I'm subscribing to a Google calendar using the new, lovely, Corinthian leather iCal on Lion, and it's asking me if I want to remove alerts, attachments, and reminders:
What do these options mean?
Attachment removal should be obvious to most - but I have no good explanation for why Alerts and Reminders are called out distinctly when to iCal they are one and the same concept.
Removing attachments means you won't download any files attached to the event and have them stored locally within iCal (and on the file system). I suppose you could be safer, too if a calendar contained a malicious or malformed attachment.
Removing alerts / reminders means your mac won't interrupt you if warnings are set for a specific event (in relation to the start time). Leaving these enabled gives me great unease since reminders are very powerful on Mac OS X.
You can open arbitrary files (including presumably an attachment assuming you can guess my short name or if wildcards are not sanitized in the process of accepting an event), applications, schedule an email to be sent by your mac without user intervention. If the person who makes an event added an email reminder to a specific event, imagine a case where 30 people accept that meeting to their personal calendar. At the designated time, the email address that was supposed to get a mail from the initial event would instead get one email each from every machine that was running as the alarm moment passes.
I imagine several Apple engineers have thought this through to ensure that I can't start a file sharing service on someone else's machine though a calendar reminder. On the surface, you are allowing someone else to operate any file, script that is already on your mac as well as let them send their canned email on your behalf should you leave your mac running.
I believe these options are generally more relevant when you are subscribing to someone else's calendar.
(Or one that you use more actively on another machine.)
For example, you might subscribe to your spouse or partner's calendar to know their schedule, but not necessarily want to auto-download the TPS reports they attach to them, or hear a duck quack 15 minutes before each of their meetings.