211–220 of 316 posts
Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.
It seems like the only real issue here is that a file:// URL can make a network request. Who could ever think that that would be a good idea?
Earlier quoted context omitted.
On the contrary, it's a simple and explicit (when not stupidly hidden...) way of denoting the file type, which is great for interoperability and information interchange. Proprietary, opaque mechanisms like resource forks only serve to keep users uninformed (and thus unlearning) and impede the free interchange of information between different applications.
But it's not a file type, it's a file extension that sometimes can be matched to a content type.
Has Apple paid the author yet? Or is this yet another free bug bounty?
I wish there was more elaboration on this. Opening a downloaded file without user interaction sounds pretty bad.
Sure, you know this is a simple txt file, so anything can come into it, right? There is no such thing as malicious txt file.
File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rena…
Earlier quoted context omitted.
Whether or not a default configuration is vulnerable is a pretty typical component of accessing a vulnerability’s severity. Unfortunate that the author didn’t mention this. Obviously this doesn’t excuse the bug, but it’s important to contextualize if we hope to compare relative impact and have frank discussions.
The default configuration was, in fact, vulnerable at the time. Having it be commented out by default is new.
File extensions are a kludge anyway. (And Windows 10 still hides them by default, because hey, backwards compatibility, and you wouldn't want to confuse Grandma who's seen the file be called "grandkids" since Windows 95..). Why should the filetype be dependent on the name? People even think renaming a .BMP to .JPG means now it's a compressed file! Old school Macs stored the filetype outside of a file, so you can rena…
It would be kind of neat if changing the extension of a file caused it to be converted automatically. It would save a bunch of typing and browsing around. Just rename a directory to foo.tar.gz and it gets compressed and tarred. I'm not saying that the kernel should be doing that, but it feels like a nice abstraction for some UI.
Earlier quoted context omitted.
I was in my tweens/early teens when I learned about ResEdit. I thought it was some kind of hacker tool, and I was amused at the various things I could change.
I used to add menu items (that didn’t do anything), I was able to change picture/icon resources inside apps, all kinds of fun stuff. Change command mapping, etc
Earlier quoted context omitted.
It would be kind of neat if changing the extension of a file caused it to be converted automatically. It would save a bunch of typing and browsing around. Just rename a directory to foo.tar.gz and it gets compressed and tarred. I'm not saying that the kernel should be doing that, but it feels like a nice abstraction for some UI.
But why tar it in the first place? If you want to share a directory, the system can tar it for you behind the scenes. Also, the system can zip anything behind the scenes, without the user knowing.