Gmail will now support CSS media queries • Hacker News Board

Re: Gmail will now support CSS media queries

#41

Post by userbinator » Mon, Sep 19, 2016, 3:51 AM UTC

hrayr wrote: post #39

MereInterest wrote: post #37

This is a great thing. One more metric by which to filter out spam. If I am receiving an email from an actual person, it will be plain text, perhaps with 1-2 links or images, and will not contain any CSS.

A bit passive aggressive don't you think? There are plenty of reputable email clients that add extra styling to make email look better that are not necessarily spam.

I filter out HTML emails too, and a lot of mailing lists do as a standard practice. For some reason I find a large amount of sites which specify precise expectations for email are either German or somewhere in that region. Here's two examples:

https://www.gaertner.de/~neitzel/mail-policy.html

https://www-user.tu-chemnitz.de/~heha/email.var

The prevailing attitude seems to be "If you can't configure your email client to send plaintext or follow the other rules I've listed on my site, I'm not interested in communicating with you."

Re: Gmail will now support CSS media queries

#42

Post by beefsack » Mon, Sep 19, 2016, 4:40 AM UTC

TazeTSchnitzel wrote: post #7

This is mostly a distraction, but I still wish text/enriched had won instead of HTML email: https://en.wikipedia.org/wiki/Enriched_text If only because it's simpler, so it might have been more fully and consistently supported (and it's not a security nightmare).

I'm writing a text-rendered board games by email service and this would have been a perfect format for me. If only.

Re: Gmail will now support CSS media queries

#43

Post by themodelplumber » Mon, Sep 19, 2016, 5:08 AM UTC

MereInterest wrote: post #37

This is a great thing. One more metric by which to filter out spam. If I am receiving an email from an actual person, it will be plain text, perhaps with 1-2 links or images, and will not contain any CSS.

Well, if you ever end up working with a company for which someone created a responsive email footer, I hope your missing their email is not a big deal.

Re: Gmail will now support CSS media queries

#44

Post by wvenable » Mon, Sep 19, 2016, 5:22 AM UTC

TazeTSchnitzel wrote: post #7

This is mostly a distraction, but I still wish text/enriched had won instead of HTML email: https://en.wikipedia.org/wiki/Enriched_text If only because it's simpler, so it might have been more fully and consistently supported (and it's not a security nightmare).

I was expecting something significantly different from HTML but this is really just pre-CSS HTML with different tags. At this point, I can't imagine another SGML based language for formatting is necessary.

If everyone could just agree on a safe subset of HTML for email then that's all we would need.

Re: Gmail will now support CSS media queries

#45

Post by networth » Mon, Sep 19, 2016, 6:12 AM UTC

haimez wrote: post #32

networth wrote: post #30

Earlier quoted context omitted.

Put it in a safe iframe, whats the catch?

Everything. iframes can't fuck with you code, but they are 1. displayed in your page (is this a good idea, does this iframe agree with how your page will display it). 2. Is leaking information to this iframe (and consequently, that iframe's server that this email had been opened) a good idea (no. 100% it's not.). 3. Can someone else contrive another vector of page control or information leak that suits their motives…

Are most of these protected by sandboxed iframes? What kind if leak are you talking about? Referer leak? That is easy to fix, but what else?

I dont think email sender cares about how iframe is rendered. They currently render in a rectangle, and they will keep render in a rectangle.

Re: Gmail will now support CSS media queries

#46

Post by jcranmer » Mon, Sep 19, 2016, 6:36 AM UTC

wvenable wrote: post #44

TazeTSchnitzel wrote: post #7

This is mostly a distraction, but I still wish text/enriched had won instead of HTML email: https://en.wikipedia.org/wiki/Enriched_text If only because it's simpler, so it might have been more fully and consistently supported (and it's not a security nightmare).

