How much data do I leak if I use the first bytes of a file as AES-CBC IV? I found a piece of code that uses the first 16 bytes of the input file as IV. This immediately set off some flags in my head, but I have no idea how bad it really is. So, how bad is it? Obviously we're storing the first block in plaintext as the IV, but can we get any other information out?
The danger I see with using the beginning of a file as the IV is that the beginning of files tend to be fairly predictable.  For example. Linux shell scripts tend generally have a first line of "#!/bin/bash" - 11 characters (12 counting the Linux end-of-line LF character). If each file has a separate key this isn't much of a risk, but if the same key is used for multiple files then the IV reuse can result in problems (see this question or this question, or this question for examples)