Hacker News Reader

Comment by rsync | Hacker News Reader

I’m not so sure …

If you expect a host name and you end up clicking a file instead, that seems dangerous.

But in this case, you expect to open a file and you visit a website instead? That sounds simply annoying…

Maybe this is for browsers to deal with - if there is a collision between TLD and (file extension on this system) throw up a warning?

View on HN

Exactly — and I think the danger is in website mimicking a file being opened. Which, browsers have already trained us to expect in many cases. Maybe some browser teams will implement a warning like this, that would make sense to me?

You'd be throwing a warning on nearly every domain name, including this very site we're on right now. What would be the point? Domain names are different from file system paths, full stop.

I was interested in that, and apparently that has actually been used as an attack vector in the past! https://en.wikipedia.org/wiki/COM_file#Malicious_usage_of_th... TIL.

Do you think computer users always think that's the case? I tend to come down on the side of "no, probably not" but open to other arguments.

it could be worse, if the 'website' server automatically returned / downloaded something called YourTaxReturns.zip

Just to make sure I'm following, the scenario you're worrying about is someone sends an email containing a url to "YourTaxReturns.zip". Upon visiting the site, it automatically downloads a zip file named "YourTaxReturns.zip". And then what? How is this any worse than the user downloading the zip directly? They clearly wanted to download it, given they clicked on it after all.

Reply on news.ycombinator.com