> A binary stream can be multiple formats at once So what? If Spartan doesn't do anything with them, it can save them to the disk: It doesn't need to know the

> A binary stream can be multiple formats at once So what? If Spartan doesn't do anything with them, it can save them to the disk: It doesn't need to know the difference between a zipfile and an xlsx sheet in order to do so. > An out-of-band content-type is the only workable solution Solution to what? I don't think "more metadata" solves anything, let alone security problems. An "out-of-band content type" declaration is just that: an unsubstantiated claim as to a valid interpretation of the bytes-in-question. Using a buggy png parser just because some other layer said it was "image/png" is where the security problems are. > auto-detection of file formats (a.k.a. ”sniffing”) has has a terrible security record. The single biggest source of security problems is code you don't need: Fix whatever program you've got that can't tolerate random bytes from the Internet, or don't give those programs random bytes you get from the Internet.