frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Roundcube Webmail: SVG feImage bypasses image blocking to track email opens

https://nullcathedral.com/posts/2026-02-08-roundcube-svg-feimage-remote-image-bypass/
46•nullcathedral•1h ago

Comments

Galanwe•1h ago
Nice catch!

I am trying to read as less _online_ as possible nowadays. I essentially have dovecot in my crontab, and read it off roundcube. It's been working great, RoundCube is dead simple to setup and use, the UI and search are very fast.

stragies•59m ago
Hmm, I wonder, if roundcube was the exception (w.r.t feImage), or if soon other webmail clients will need to be patched
nullcathedral•39m ago
Author here! I have looked at Thunderbird. I'll go and look at some others as well, should have probably done that earlier.
zimpenfish•20m ago
I wouldn't vouch 100% for my PHP understanding but it looks like SnappyMail removes `<svg>` elements entirely (`BuildHtml` in `snappymail/v/2.38.2/app/libraries/MailSo/Base/HtmlUtils.php`)
smelendez•44m ago
I often think the best way to defeat email open tracking would be for a mainstream email client to prefetch every image when a non-spam email is received and cache it for 72 hours or so.

Every email gets flagged as “opened,” so the flag is meaningless, and recipients can see the images without triggering a tracker.

mmh0000•41m ago
Some of the big providers already do this, notably Apple and Gmail:

https://www.litmus.com/blog/gmail-prefetching-images

Saris•39m ago
I think this is what icloud does. Seems like an easy way to make tracking useless if every client did it.
mzi•4m ago
I worked for a short time for an American company. They had periodic phishing test from Mitnick. The links in those emails was not to be clicked as it would trigger a mandatory training. The emails also had a header saying they were a phishing test, so I deleted all those emails in a filter.

The company also ran a mail filter called Baracuda or something similar that followed links in emails to see if they were malicious.

I was quite annoyed when I was called to do the mandatory training as "I" had clicked a link (on an email I hadn't seen) and more so when told I had no other recourse than to sit through it.

I resigned shortly afterwards.

jonathanlydall•43m ago
Slightly related, but fraudsters love using .svg attachments, typically the mails purport to be for an invoice which you need to log into your Microsoft account to be able to “securely” view.

I’m not sure if Exchange Online doesn’t scan them or something, but I landed up making a rule which blocks all emails with either .svg or .htm(l) attachments and to notify me when blocked.

Happens a couple of times per month for the our small company, no false positives yet.

michaelteter•23m ago
Not disputing the article, nor insinuating that there's some ulterior motive, but it's curious that this blog has only one post; and the About page suggests a lengthier history (with references to what would have been previous posts).
nullcathedral•4m ago
Author here! Are you referring to the "What’s inside this vendor’s VMware images?" on the about page? That is merely an illustration of what goes on inside my head. This is the first article on my blog.
Avamander•2m ago
SVGs are just the tip of the iceberg of how hard it is to sanitize email content. There aren't any purpose-built good libraries for email sanitization either. That would handle SVG, CSS, HTML, everything.

Corporations Don't Have to Maximize Profits (2015)

https://www.nytimes.com/roomfordebate/2015/04/16/what-are-corporations-obligations-to-shareholder...
1•speckx•51s ago•0 comments

Betteridge's Law of Headlines

https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines
1•wjb3•1m ago•0 comments

The Gradual Print Is Here

https://www.lynalden.com/february-2026-newsletter/
1•throwaway_08932•1m ago•0 comments

EU AI Act: Practical Risk Classification for Business AI Use Cases

https://www.jaikin.eu/en/ia-conforme-rgpd-ai-act
1•victorgk_•2m ago•1 comments

Show HN: We audited AI agent configs on GitHub. Every one had security issues

https://clawhatch.com/blog/state-of-ai-agent-security-2026
1•pensaer•3m ago•0 comments

