> Anything that runs on untrusted input should be run in an isolated environment.

If a colleague sends me something to review, I trust that he doesn't want to hack me. Someone can always use physical access to capture my keystrokes in some way.

> doesn't mean it's not genuinely exploitable

Agreed, so the message should be "don't run random LaTeX files from the internet or classmates or something", not "oh hey look at me annoying colleagues at work".

Malware writers might take advantage of your trust for your coworkers and spread their viruses as email attachments from trusted (infected) sources.

It's like Office macro viruses but for nerds.

Yes, but that's not a problem for LaTeX specifically.

This is being a bit paranoid, but do your colleagues pgp sign their messages? How do you know it is really coming from them?

Fair point. I mean, I do sign with PGP when I have someone's key but this often runs into trouble with spam filters or people going "I lost my key" or "I want to read it in the train and I don't have my privkey on my mobile device". So it's a valid point.

You don't need to encrypt it, just sign it - no privkey required to read a signed message, and you don't need someone else's pubkey to do so.

Of course it won't help if your coworkers don't also sign things they send to you.

and how do you know your colleague is not a spy, or a double agent, or an advanced AI seeking to take down the human race ... /paranoia

Or just has an email client that got infected with a virus. Remember Office macro viruses? How we laughed at how stupid it was that a simple word processor apparently needed vulnerable turing-complete macros?

Now we actually compile source files into documents and get surprised that someone might trick you into running malware.

Well, the article implies 'pwning coworkers' which is indeed quite immature. Do you do all your development in closed/isolated environment because of your coworkers posing threats? That sounds a bit paranoid.

> Do you do all your development in closed/isolated environment because of your coworkers posing threats? That sounds a bit paranoid.

Not because of my coworkers posing threats. And this wouldn't have to come from a coworker. Though that's what the author suggests the issue isn't limited to that which unfortunately seems to have taken the upper hand in the discussions around this.

But I do most of my development in isolated environments. Not because I don't trust my coworkers but because people can fuck up, things sneak in and can break my system or leave it vulnerable.

On the other hand, isn't pwning coworkers the basis of sound security awareness training?