I was expecting something significantly different from HTML but this is really just pre-CSS HTML with different tags. At this point, I can't imagine another SGML based language for formatting is necessary. If everyone could just agree on a safe subset of HTML for email then that's all we would need.

Thunderbird literally implements it by rewriting it into HTML: https://dxr.mozilla.org/comm-central/source/mailnews/mime/sr...

text/enriched was basically proposed as an interim result for richer text than plain text back when HTML email was controversial.

There is a more-or-less defunct community group at the W3C about building an HTML email specification. In practice, the elephant in the room remains Outlook, which uses the same HTML engine built into MS Word, which, IIRC, is built on IE 5.5.

Re: Gmail will now support CSS media queries

#47

Post by jcranmer » Mon, Sep 19, 2016, 6:39 AM UTC

haimez wrote: post #24

CM30 wrote: post #13

It's a good start, and something that's very useful for people coding HTML emails. That said, we still need to get this sort of thing in Microsoft Outlook, and both that and Gmail really need to support CSS to something of a normal standard, like with say Apple Mail or what not. There's no real reason email standards should be different to browser ones, except with the former not having Javascript included.

Good luck stopping a browser from implementing a "fun" javascript API just because it opens a security or usability hole in email.

No email client that I'm aware of supports JS in email. (Thunderbird used to have a hidden option for turning it on, but even that was removed when we doubted the ability to enforce sandboxing at all). All email clients sanitize the HTML in email to some extent anyways.

Re: Gmail will now support CSS media queries

#48

Post by jcranmer » Mon, Sep 19, 2016, 6:44 AM UTC

mschuster91 wrote: post #28

cpmsmith wrote: post #8

Earlier quoted context omitted.

They've historically been very restrictive about what they do and don't allow in emails—iirc, they even stripped CSS blocks entirely until recently. Even now they only accept a specific list of properties, selectors, and queries.[1] My impression is it's broadly in the name of security: if you allow arbitrary content inside a Google webpage, it's easy to imagine phishing running amok. [1]: https://developers.google.c…

The solution is very simple actually: place user-generated content like emails inside an iframe, after stripping out the JS. Add a CSP header disallowing external resource loads until the user confirms explicitly. This way, content using position:absolute can't escape the iframe borders, and the mail gets to enjoy full responsiveness.

iframes require explicit sizing, it's hard to adapt the size of an iframe to the size of its contents. Gmail, for example, doesn't use iframes to display message contents.

There is a request to HTML to let iframes take the height of their contents (the main thing anyone wanted from , which is now removed from HTML), but it's gone nowhere as of yet.

Re: Gmail will now support CSS media queries

#49

Post by pferde » Mon, Sep 19, 2016, 7:01 AM UTC

Alex3917 wrote: post #20

jeena wrote: post #14

I always wish we could go back to plaintext emails.

Pretty much every single html email also has a plaintext version attached, otherwise it hurts the deliverability. You just need to set your email client to use the plaintext version.

If only.

Re: Gmail will now support CSS media queries

#50

Post by packetslave » Mon, Sep 19, 2016, 7:09 AM UTC

mschuster91 wrote: post #28

cpmsmith wrote: post #8

Earlier quoted context omitted.

They've historically been very restrictive about what they do and don't allow in emails—iirc, they even stripped CSS blocks entirely until recently. Even now they only accept a specific list of properties, selectors, and queries.[1] My impression is it's broadly in the name of security: if you allow arbitrary content inside a Google webpage, it's easy to imagine phishing running amok. [1]: https://developers.google.c…

The solution is very simple actually: place user-generated content like emails inside an iframe, after stripping out the JS. Add a CSP header disallowing external resource loads until the user confirms explicitly. This way, content using position:absolute can't escape the iframe borders, and the mail gets to enjoy full responsiveness.

a gentle hint: if you find yourself writing "the solution is very simple" and you're talking about something at the scale of gmail (or Firefox, or AWS, or Linux, or...), you can probably be assured there are a few things you haven't considered.