Cybersecurity

It's not.

Go ahead and look through your filesystem. Just random parts of it. Count the number of things you downloaded off of the Internet. And yes, all of those files you extracted from an downloaded archive still count as downloaded from the internet.

If you're using Linux, the ISO you downloaded is from the Internet. All of the security patches and updates were downloaded from the Internet. Every single web site you visit was downloaded from the Internet. If you wanted to use a new program, you downloaded it from the Internet. If you created a new file, chances are good that you used some sort of cloud-based service and it was downloaded from the Internet.

There's a reason why Apple got rid of the CD-ROM drive. Because nobody was fucking using it and everything is installed off of the fucking internet! I was going to say that I haven't touched my CD-ROM drive in ages, but then I looked down and realized that I don't even have one installed on this PC.

Putting a "Mark of the Web" on a file is functionally useless. It's like putting a boolean on a file that says "this came from a computer".

Most file systems have a very limited footprint of metadata. Static information. And they are usually following basic POSIX standards, to ensure that file transfers between mediums are as cross-compatible as possible.

This Alternative Data Stream is now creating this entirely new variable data stream for hackers to hide shit in. No longer can just you scan a file's data to make sure nothing malicious is in there. Now you need complex logic to be able to both read this new stream, interpret the flags and other metadata, and take all of those different pieces of information and figure out if it's even worth opening the damn file.

Data is data. Keep data in the data layer. Everything else is secondary, and should be kept tiny.