Re: [EXTERNAL] Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Daniel Stenberg via curl-library
On Mon, 17 Oct 2022, Timothe Litt via curl-library wrote: If we're going forwward with this, the new behavior should be a new option. It can be a new value for the current option, I can tell you didn't look at the PR... -- / daniel.haxx.se | Commercial curl support up to 24x7 is availab

Re: [EXTERNAL] Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Timothe Litt via curl-library
On 17-Oct-22 16:57, Daniel Stenberg via curl-library wrote: On Mon, 17 Oct 2022, Dmitry Karpov via curl-library wrote: I'm all for adding an option to add the host-only behaviour as an option, but not to make it the default. Yes, I also think that this is the right way to do it. I hear you

RE: [EXTERNAL] Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Daniel Stenberg via curl-library
On Mon, 17 Oct 2022, Dmitry Karpov via curl-library wrote: I'm all for adding an option to add the host-only behaviour as an option, but not to make it the default. Yes, I also think that this is the right way to do it. I hear you. Thanks all for the feedback. If we're going forwward with t

RE: [EXTERNAL] Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Dmitry Karpov via curl-library
> I agree with Timothe that this doesn't seem worthwhile breaking backward > compatibility. I discovered only recently that browsers have changed their > behaviour in this area when a site that was depending on > receiving the full URL broke. > If someone is going to the trouble of enabling this

Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Dan Fandrich via curl-library
On Mon, Oct 17, 2022 at 04:34:05PM +0200, Daniel Stenberg via curl-library wrote: > On Mon, 17 Oct 2022, Timothe Litt via curl-library wrote: > > > > My initial PR for this work: https://github.com/curl/curl/pull/9750 > > > > > Why change the default behavior? > > For improved privacy. Because

Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Daniel Stenberg via curl-library
On Mon, 17 Oct 2022, Timothe Litt via curl-library wrote: My initial PR for this work: https://github.com/curl/curl/pull/9750 Why change the default behavior? For improved privacy. Because the browsers sort of do it like this. -- / daniel.haxx.se | Commercial curl support up to 24x7 is a

Re: On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Timothe Litt via curl-library
On 17-Oct-22 09:46, Daniel Stenberg via curl-library wrote: Hello, When setting the CURLOPT_AUTOREFERER option, libcurl automatically sets the referer: header in following request (like when following redirects) to the URL of the previous transfer. This can be considered a minor privacy lea

On CURLOPT_AUTOREFERER privacy

2022-10-17 Thread Daniel Stenberg via curl-library
Hello, When setting the CURLOPT_AUTOREFERER option, libcurl automatically sets the referer: header in following request (like when following redirects) to the URL of the previous transfer. This can be considered a minor privacy leak, especially when folllowing requests cross-orgin and to an

RE: Does support for FTP growing files work in libcurl?

2022-10-17 Thread Robert Sumner via curl-library
-Original Message- From: Daniel Stenberg Sent: 15 October 2022 23:29 To: Robert Sumner via curl-library Cc: fractal.sum...@btinternet.com Subject: Re: Does support for FTP growing files work in libcurl? On Thu, 13 Oct 2022, Robert Sumner via curl-library wrote: > I have been trying