bug#15882: 24.3.50; gnus does not suppress email tracking

bug#15882: 24.3.50; gnus does not suppress email tracking

[Michael Albinus]

There are many methods to track html emails from remote side. Most of
them do not work when reading emails with gnus, because the shr renderer
does not support javascript or css or suchalike.

However, svg inline with remote images are not detected by shr. You can
test this when sending yourself an email from the webpage
<https://emailprivacytester.com/>, and read that email with gnus.

There shall be an option to suppress such tracking, and this option
shall be set to t by default.



In GNU Emacs 24.3.50.4 (x86_64-unknown-linux-gnu, GTK+ Version 2.24.20)
 of 2013-11-12 on detlef
Bzr revision: 115082 monnier@iro.umontreal.ca-20131112191122-1h5gu9yjktzcz6bc
System Description:	Ubuntu 13.10

Important settings:
  value of $LC_MONETARY: en_US.UTF-8
  value of $LC_NUMERIC: en_US.UTF-8
  value of $LC_TIME: en_US.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  display-time-mode: t
  shell-dirtrack-mode: t
  iswitchb-mode: t
  icomplete-mode: t
  show-paren-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
ESC [ > 1 ; 3 2 0 1 ; 0 c ESC x b u g C-a - ESC O D 
e m a c s TAB DEL ESC O D ESC O D ESC O D ESC O D ESC 
O D - ESC O D r TAB RET

Recent messages:
("/home/albinus/src/emacs/src/emacs")
Loading icomplete...done
Loading /home/albinus/.tramp...done
Loading /home/albinus/src/elpa/packages/debbugs/debbugs-autoloads.el (source)...done

