ddandd
A great introduction may be found at [0], if one is already well versed in Bayes theorom, then an excerpt [1] should be enough.
[0]: http://www.yudkowsky.net/rational/bayes
[1]: http://www.soest.hawaii.edu/oceanography/researchers/francoi...
Regarding his example, IMO, the process of saving a file has a platonic security abstraction, it is a very limited computation engine. When one is able to escape this abstraction, it is a security concern.
The distinction between a security bug and non security bug is very subtle.
An example how this violation may happen in real life. Assume a filesystem that may contain long filenames, an attacker may control it and cause remote execution. Another scenario may be a site that tells you to see an easter egg in notepad by fire up notepad and save a file named <payload>, which will do some trick and will also run arbitrary code on your machine.
Single chain Chrome RCE on unsandboxed process
Do we really want to fuse our minds together?
A New Way to Look at Networking (2006) [video]
[1] http://en.wikipedia.org/wiki/Argument-dependent_name_lookup
One Hacker Way
This repository previously included a toolchain to build a collection of eBooks, in ePub and MOBI formats, from Caltech's online edition of the Feynman Lectures. Those scripts have since been removed, in response to the suggestion that their continued availability might lead to a permanent discontinuation of HTML access.
But, I do think that the else clause on try\except blocks is less harmful. It is less harmful because the control flow complexity of exceptions handling is already there on the catch clause, so while exceptions does add big control flow changes, the addition of the else clause causes a relative minor change on the linearity of code (as it is already broken by catch: clause.)