Regarding the 'macros should NOT be stored in documents'.

Surely this is a little strong. It should be possible to store macros in documents IMO, BUT the macros should be effectively sandboxed such that they can only (a) deal with the document containing the macro OR (b) create a new document, and cause actions to be done on THAT document (and, at the option of the macro in the creating document, allow macros in the new document to affect the old document). Anything more than this MUST require a separate template-like system for 'more powerful' macros. etc. etc.

Basically this is a 'tainting' system for the effects of macros so that a macro can only affect a document that 'trusts' it. But I think that simply banning macros is a little heavy handed --- most are harmless, useful and convenient to have in the relevant document, and one need not necessarily ditch macros in documents lock, stock and barrel.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/315/10152#10152