Load-path shadows:
/home/albinus/src/elpa/packages/debbugs/debbugs-gnu hides /home/albinus/.emacs.d/elpa/debbugs-0.4/debbugs-gnu
/home/albinus/src/elpa/packages/debbugs/debbugs hides /home/albinus/.emacs.d/elpa/debbugs-0.4/debbugs
/home/albinus/src/elpa/packages/debbugs/debbugs-autoloads hides /home/albinus/.emacs.d/elpa/debbugs-0.4/debbugs-autoloads
/home/albinus/src/elpa/packages/debbugs/debbugs-pkg hides /home/albinus/.emacs.d/elpa/debbugs-0.4/debbugs-pkg
~/src/org-mode/lisp/ob-python hides /home/albinus/src/emacs/lisp/org/ob-python
~/src/org-mode/lisp/ob-scala hides /home/albinus/src/emacs/lisp/org/ob-scala
~/src/org-mode/lisp/ob-ref hides /home/albinus/src/emacs/lisp/org/ob-ref
~/src/org-mode/lisp/org-gnus hides /home/albinus/src/emacs/lisp/org/org-gnus
~/src/org-mode/lisp/ob-java hides /home/albinus/src/emacs/lisp/org/ob-java
~/src/org-mode/lisp/ob-css hides /home/albinus/src/emacs/lisp/org/ob-css
~/src/org-mode/lisp/org-bibtex hides /home/albinus/src/emacs/lisp/org/org-bibtex
~/src/org-mode/lisp/ob-ledger hides /home/albinus/src/emacs/lisp/org/ob-ledger
~/src/org-mode/lisp/ob-ruby hides /home/albinus/src/emacs/lisp/org/ob-ruby
~/src/org-mode/lisp/org-irc hides /home/albinus/src/emacs/lisp/org/org-irc
~/src/org-mode/lisp/ob-plantuml hides /home/albinus/src/emacs/lisp/org/ob-plantuml
~/src/org-mode/lisp/org-entities hides /home/albinus/src/emacs/lisp/org/org-entities
~/src/org-mode/lisp/org-agenda hides /home/albinus/src/emacs/lisp/org/org-agenda
~/src/org-mode/lisp/ox-html hides /home/albinus/src/emacs/lisp/org/ox-html
~/src/org-mode/lisp/ob-core hides /home/albinus/src/emacs/lisp/org/ob-core
~/src/org-mode/lisp/ox-md hides /home/albinus/src/emacs/lisp/org/ox-md
~/src/org-mode/lisp/ox hides /home/albinus/src/emacs/lisp/org/ox
~/src/org-mode/lisp/ob-sqlite hides /home/albinus/src/emacs/lisp/org/ob-sqlite
~/src/org-mode/lisp/org-compat hides /home/albinus/src/emacs/lisp/org/org-compat
~/src/org-mode/lisp/ob-gnuplot hides /home/albinus/src/emacs/lisp/org/ob-gnuplot
~/src/org-mode/lisp/ox-beamer hides /home/albinus/src/emacs/lisp/org/ox-beamer
~/src/org-mode/lisp/ob-exp hides /home/albinus/src/emacs/lisp/org/ob-exp
~/src/org-mode/lisp/ob-C hides /home/albinus/src/emacs/lisp/org/ob-C
~/src/org-mode/lisp/ob-awk hides /home/albinus/src/emacs/lisp/org/ob-awk
~/src/org-mode/lisp/ob-matlab hides /home/albinus/src/emacs/lisp/org/ob-matlab
~/src/org-mode/lisp/ox-org hides /home/albinus/src/emacs/lisp/org/ox-org
~/src/org-mode/lisp/org-archive hides /home/albinus/src/emacs/lisp/org/org-archive
~/src/org-mode/lisp/org-plot hides /home/albinus/src/emacs/lisp/org/org-plot
~/src/org-mode/lisp/org-install hides /home/albinus/src/emacs/lisp/org/org-install
~/src/org-mode/lisp/ob-octave hides /home/albinus/src/emacs/lisp/org/ob-octave
~/src/org-mode/lisp/ob-calc hides /home/albinus/src/emacs/lisp/org/ob-calc
~/src/org-mode/lisp/org-bbdb hides /home/albinus/src/emacs/lisp/org/org-bbdb
~/src/org-mode/lisp/ob-lilypond hides /home/albinus/src/emacs/lisp/org/ob-lilypond
~/src/org-mode/lisp/ox-odt hides /home/albinus/src/emacs/lisp/org/ox-odt
~/src/org-mode/lisp/ob-sass hides /home/albinus/src/emacs/lisp/org/ob-sass
~/src/org-mode/lisp/ob-lisp hides /home/albinus/src/emacs/lisp/org/ob-lisp
~/src/org-mode/lisp/org-indent hides /home/albinus/src/emacs/lisp/org/org-indent
