[Dylan16807]

I think you meant to link to http://en.wikipedia.org/wiki/Software_bloat

All file needs to do is scan for some magic bytestrings, and optionally print the numbers at a handful of offsets. It currently does much more than that, which is why it's insecure and hard to fix.

[raldi]

You say "needs" as if it's a matter of fact, but what a program needs to do is a very subjective matter.

If you feel the command does more than it needs to, could you call out a few examples of bloated features that you would cut?

[Dylan16807]

Okay, I appear to have misremembered a problem in "strings" as being in "file", where it went overboard in parsing and introduced vulnerabilities.

But I haven't seen anything to disagree with file being similarly problematic. A quote like

To sum up: If somebody uses 'file' in an unconstrained OS environment on untrusted inputs, and he gets pwnd in the result, then it's not a security problem, it's an incompetence problem - and IMO it should be discussed elsewhere.

does not suggest that the program is very well designed.

Scanning for byte strings with no possibility of security flaw is a solved problem.