Related thoughts specifically concerning ransomware (controlling write access): Operating systems with a GUI typically have file associations bound to executab

Related thoughts specifically concerning ransomware (controlling write access): Operating systems with a GUI typically have file associations bound to executables. One could use that knowledge to restrict write access (or even read access), or at least use this fact; "application with no file associations does file I/O." Excluding known system executables, etc. So if applied more strictly, an application that wasn't associated with .JPG or .JPEG couldn't write to those files, or perhaps not even read from them. As for restricting read access, my first thought goes to browsers that may not be associated with every file type you want to upload/attach, but that could be a dialog between you and the system as it happens (allow it once/now/session, for N days, forever, etc).