On: LibreOffice actually works 365 days a year

> It is a bug in the `file` utility

OK but although I love the file utility, why does OpenOffice and/or CUPS rely on it to... print a file that ends with the .ps extension?

It's kinda begging for troubles.

Assuming file type by name rather than by contents opens a whole 'nother can of worms.

Content injection vulnerability is bad, and that's the core of what sniffing does. Failing randomly like in this case is mild in comparison.

Like I get that sometimes you have to do what you have to do, but sniffing should be a last resort.

Why would a tool that runs any program sent to it on a device it doesn’t know about be that concerned about being sent an invalid program?

An attacker might send a file that orders for millions of dollars of pizzas, using the fax hardware built into the printer (I’m not sure you can buy postscript printers that can fax today, but you can buy printers that can fax even today)

Tbf magic bytes are also not that helpful here