~/src/org-mode/lisp/org-mouse hides /home/albinus/src/emacs/lisp/org/org-mouse
~/src/org-mode/lisp/org-macs hides /home/albinus/src/emacs/lisp/org/org-macs
~/src/org-mode/lisp/org-timer hides /home/albinus/src/emacs/lisp/org/org-timer
~/src/org-mode/lisp/org-pcomplete hides /home/albinus/src/emacs/lisp/org/org-pcomplete
~/src/org-mode/lisp/org-inlinetask hides /home/albinus/src/emacs/lisp/org/org-inlinetask
~/src/org-mode/lisp/ob-comint hides /home/albinus/src/emacs/lisp/org/ob-comint
~/src/org-mode/lisp/ob-org hides /home/albinus/src/emacs/lisp/org/ob-org
~/src/org-mode/lisp/ob-keys hides /home/albinus/src/emacs/lisp/org/ob-keys
~/src/org-mode/lisp/org-src hides /home/albinus/src/emacs/lisp/org/org-src
~/src/org-mode/lisp/org-ctags hides /home/albinus/src/emacs/lisp/org/org-ctags
~/src/org-mode/lisp/ob-clojure hides /home/albinus/src/emacs/lisp/org/ob-clojure
~/src/org-mode/lisp/ob-ocaml hides /home/albinus/src/emacs/lisp/org/ob-ocaml
~/src/org-mode/lisp/org-mobile hides /home/albinus/src/emacs/lisp/org/org-mobile
~/src/org-mode/lisp/ob-tangle hides /home/albinus/src/emacs/lisp/org/ob-tangle
~/src/org-mode/lisp/ob-asymptote hides /home/albinus/src/emacs/lisp/org/ob-asymptote
~/src/org-mode/lisp/ob-table hides /home/albinus/src/emacs/lisp/org/ob-table
~/src/org-mode/lisp/ob-makefile hides /home/albinus/src/emacs/lisp/org/ob-makefile
~/src/org-mode/lisp/ox-publish hides /home/albinus/src/emacs/lisp/org/ox-publish
~/src/org-mode/lisp/org-macro hides /home/albinus/src/emacs/lisp/org/org-macro
~/src/org-mode/lisp/ob-maxima hides /home/albinus/src/emacs/lisp/org/ob-maxima
~/src/org-mode/lisp/ox-man hides /home/albinus/src/emacs/lisp/org/ox-man
~/src/org-mode/lisp/ox-latex hides /home/albinus/src/emacs/lisp/org/ox-latex
~/src/org-mode/lisp/org-table hides /home/albinus/src/emacs/lisp/org/org-table
~/src/org-mode/lisp/org-colview hides /home/albinus/src/emacs/lisp/org/org-colview
~/src/org-mode/lisp/ob-haskell hides /home/albinus/src/emacs/lisp/org/ob-haskell
~/src/org-mode/lisp/org-version hides /home/albinus/src/emacs/lisp/org/org-version
~/src/org-mode/lisp/ox-texinfo hides /home/albinus/src/emacs/lisp/org/ox-texinfo
~/src/org-mode/lisp/ob-dot hides /home/albinus/src/emacs/lisp/org/ob-dot
~/src/org-mode/lisp/ob-lob hides /home/albinus/src/emacs/lisp/org/ob-lob
~/src/org-mode/lisp/ob-mscgen hides /home/albinus/src/emacs/lisp/org/ob-mscgen
~/src/org-mode/lisp/ob-js hides /home/albinus/src/emacs/lisp/org/ob-js
~/src/org-mode/lisp/ob-eval hides /home/albinus/src/emacs/lisp/org/ob-eval
~/src/org-mode/lisp/org-eshell hides /home/albinus/src/emacs/lisp/org/org-eshell
~/src/org-mode/lisp/ob-abc hides /home/albinus/src/emacs/lisp/org/ob-abc
~/src/org-mode/lisp/org-feed hides /home/albinus/src/emacs/lisp/org/org-feed
~/src/org-mode/lisp/ob-R hides /home/albinus/src/emacs/lisp/org/ob-R
~/src/org-mode/lisp/org-crypt hides /home/albinus/src/emacs/lisp/org/org-crypt
~/src/org-mode/lisp/org-footnote hides /home/albinus/src/emacs/lisp/org/org-footnote
~/src/org-mode/lisp/ox-ascii hides /home/albinus/src/emacs/lisp/org/ox-ascii
~/src/org-mode/lisp/ob-screen hides /home/albinus/src/emacs/lisp/org/ob-screen
~/src/org-mode/lisp/org-w3m hides /home/albinus/src/emacs/lisp/org/org-w3m
~/src/org-mode/lisp/org-mhe hides /home/albinus/src/emacs/lisp/org/org-mhe
~/src/org-mode/lisp/org-attach hides /home/albinus/src/emacs/lisp/org/org-attach
