Hacker News Reader

If someone is knowledgeable enough to not open a shady exe file, they'll probably not simply open any shady files, including doc, ppt, and html

Nah, people are dumb (exhibit A: myself) and overly trusting of parsers/sandoxes.

Not true for html files. They are widely regarded as harmless.

I have never seen anyone saying HTML files are harmless, and would definitely never say it myself.