUA with text/enriched support, or is it something else? Send me an example of whatever it is, please. Something with boldface but without HTML.

arnt@gulbrandsen.priv.no.

Just regular Thunderbird rendering some common elements in plaintext mails. Just like e.g. Markdown is rendered on Github. This is what Markdown comes from after all.

It was allowed before HTML even existed: MIME was invented for email.

> It should be rejected/ignored if you are at all concerned about privacy and/or security.

This is actively harmful advice that could easily get someone fired.

Feel free to use https though, it's a self-signed cert. http://athena.m3047.net/pub/fwm/rfc-tree.pdf

Ecommerce loves html in email, it would be interesting seeing them reverting to plain text but the backlash would be too great

Reply on news.ycombinator.com