~/src/org-mode/lisp/org-habit hides /home/albinus/src/emacs/lisp/org/org-habit
~/src/org-mode/lisp/ob hides /home/albinus/src/emacs/lisp/org/ob
~/src/org-mode/lisp/org-clock hides /home/albinus/src/emacs/lisp/org/org-clock
~/src/org-mode/lisp/org-list hides /home/albinus/src/emacs/lisp/org/org-list
~/src/org-mode/lisp/ob-perl hides /home/albinus/src/emacs/lisp/org/ob-perl
~/src/org-mode/lisp/ob-fortran hides /home/albinus/src/emacs/lisp/org/ob-fortran
~/src/org-mode/lisp/org-protocol hides /home/albinus/src/emacs/lisp/org/org-protocol
~/src/org-mode/lisp/ox-icalendar hides /home/albinus/src/emacs/lisp/org/ox-icalendar
~/src/org-mode/lisp/org-info hides /home/albinus/src/emacs/lisp/org/org-info
~/src/org-mode/lisp/org-docview hides /home/albinus/src/emacs/lisp/org/org-docview
~/src/org-mode/lisp/org-id hides /home/albinus/src/emacs/lisp/org/org-id
~/src/org-mode/lisp/org-faces hides /home/albinus/src/emacs/lisp/org/org-faces
~/src/org-mode/lisp/ob-emacs-lisp hides /home/albinus/src/emacs/lisp/org/ob-emacs-lisp
~/src/org-mode/lisp/org hides /home/albinus/src/emacs/lisp/org/org
~/src/org-mode/lisp/org-rmail hides /home/albinus/src/emacs/lisp/org/org-rmail
~/src/org-mode/lisp/ob-ebnf hides /home/albinus/src/emacs/lisp/org/ob-ebnf
~/src/org-mode/lisp/ob-shen hides /home/albinus/src/emacs/lisp/org/ob-shen
~/src/org-mode/lisp/org-capture hides /home/albinus/src/emacs/lisp/org/org-capture
~/src/org-mode/lisp/org-element hides /home/albinus/src/emacs/lisp/org/org-element
~/src/org-mode/lisp/ob-ditaa hides /home/albinus/src/emacs/lisp/org/ob-ditaa
~/src/org-mode/lisp/ob-latex hides /home/albinus/src/emacs/lisp/org/ob-latex
~/src/org-mode/lisp/ob-io hides /home/albinus/src/emacs/lisp/org/ob-io
~/src/org-mode/lisp/ob-sh hides /home/albinus/src/emacs/lisp/org/ob-sh
~/src/org-mode/lisp/org-datetree hides /home/albinus/src/emacs/lisp/org/org-datetree
~/src/org-mode/lisp/ob-picolisp hides /home/albinus/src/emacs/lisp/org/ob-picolisp
~/src/org-mode/lisp/ob-sql hides /home/albinus/src/emacs/lisp/org/ob-sql
~/src/org-mode/lisp/ob-scheme hides /home/albinus/src/emacs/lisp/org/ob-scheme
~/src/org-mode/lisp/org-loaddefs hides /home/albinus/src/emacs/lisp/org/org-loaddefs
~/src/tramp/lisp/tramp-smb hides /home/albinus/src/emacs/lisp/net/tramp-smb
~/src/tramp/lisp/tramp-uu hides /home/albinus/src/emacs/lisp/net/tramp-uu
~/src/tramp/lisp/tramp-adb hides /home/albinus/src/emacs/lisp/net/tramp-adb
~/src/tramp/lisp/tramp-cmds hides /home/albinus/src/emacs/lisp/net/tramp-cmds
~/src/tramp/lisp/tramp-cache hides /home/albinus/src/emacs/lisp/net/tramp-cache
~/src/tramp/lisp/trampver hides /home/albinus/src/emacs/lisp/net/trampver
~/src/tramp/lisp/tramp-ftp hides /home/albinus/src/emacs/lisp/net/tramp-ftp
~/src/tramp/lisp/tramp-sh hides /home/albinus/src/emacs/lisp/net/tramp-sh
~/src/tramp/lisp/tramp hides /home/albinus/src/emacs/lisp/net/tramp
~/src/tramp/lisp/tramp-loaddefs hides /home/albinus/src/emacs/lisp/net/tramp-loaddefs
~/lisp/dbus hides /home/albinus/src/emacs/lisp/net/dbus
~/lisp/soap-client hides /home/albinus/src/emacs/lisp/net/soap-client
~/src/tramp/lisp/tramp-gw hides /home/albinus/src/emacs/lisp/net/tramp-gw
~/src/tramp/lisp/tramp-gvfs hides /home/albinus/src/emacs/lisp/net/tramp-gvfs
~/src/tramp/lisp/tramp-compat hides /home/albinus/src/emacs/lisp/net/tramp-compat

