Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man who thought opening a TXT file is fine thought wrong

paulosyibelo.com

Post reply on HN
Print view View original

191–200 of 316 posts

Re: Man who thought opening a TXT file is fine thought wrong

#191

Post by tsimionescu »

benatkin wrote: post #173
crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

The extension is meaningless outside of Windows...

File extensions are routinely used by all sorts of software, at least as hints if nothing else. For example, gcc will handle files named .c differently from files named .cpp, and will not even work with static libraries unless they are named .a.

Re: Man who thought opening a TXT file is fine thought wrong

#192

Post by simonh »

throwawayboise wrote: post #89
userbinator wrote: post #56

Two words: excessive complexity. It's always seemed strange that an application called TextEdit is actually more than a text editor. I strongly believe that content-type autodetection, much less HTML rendering(!), most certainly does not belong in a text editor.

TextEdit dates back to NeXTStep, so it was originally written in the late 1980s probably. Guessing it didn't render HTML originally, but it always had RTF capability. Not that it's an excuse in 2021, but very few applications from that era woudl be considered "safe" today.

This was fixed in 2020 so no need for any excuses in 2021.

Re: Man who thought opening a TXT file is fine thought wrong

#193

Post by tsimionescu »

eurasiantiger wrote: post #159
ethbr0 wrote: post #130

Earlier quoted context omitted.

That sound in the background is emacs laughing.

You can press ctrl-super-meta-¥ to make it stop.

I don't think it will accept the command if it knows you learned it as anything other than C-S-M-¥.

Re: Man who thought opening a TXT file is fine thought wrong

#194

Post by tsimionescu »

cyphar wrote: post #120
Railsify wrote: post #87

Earlier quoted context omitted.

But not with file extensions of .txt. They should only do bells and whistles if the extension warrants some bells. .md, sure syntax highlight me. But opening .txt and treating it as html, that seems strange.

Well, on Unix file extensions are a convention and don't have any strict semantic meaning. Maybe this doesn't make sense in a world where most people do think in terms of file extensions (thanks to the popularity of Windows) but it shouldn't be surprising that non-Windows programs might not special-case file extensions. (Though in fairness, text editors do usually have special casing for file extensions and these day…

This is only a Unix vs Windows thing in terms of the application launcher and how it is implemented. File extensions are semantically meaningful for many unix tools, most notably gcc.

Re: Man who thought opening a TXT file is fine thought wrong

#195

Post by extropy »

rcrisan wrote: post #186
tmp538394722 wrote: post #136

Earlier quoted context omitted.

“Everything’s a file!”

perhaps this is the worst possible abstraction to be protected by a security framework.

IMO not so much. Just assume all files are malicious unless accompanied by metadata saying otherwise. That is pretty much the status quo already.

Except we have some grandfathered file types that are implicitly trusted.

Re: Man who thought opening a TXT file is fine thought wrong

#196

Post by Jabbles »

extropy wrote: post #195
rcrisan wrote: post #186

Earlier quoted context omitted.

perhaps this is the worst possible abstraction to be protected by a security framework.

IMO not so much. Just assume all files are malicious unless accompanied by metadata saying otherwise. That is pretty much the status quo already. Except we have some grandfathered file types that are implicitly trusted.

In the article, the remote file's contents were not malicious, but merely trying to access it was. That would require a very different security posture to "assume all files are malicious".

Re: Man who thought opening a TXT file is fine thought wrong

#197

Post by Lucasoato »

extropy wrote: post #195
rcrisan wrote: post #186

Earlier quoted context omitted.

perhaps this is the worst possible abstraction to be protected by a security framework.

IMO not so much. Just assume all files are malicious unless accompanied by metadata saying otherwise. That is pretty much the status quo already. Except we have some grandfathered file types that are implicitly trusted.

And what about malicious metadata?

Re: Man who thought opening a TXT file is fine thought wrong

#199

Post by ngcc_hk »

bawolff wrote: post #145
crazygringo wrote: post #105

Oh, man. The idea that TextEdit automatically parsed .txt files as HTML if they started with a certain file signature is problematic... ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. I mean, the entire purpose of "file://" would seem to be to provide access to local/mounted files and only those. The fact that a Mac engineer thought it woul…

> ...but the fact that file:// schemes can access remote files by appending /net/ followed by a domain name is pretty shocking. Not that shocking. Windows has had that with SMB networking for ages file://SMBSERVERNAME/path/file . Linux somewhat supports /dev/tcp/HOSTNAME/PORT (technically that's application level in bash so not everywhere), and im sure there's daemons you could run to automount things on the fly.

Actually if I am not mistaken it is after they want to fight the browser war they break the barrier between the file system and internet system. It is not in the early version of windows or IE. the integration is one of the major mistakes Microsoft made. And surprise apple fall for it as well.

Can’t trust these two or ,,, who can we trust for network security.

Post reply on HN