Hacker News in Your Terminal

https://github.com/bensadeh/circumflex
1•saikatsg•5m ago•0 comments

Ask HN: What to do instead of giving up on tech

1•moon2•9m ago•0 comments

Show HN: PLP – An open protocol for managing AI prompts (3 REST endpoints, MIT)

https://github.com/GoReal-AI/plp
1•sossoecho•10m ago•1 comments

Show HN: Calculator for UK student loan repayment strategies

https://mystudentloan.uk
2•farham•10m ago•0 comments

Context Fence Design Pattern for Claude Code Skills

https://github.com/jimmc414/claude-context-fence
1•Jimmc414•12m ago•0 comments

Intel Recently Shelved Numerous Open-Source Projects

https://www.phoronix.com/news/Intel-OSS-Projects-Ended-2025
1•pjmlp•12m ago•0 comments

Catching Fire: How Cooking Made Us Human (2009) [pdf]

https://dn790008.ca.archive.org/0/items/pdfy-DDoNCJJ_Wt0qOH7e/Catching%20Fire%20%5BHow%20Cooking%...
2•bookofjoe•13m ago•0 comments

A Newbie's First Contribution to (Rust for) Linux

https://blog.buenzli.dev/rust-for-linux-first-contrib/
1•goranmoomin•17m ago•0 comments

Ask HN: How are you enabling your company to vibe-code?

1•tornato7•18m ago•0 comments

Multi-Layered Counter-UAS Defense: Portable, Mobile, and Fixed

https://dzyne.com/counter-uas/
1•rolph•19m ago•0 comments

Is artificial general intelligence here?

https://www.universityofcalifornia.edu/news/artificial-general-intelligence-here
1•geox•19m ago•0 comments

Show HN: Sofia Core – Open-source AI infrastructure with biological computing

https://github.com/emeraldorbit/sofia-core-backend
1•emeraldorbit•19m ago•0 comments

Ask HN: How do you maintain integrations once they're in production?

1•ksvmkoundinya•20m ago•0 comments

"Infinite Jest" Has Turned Thirty. Have We Forgotten How to Read It?

https://www.newyorker.com/magazine/2026/02/02/infinite-jest-david-foster-wallace-anniversary-book...
1•B1FF_PSUVM•20m ago•0 comments

Show HN: SubAnalyzer subdomain discovery and external attack surface map tool

https://subanalyzer.com
1•TallSession9532•20m ago•0 comments

31-year old VT220 terminfo curses bug

https://lists.gnu.org/archive/html/bug-ncurses/2026-02/msg00004.html
1•mprovost•22m ago•1 comments

Interlock (Engineering)

https://en.wikipedia.org/wiki/Interlock_(engineering)
1•downboots•23m ago•0 comments

Master of Science in Applied Ontology (Fully Online)

http://ontology.buffalo.edu/
1•hackandthink•23m ago•0 comments

Creating a Programming Language Using Coding Agents on GitHub

https://dsyme.net/2026/02/08/july-2025-creating-a-compiler-with-a-swarm/
1•laurentlb•28m ago•0 comments

Hollywood Is Losing Audiences to AI Fatigue

https://www.wired.com/story/hollywood-is-losing-audiences-to-ai-fatigue/
1•saikatsg•29m ago•3 comments

SOK: On the Analysis of Web Browser Security (2021)

https://arxiv.org/abs/2112.15561
1•walterbell•30m ago•0 comments

An Analysis of Poptropica's Mancala

https://farlow.dev/2026/02/08/an-analysis-of-poptropicas-mancala
2•farlow•33m ago•0 comments

Why Improving VO₂ Max Increases Confidence Outside of Workouts

https://www.vo2maxpro.com/blog/vo2-max-confidence-beyond-workouts
1•GoodluckH•33m ago•0 comments

Show HN: Nick the Groq – AI Poker Coach- Open Source

https://poker-coacher.vercel.app/
1•hotrod46•37m ago•0 comments

DSA Interview Preparation Guide: Complete 90-Day Roadmap

https://www.dsaprep.dev/blog/dsa-interview-preparation-guide-90-day-roadmap
1•anjandutta•37m ago•0 comments