The "carpet bomb" attack that the article refers to is scripting the browser to download a lot of files, knowing that Safari doesn't prompt before downloading a

The "carpet bomb" attack that the article refers to is scripting the browser to download a lot of files, knowing that Safari doesn't prompt before downloading a file, in the hope that the user will execute one of them. I don't think this kind of a attack is that practical on OS X as there's no way of automatically executing a downloaded executable (as far as I know) and OS X's sandbox would kick in with a dialog confirming that the file should be opened on the off-chance the user did elect to open something random from the internet. It's arguable that this could be a more powerful attack by taking advantage of an exploit in the handling of one of the "Safe" formats that are (by default) opened automatically (Movies, Pictures, etc). However, such an attack would be more subtle if it were just used inline in a webpage which makes the issue a bit redundant.