Hacker News Reader

I am shocked that it's considered a smart idea to make it possible to execute code from XML files (and that this is the default setting)!?

Of course it's not considered a smart idea. That's why this was fixed. It was a (critical) bug.