3 ms·
Depends entirely on your application. Often you know, or are willing to constrain, the uses of an input.
by eximius 8y ago
Depends entirely on your application. Often you know, or are willing to constrain, the uses of an input.
- Bartweiss 8y agoAnd for encryption, absolutely should when in doubt. The HTML tag attack on PGP works by mixing plain and cipher text, which is a thing people might genuinely want to do. But the safer clients still interfered with it by re-encrypting anything which didn't begin with a PGP signature, for the very good reason that they couldn't trust mixed messages. The clients which mildly constrained inputs prevented the entire attack vector, and it looks a very good tradeoff right now.