3 ms·

I’m not so sure … If you expect a host name and you end up clicking a file instead, that seems dangerous. But in this case, you expect to open a file and you

by rsync 3y ago

I’m not so sure … If you expect a host name and you end up clicking a file instead, that seems dangerous. But in this case, you expect to open a file and you visit a website instead? That sounds simply annoying… Maybe this is for browsers to deal with - if there is a collision between TLD and (file extension on this system) throw up a warning?

CydeWeys 3y ago
You'd be throwing a warning on nearly every domain name, including this very site we're on right now. What would be the point? Domain names are different from file system paths, full stop.
- growthwtf 3y ago
  I was interested in that, and apparently that has actually been used as an attack vector in the past! https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_the_.com_extension https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_th... TIL. Do you think computer users always think that's the case? I tend to come down on the side of "no, probably not" but open to other arguments.
growthwtf 3y ago
Exactly — and I think the danger is in website mimicking a file being opened. Which, browsers have already trained us to expect in many cases. Maybe some browser teams will implement a warning like this, that would make sense to me?
jareklupinski 3y ago
it could be worse, if the 'website' server automatically returned / downloaded something called YourTaxReturns.zip
- danem 3y ago
  Just to make sure I'm following, the scenario you're worrying about is someone sends an email containing a url to "YourTaxReturns.zip". Upon visiting the site, it automatically downloads a zip file named "YourTaxReturns.zip". And then what? How is this any worse than the user downloading the zip directly? They clearly wanted to download it, given they clicked on it after all.
  - deleted 3y ago
    [deleted]

3 ms·

I’m not so sure … If you expect a host name and you end up clicking a file instead, that seems dangerous. But in this case, you expect to open a file and you

by rsync 3y ago

CydeWeys 3y ago
You'd be throwing a warning on nearly every domain name, including this very site we're on right now. What would be the point? Domain names are different from file system paths, full stop.
- growthwtf 3y ago
  I was interested in that, and apparently that has actually been used as an attack vector in the past! https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_the_.com_extension https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_th... TIL. Do you think computer users always think that's the case? I tend to come down on the side of "no, probably not" but open to other arguments.
growthwtf 3y ago
Exactly — and I think the danger is in website mimicking a file being opened. Which, browsers have already trained us to expect in many cases. Maybe some browser teams will implement a warning like this, that would make sense to me?
jareklupinski 3y ago
it could be worse, if the 'website' server automatically returned / downloaded something called YourTaxReturns.zip
- danem 3y ago
  Just to make sure I'm following, the scenario you're worrying about is someone sends an email containing a url to "YourTaxReturns.zip". Upon visiting the site, it automatically downloads a zip file named "YourTaxReturns.zip". And then what? How is this any worse than the user downloading the zip directly? They clearly wanted to download it, given they clicked on it after all.
  - deleted 3y ago
    [deleted]