3 ms·
A downloaded file loading remote resources automatically (without prompting) can be a big problem, which is why nearly every other piece of productivity softwar
by blincoln 3y ago
A downloaded file loading remote resources automatically (without prompting) can be a big problem, which is why nearly every other piece of productivity software has prompted before doing so for many years.
E.g. if someone built an API that used LibreOffice code to convert Office files to PDFs and hosted it using AWS, would they think to check to see if someone can reference the metadata URL and read their EC2 instance credentials? Or reference file:// URIs and read from the server's filesystem?
- charcircuit 3y agoSo is the problem that a random bash script can run "rm -r ~/*" and delete all of your files or a random exe on Windows can encrypt all of your files and ask for a ransom. The capabilities to do these bad things stems from a poor security model that does not fit the user's wants and needs. The capabilities are not coming from a vulnerability.