Using a separate domain to display the attachments is a good idea. Gmail does it. It is mentioned towards the end of the blog post. However, that still doesn't

Using a separate domain to display the attachments is a good idea. Gmail does it. It is mentioned towards the end of the blog post. However, that still doesn't get rid of the vulnerability, it just makes it less dangerous. There should be a strict whitelist of allowed content types, and anything not on that list should be download only. The trouble is, people tend to put "image/*" on that list, because they don't know what an SVG is or what it can do.