The odd saga of CVE-2012-5639

> Nobody expects a HTML file to be self-contained (even though it's possible), the usual case is that it depends on external resources
> (images, CSS files, etc). On the other hand, the common expectation for a document file is that it's self-contained (even though
> depending on external resources is possible), with everything (images, style files, etc) being stored within a single file.

> Personally, I'd expect that opening a document which requires external resources (be them from the network, from an
> absolute path on the C:\ drive which does not exist on my machine, or even from another file in the same directory) to
> first show me an alert dialog box, similar to the "this document contains macros, are you sure?" warning.

While the expectation that the document is self-contained, I think the expectation has been false since the mid-1990s for nearly every office suite once web-fonts became a thing. Then when the 'native' form of the documents became either XML or some form of SGML it became even harder as the DTD, fonts, macros, etc might all be referred to a list which the editor would try to find locally and then go to wherever the document said for it to go to. Many documents might have hundreds of artifacts being downloaded from the web. Starting out most of these artifacts were seen as 'wanted/needed' by the writer and viewer of the document, but only when they looked at that particular document.. so having them be 'throw-away' cache made sense versus having to put on a limited drive gigabytes of data that was barely used. [Another large complaint I remember from help desk duty in the 2000's.. I can't open this document because I need these items installed but I have no disk-space...]

Going from the amount of 'why am I getting so many pop-ups' that help desks get from people when that started getting flagged.. adding more pop-ups to say 'this is going to download content from the internet' was probably seen as either adding another 'click-thru' security item or adding more helpdesk costs which companies don't like. And like all unintended consequences, we end up with creating a security problem which isn't easily fixed.