Re: Archiving HTML mail

[Florian Weimer <fw@deneb.enyo.de>]

* Eric Wong:

> You can use "publicinbox.$NAME.filter = PublicInbox::Filter::Mirror"
> in the config to blindly mirror everything, which I use for
> public-inbox-watch.
> 
> I also added "--no-precheck" to public-inbox-mda recently which
> disables the last of the mda-specific checks:
> https://public-inbox.org/meta/20191016003956.13269-1-e@80x24.org/

Thanks for the pointers.

> text/html is currently shown inline as raw HTML since
> https://public-inbox.org/meta/20191031031220.21048-2-e@80x24.org/
> But maybe the HTML part shouldn't be shown inline at all in
> multiparts parents.

Yeah, there's some concern that this could be used to host phishing
forms.  I've seen this occasionally in the Debian mailing list archive
(where anti-phishing companies tend to report them several years later
to security@).

My feeling is that it would need some post-processing, maybe stripping
image links and forms (and Javascript of course).  Plus the separate
domain thing for additional XSS protection (like bugzilla.mozilla.org
does, IIRC).  But presumably you could put the entire list archive
under its own domain to avoid having to write code for that.

> FWIW, I suggest keeping your lists text-only so contributors can
> flow between different projects more easily and not get blocked
> by spam filters.  It's significantly more expensive to do spam
> processing on HTML mail and less accurate IME.  Better to teach
> contributors to optimize for low-end computers and limited
> bandwidth situations :)

While this is true, it is also a bad experience for those who send
their first email (which may be a huge step for some, I completely
lack perspective there), and then it gets rejected with an obscure
message.  It's also very confusing if Cc:s are involved and everyone
but the mailing list gets the message.

In some clients, it's now impossible to switch of HTML mail (but I
don't know which variant, whether that's HTML-only, or whether there's
still a client-generated text/plain alternative).

> Also, public-inbox-watch is designed to work in parallel with
> existing mailing lists.  I archive several lists (including
> libc-alpha@sourceware and git@vger) this way with no special
> permissions or access aside from being a regular subscriber.

I feel we need to change libc-alpha to accept text/html email.