> Is that the most widespread vector for attack? Probably not. Yeah one big issue I had with the article was the assertion that telling people to open a file l

> Is that the most widespread vector for attack? Probably not. Yeah one big issue I had with the article was the assertion that telling people to open a file like VacationPhotos.zip isn't something humans do. Is it common? Probably not, but there are a LOT of humans. Even 1% of them doing something makes for a huge attack surface. The vacation photos example is also probably not a very good one. How many README.md files are there out there telling someone to look in assets.zip for the webserver assets, or docs.zip for documentation? Someone seeing this is a link would likely reasonably assume it's a link to the file in the repository, and I'm sure someone more creative than me could get up to all sorts of interesting shenanigans with that (incorrect) assumption.