In Tangled Web Michal Zalewski says:
Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning Content-Type: text/plain.
For example, any code-hosting platform must exercise caution when returning executables or source archives as application/octet-stream, because there is a risk they may be misinterpreted as HTML and displayed inline.
The text/plain logic subsequently implemented in Internet Explorer and Safari in order to detect HTML in such a case is really bad news: It robs web developers of the ability to safely use this MIME type to generate user-specific plaintext documents and offers no alternatives. This has resulted in a substantial number of web application vulnerabilities, but to this day, Internet Explorer developers seem to have no regrets and have not changed the default behavior of their code.
X-Content-Type-Options:nosniff. Author says the following about this header:
The use of this header [X-Content-Type-Options] is highly recommended; unfortunately, the support for it [...] has only a limited support in other browsers. In other words, it cannot be depended on as a sole defense against content sniffing.
What content sniffing attacks
X-Content-Type-Options:nosniff doesn't prevent? What
Content-Type should be returned to user instead of