3 ms·
I find it kind of astonishing that Word documents have been an attack vector (a) in the first place and (b) for as long as they have without a sealing patch. Li
by raydiatian 4y ago
I find it kind of astonishing that Word documents have been an attack vector (a) in the first place and (b) for as long as they have without a sealing patch. Like, why do I need my word document to contain any sort of RPC invoking capability.
- zamadatix 4y agoMacro enabled documents enable you to programmatically publish content. E.g. you can pull from an Access database or an Excel sheet and have it autogenerate formatted quotes for customers. Such flexibility is naturally a security risk which is why it has been made so difficult for the typical user to run this kind of document without jumping through hoops to do so but it makes no sense to remove the functionality from Word itself in the same way it doesn't make sense to remove PowerShell.
- raydiatian 4y agoDid it ever make sense to put it there in the first place?
- zamadatix 4y agoI mean why not. Remember this isn't a standard Word document John Doe is going to type his homework assignment in it's a whole different filetype for a different use case. Office got VBA functionality before Netscape or IE were even a thing so it has a valid excuse of why the default security restrictions came later - the internet wasn't really a threat model yet.
- raydiatian 4y agoFair arguments, esp cart coming before horse security-wise