Hector Martin

I'm sorry, when did we go from "logged in your browser history" to "public"? Your argument is bullshit. You're saying that just because a particular thing has some (known) security caveats it's fine to gratuitously introduce more undiscoverable ones to bite people in the ass.

Sorry, but ultimately it comes down to this: curl is following the RFCs, and you are not.

Sometimes the RFCs are bullshit. If people followed the RFCs to the letter anyone could DoS any server, because they require vulnerable implementations of things like TCP. This is one of those times.

There is a huge gap between "I'm deliberately putting a password in URIs so I can paste them in a command line in the privacy of my home" to "hey browser please attach my password invisibly to every file I download so I can unknowingly hand it to someone in a USB stick"

"The RFCs say I can get away with this" doesn't mean that doing something isn't stupid. The RFCs do not aim to forbid all stupid behavior.

Except in this case, the RFCs say you shouldn't do the stupid thing, but you're insisting on the right to do the stupid thing because it's convenient, and then have software take special steps to protect you.

I'm insisting in software *not* taking dumb steps like silently shoving URIs into xattrs for no reason. This has been a thing for *years* and I only just found out. This is broken. It's not just about userdata passwords. Nobody expects download URIs to tag along files!

It's not for no reason. It's very useful to know where a file came from and record the URL along with the file download. Safari does it, DEVONthink Pro does it, Evernote does it, etc. Which is exactly why the RFCs say not to put secret info in URLs.