Hacker News new | ask | show | jobs
by TazeTSchnitzel 1899 days ago
That is Safari's default behaviour for ZIP files. Only to extract them, though.
3 comments
sammax 1899 days ago
So whenever the program used for extracting ZIPs has a vulnerability any website could force-download a malicious ZIP and it would automatically be extracted and trigger the vulnerability...

Why is "force-download" even a thing? IMO the browser should always ask before downloading any file. Though this is not a unique Mac thing, I believe Chrome does that everywhere.

link
dividuum 1899 days ago
What happens with 42.zip and other zip bombs? https://www.bamsoftware.com/hacks/zipbomb/
link
kergonath 1899 days ago
Still a terrible idea, though.
link