Thank you. This is the important takeaway here. Changing the encoding simply swaps out one set of vulnerabilities and attacks for another. Separating control f

Thank you. This is the important takeaway here. Changing the encoding simply swaps out one set of vulnerabilities and attacks for another. Separating control flow and data is the actual silver bullet for this category of attacks. Unfortunately, there’s rarely ever a totally clear logical separation between the two. Anything you want to bucket into “control”, someone else is going to want the client to be able to manipulate as data.