GNU bug report logs - #65973
[PATCH] ; send filename, not full path, on EWW form submit

Previous Next

Full log

View this message in rfc822 format

From: Stefan Kangas <stefankangas <at> gmail.com>
To: Jim Porter <jporterbugs <at> gmail.com>, Eli Zaretskii <eliz <at> gnu.org>,  Sebastián Monía <sebastian <at> sebasmonia.com>
Cc: ozzloy <at> challenge-bot.com, 65973 <at> debbugs.gnu.org, ozzloy <at> gmail.com
Subject: bug#65973: [PATCH] ; send filename, not full path, on EWW form submit
Date: Wed, 6 Nov 2024 23:30:54 +0000

Jim Porter <jporterbugs <at> gmail.com> writes:

> On 11/5/2024 9:08 AM, Eli Zaretskii wrote:
>
>> I'd like some rationale for this change.  The original report never
>> explains why sending the full absolute file name to the server is bad.
>
> I see three possible reasons: 1) there could be (probably minor) privacy
> issues with sending the directory structure along to a server;

From a privacy perspective, I don't think this we can really consider
this as a minor issue.

Users commonly use their full names, or another similarly unique
identifier, as their login name.  It goes without saying, that sending a
string such as "/home/myfullname/some/file" to a remote host completely
defeats all notions of preserving user privacy.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.