logoalt Hacker News

sfinkyesterday at 6:24 PM0 repliesview on HN

You have to balance security with utility, so you find obviously safe compromises. You shouldn't allow applications to share completely different file formats. Your text editor doesn't need to be able to open an mp3 file. Even when it's convenient for an application to open a file, as long as it can't execute the file it can't do too much damage. Be sure to consider that interpreting complex file formats is dangerous, since parsers can and are exploited regularly. So be careful about trusting anything but dead-simple text files.

Oh, and by the way, now we'd like to make all written text treated as executable instructions by a tool that needs access to pretty much everything in order to perform its function.