Omit User-Agent: header by default

The User-Agent: header can be fun and interesting and useful for
debugging, but it also leaks quite a bit of information about the user
and their software stack.

This represents a potential security risk (attackers can target the
particular stack) and also an anonymity risk (a user trying to
preserve their anonymity by sending mail from a non-associated account
might reveal quite a lot of information if their choice of mail user
agent is exposed).

Users who want to configure `user_agent` to `yes` can still do so, but
it makes sense to have safer defaults.

Closes: #159

diff --git a/init.h b/init.h
index 041806b185c3b5b99ef4dec48aa040cd005c3fd8..28eb37ba98d8fe743aa256470b319bd1136c26f5 100644 (file)
--- a/init.h
+++ b/init.h
@@ -4142,7 +4142,7 @@ struct option_t MuttVars[] = {
   ** Normally, the default should work.
   */
 #endif /* HAVE_GETADDRINFO */
-  { "user_agent",      DT_BOOL, R_NONE, {.l=OPTXMAILER}, {.l=1} },
+  { "user_agent",      DT_BOOL, R_NONE, {.l=OPTXMAILER}, {.l=0} },
   /*
   ** .pp
   ** When \fIset\fP, mutt will add a ``User-Agent:'' header to outgoing