Open a message and it appears in the View like any other document, with its subject on the tab. What's different is how it's treated. A message is the only document in Desktop Minder written by somebody who wasn't asked to be careful, so it's the only one treated as hostile from the start: it runs nothing, it fetches nothing from anywhere until you say so, and its attachments are never opened on their own.

What You See

The message's tab shows its subject, and the message itself starts with the subject again, then who it's from, who it's to, and when. Formatted mail is shown as the page it is; plain mail is wrapped to the width of the View. Opening a message marks it read. Its two tabs are View, which is the message, and Source, which shows the whole raw message as text, every header included, for when you want to see what was actually sent.

The Properties panel describes the message and its delivery. It says where a message arrived from, never where it was "sent from," because that's all it honestly knows: the machine that handed the message to your server. Everything a message says about itself before that point was written by whoever sent it, and can say absolutely anything. The panel also gives the sender checks—SPF, DKIM and DMARC—as the mailbox's own server reported them, read the same way the spam filter reads them; a verdict written into the message by anyone else, a forger included, isn't believed. It also says the program the message was written with, and whether it's bulk mail.

Three Walls

A message is shown inside three walls, any one of which would do on its own:

• It's shown in a sealed box in which no script runs at all, and from which it can't reach anything else in the program.
• A rule at the top of the message stops the browser from fetching anything from the internet before a request is even made. Only the pictures that came with the message are allowed.
• And as a backstop, every request the page makes that isn't the program's own is refused: refused by default and allowed by exception, because the list of ways to fetch something is longer than anyone's list of ways to block them.

The browser's habit of offering to save passwords and fill in forms is switched off in mail, too.

Pictures

Pictures that came inside a message are shown, up to four megabytes each. Pictures it only points at, somewhere on the internet, are held back, behind a yellow bar: "3 pictures were not loaded, because loading them would tell the sender you read this." That's what a tracking pixel is: a picture one dot across, whose address is unique to you, so that fetching it tells the sender the exact moment you opened their message, and from where. A mail program that loads them quietly is answering on your behalf.

Show pictures loads them, for this message, this time. Opening it again asks again, because the answer was about one message, not about the sender.

Links

A link to a web page opens that page right there in the View, as a document like any other, and Back brings you back to the message. Point at a link without clicking and its address shows along the bottom of the window, so you can see where it really goes before you go. A mailto: link goes to Windows. Anything else is refused, because handing a file: link to Windows runs a program.

Getting Rid of It

An open message has three buttons beside Back and Ahead. Up shows the basket it's in. The trash can sends it to the Recycle Bin, closes its View, and puts you back where you were; where there's a Recycle Bin to take it, nothing asks first, because the Recycle Bin is the undo. In the Inbox, Unknown Senders and Newsletters there's a spam can too, which asks Mark as Spam and then closes the message the same way.

Attachments

Attachments are listed with the message, and each can be saved, through a Save box, to wherever you choose. That's all. An attachment is never opened by the reader, and never written anywhere on its own: what arrives in the post is not run because it asked nicely, and the Save box is you saying yes to this one. A saved file carries the mark Windows uses for things that came from the internet, so Windows will warn before running it.

Not Yet

• An attachment opened as the document it is—a picture, a text, a web page—in the View, or dragged straight out to a folder.
• Web addresses in plain-text mail shown as links.