Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Because they already have the run of the user's profile. Why add additional complexity for less access?


Because you may of had zero access rather than some, for example a web dev who wouldn't click on an .exe but would open an .html file without a second thought. More access isn't necessarily always the end goal either.


If someone is knowledgeable enough to not open a shady exe file, they'll probably not simply open any shady files, including doc, ppt, and html


Nah, people are dumb (exhibit A: myself) and overly trusting of parsers/sandoxes.


Not true for html files. They are widely regarded as harmless.


I have never seen anyone saying HTML files are harmless, and would definitely never say it myself.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: