Re: [nail-devel] Is there a way to configure to prompt before opening an attachment?

[Gunnar R. <Gun...@pl...>]

Bob Tennent <rd...@cs...> wrote:

>  >|Basically, I don't want attachments to open automatically. 
> I suggest you avoid acroread and similar bloatware (OO.org for instance)
> in this context.  Use applications such as w3m, pdftotext and antiword
> which start instantaneously and display to the terminal.

I would second that in general. This is what the pipe-content/subcontent
mechanism was really intended for; it uses external tools to insert the
converted attachment contents into the message stream in-line. Its use
with GUI applications was not originally anticipated, it just turned out
to work in practice.

But the problem remains: Do I trust pdftotext enough to have it invoked
automatically on any message I get? There have been at least two major
vulnerabilities in xpdf in the last half year. I frankly do not know if
they applied to its pdftotext component too, and I also do not want to
say that xpdf is a questionable application. But the task it performs
is so obviously complex that it is questionable whether one can ever
trust that much in any PDF reader program.

As I wrote, it is not possible to ask on the terminal if an attachment
should be passed to an application without revising the whole pager
mechanism. I also do not consider this to be the optimal solution to
the problem; I would personally find it quite nasty to be asked that
every time I view a message.

Another possibility is to have a second set of pipe-x/y-style variables
that would not be effective with the regular 'print' and 'next' commands,
but with a special 'print-a-trusted-message' one.

But perhaps there are still better ideas.

	Gunnar