I think it's "don't use parsers written in unsafe languages".
I think it's simpler: don't touch untrusted content unless/until you need to.
alt Hacker News
I think it's simpler: don't touch untrusted content unless/until you need to.