The odd saga of CVE-2012-5639

> Personally I could care less about badly-run IT departments. I care about "default-secure", which (a) doesn't even need an IT department and (b) negates quite a few opportunities for incompetence.

The problem is that there's no obvious attack which can meaningfully be carried out against a user who doesn't work for some organization with an IT department,* but would be prevented by blocking external content. Sure, there are tracking pixels, but think about it: From the user's perspective, what is the negative consequence caused by a tracking pixel? The sender gets a read receipt? That's hardly worth discussing, by the time you have convinced a user to download and open an attachment. Heck, you could just put the document on your own server and tell the user to click a link to download it, then you don't even need the user to open the document. Do you really think the average non-technical user is going to notice the difference between clicking a link to download something and downloading an attachment?

* The military, the NSA, etc. are all assumed to have IT departments, so we need not concern ourselves with the "my workstation is airgapped and all the ports are filled with epoxy" stuff. Even so, that seems like a problem that solves itself ("airgapped" means no external content will load).