41–50 of 90 posts
Honestly, I harbour just a smidgeon of hope that cases like this will nudge companies to reevaluate the whole “find text that could be a link with a missing protocol” feature and realise that it’s a terrible idea that causes more trouble than it solves. If you want a link, write a proper URL. The embedded tweet shows another problem, too: > Grrr... Because .zip is a valid TLD, it's impossible to know whether http://t…
Can someone describe a concrete vulnerability that this creates?
How is this different from .com, which was also a common file extension?
It's not a commonly used extension, and it's a dangerous file type, so users shouldn't be opening received .com files either way. OTOH .zip is quite common and has legitimate uses.
Can someone describe a concrete vulnerability that this creates?
I’d really like to use my last name as a TLD so I can do firstname.lastname.
Earlier quoted context omitted.
.com .sh There are many file extension collisions with TLDs and the sky didn't fall yet
Neither of those are used by general consumers on a regular basis. Those are used by people that are generally knowledgeable. I don't know why people can't wrap their head around this. .zip is used every day by people that aren't the best at understanding computer security. Massive difference.
This is going to be a problem, but not for the average folk, but rather for IT teams with unstable rules and other software teams like Gmail who are likely to signal larger differences between attachments and just links.
Here's the files you requested: https://attachment.zip
Rickrolling in 2023: Video is initially paused with a full title card visible, If you attempt to play it, you get 5 seconds of an AD playing before you can manually click a Skip button, then finally the synth music comes in...
Yeah, it just doesn't work anymore.