I don't know. History, probably.
We used to assume everyone played nice.
nmh-access-{ftp,url} were added less than 4 years ago. Ken, should we
revisit? I don't have strong feelings, the only messages I've received
that use it are from you and Ralph.
So, I read Anthony's email, and while I don't agree with all of his concerns
I do understand where he is coming from.
My reading of the historical MH code is that it would always try to fetch
external-body content. But ... the assumption in MH 6.8 was that MIME
content was rare and presumably a human would look at it before they
would run "mhn". The external-body methods supported in MH 6.8 were
"afs", "anon-ftp", "ftp", "local-file", and "mail-server". I think "ftp",
"anon-ftp", and "mail-server" probably were at a similar level of danger
to "url" today.
Thinking about the history ... along the way we moved towards always
parsing MIME messages (because most messages nowadays are), which meant
that external-body content would always be displayed (BTW, "turns out
"mhn-access-ftp" was supported even back in MH 6.8). I added the URL
support and my motivation there was really just updating the MIME
support to more modern stuff, I went along with how the ftp support
worked and didn't think about the larger concerns.
I think maybe the smartest thing to do would be to default to NOT
displaying any external content in nmh when viewing content with
show(1)/mhshow(1), but instead just show the MIME paramters to the
user. Then a user could chose to display that with -showexternal (or
whatever). A more trusting user could add -showexternal to their
profile. That might have to wait a while, though. Thoughts?
--Ken
--
nmh-workers
https://lists.nongnu.org/mailman/listinfo/nmh-workers