I think all these things are absolutely ridiculous.

I use alpine (the email client, not the Linux distro). Before that, I used pine.

Every single thing that gets loaded from anywhere on the Internet has to be the result of an action that I take. Nothing ever gets loaded automatically. I get to choose if I load the thing using the server that I'm connected to, or if I load it directly on my local machine. I know the implications of each.

The fact that programs, particularly ones that are supposed to be for the security minded like Signal, load anything by default, automatically, is just, well, naive.

I can't be the only person who thinks that people who don't think these things through shouldn't be working on apps and email clients. Sure, people would have a cow if their email client didn't load every frigging thing and run remote Javascript and so on, but in Signal? Really?

(end rant)

I see that this can be turned off. I will now tell everyone I know that uses Signal that this should, in fact, be turned off.