Gede: And I never heard of text files being a vector for infecting a system.
maxleod: The Linux installers on GOG are .sh files, which are text files. Seems you can do a lot with them...
True, text file can contain
code that can be interpreted. But you need to tell the computer,
explicitly, to run that
code as code/instructions.
Or, as I think a bit more, some advanced editors may recognized some directives written in the files for some limited per-file setting (e.g. indentation) and something more than that (Emacs Org Babel code blocks) requires a user action to trigger (and then a confirmation prompt or the prompt disabled in the options).
And some file formats could also be "text files" and embed directives that are executed when the file is loaded. So, yes, text files
have the potential to be dangerous. This seems to be your point and I agree with you, but only in very specific situations.
However, what I intended to say is that text files are
safe to look at, because they are so simple. I would feel safe opening a text file sent to me by a stranger. And there are so many text file readers and editors that, even if one program would be susceptible to a buffer overflow or other security failure, the probability of me using that program to view the file is tiny. Something similar regarding HTML files (I would be using a text editor or a browser with javascript disabled, of course).
Compare this with PDF and DOC files, that are much more complex, intricate, feature rich, feature expanding, contain logic and you have fewer programs capable of handling them.
Receiving "random" files from users
is a very big attack vector for GOG, and what could be addressed only with "best practices" (in the case of text files) now needs to be done inside an isolated environment in order to support these file types. And I wonder what do they gain from it.