Hector Martin

"The RFCs say I can get away with this" doesn't mean that doing something isn't stupid. The RFCs do not aim to forbid all stupid behavior.

Except in this case, the RFCs say you shouldn't do the stupid thing, but you're insisting on the right to do the stupid thing because it's convenient, and then have software take special steps to protect you.

I'm insisting in software *not* taking dumb steps like silently shoving URIs into xattrs for no reason. This has been a thing for *years* and I only just found out. This is broken. It's not just about userdata passwords. Nobody expects download URIs to tag along files!

It's not for no reason. It's very useful to know where a file came from and record the URL along with the file download. Safari does it, DEVONthink Pro does it, Evernote does it, etc. Which is exactly why the RFCs say not to put secret info in URLs.

Please enumerate those useful reasons. Especially reasons to attach the URI *to the file*, not just metadata in a browser database somewhere.

This reminds me of people who get really angry when they find out about EXIF information. Look, I understand, you didn't know about it — but now you do, so the smart thing is to adjust your behavior accordingly.

At least EXIF data is inside the file, and applications display it, and it's just metadata, and pretty much every non-evil camera app has toggles for sensitive stuff like location information. Literally *nothing* advertises "hey your file has an xattr with a URI in it".

On the Mac, "get info" windows in the Finder display the source URLs of downloaded files, along with the program used to create the file, and all sorts of other arguably confidential information.