Features:
(shadow sort mail-extr warnings emacsbug message rfc822 mml mml-sec
mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils
mailheader sendmail rfc2047 rfc2045 ietf-drums mail-utils xterm
cperl-mode debbugs-autoloads info easymenu magit-autoloads
zeitgeist-autoloads package time tramp tramp-compat auth-source eieio
byte-opt bytecomp byte-compile cconv eieio-core gnus-util mm-util
mail-prsvr password-cache tramp-loaddefs cl-macs gv trampver shell
pcomplete comint ansi-color ring format-spec advice help-fns cl
cl-loaddefs cl-lib autorevert filenotify iswitchb jka-compr icomplete
time-date paren ps-print ps-def lpr vc vc-dispatcher dired tooltip
ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar dnd
fontset image regexp-opt fringe tabulated-list newcomment lisp-mode
prog-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote make-network-process
dbusbind gfilenotify dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)

bug#15882: Status: 24.3.50; gnus does not suppress email tracking

[Michael Albinus]

reassign 15882 emacs,gnus

thanks

bug#15882: 24.3.50; gnus does not suppress email tracking

[Lars Ingebrigtsen]

Michael Albinus <michael.albinus@gmx.de> writes:

> There are many methods to track html emails from remote side. Most of
> them do not work when reading emails with gnus, because the shr renderer
> does not support javascript or css or suchalike.
>
> However, svg inline with remote images are not detected by shr. You can
> test this when sending yourself an email from the webpage
> <https://emailprivacytester.com/>, and read that email with gnus.

I was unable to test this, because our virus scanner eviscerated the
message.  Could you forward a complete message from the privacy tester,
or just a simple test case that shows the SVG problem?

Is the problem that the imagemagick library fetches (sub-)images from
embedded SVG images or something?

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

bug#15882: 24.3.50; gnus does not suppress email tracking

[Michael Albinus]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> I was unable to test this, because our virus scanner eviscerated the
> message.  Could you forward a complete message from the privacy tester,
> or just a simple test case that shows the SVG problem?

I'll send you the test email off the ML.

> Is the problem that the imagemagick library fetches (sub-)images from
> embedded SVG images or something?

The web site gives as explanation

--8<---------------cut here---------------start------------->8---
Test - SVG inline with remote image

In the <body> of the HTML part, place a tag as follows:

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink">
        <image xlink:href="http://TRACKING_URL/"/>
</svg>
--8<---------------cut here---------------end--------------->8---

I would conclude, that the <image ... /> link does not point to an
image, but just an arbitrary URL which is used for tracking. Likely,
images shall not be loaded by default in shr. At least there shall be an
option which prevents this, when shr is used for rendering email in gnus.

Best regards, Michael.

bug#15882: 24.3.50; gnus does not suppress email tracking

[Lars Ingebrigtsen]

Michael Albinus <michael.albinus@gmx.de> writes:

> In the <body> of the HTML part, place a tag as follows:
>
> <svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg"
> xmlns:xlink="http://www.w3.org/1999/xlink">
>         <image xlink:href="http://TRACKING_URL/"/>
> </svg>

Right.  I've now made 'xlink:href follow the same rules for blocking as
<img> images in shr.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/

bug#15882: 24.3.50; gnus does not suppress email tracking

[Michael Albinus]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> Right.  I've now made 'xlink:href follow the same rules for blocking as
> <img> images in shr.

It is fixed now, indeed. Thank you!

Best regards, Michael.